Privacy Policy

    Rxkhoj is committed to protecting your privacy. This policy explains exactly what data we collect, why we collect it, how we use it, and what rights you have. We do not sell your personal data to anyone.
  

Who We Are
Data We Collect
How We Use Your Data
Who We Share Data With
Data Retention
Security
Your Rights
Children's Privacy
Changes to This Policy
Contact Us

1. Who We Are

Rxkhoj ("we", "our", "us") is a technology platform that connects patients looking for medicines with verified local pharmacies in real time. We operate the Rxkhoj mobile application and the web portal at rxkhoj.com.

Data Controller: Rxkhoj
Contact: admin@rxkhoj.com
Website: https://rxkhoj.com

This Privacy Policy applies to all users of the Rxkhoj mobile application ("App") and the Rxkhoj web portal ("Portal"), including patients and pharmacies.

2. Data We Collect

2.1 Patient App Users

Data	Why We Collect It	Required?
Mobile phone number	Account creation and OTP-based login	Yes
Device location (latitude/longitude)	To find pharmacies near you when you submit a medicine request	Yes, for requests
Medicine name, quantity, variant, urgency	To broadcast your medicine request to nearby pharmacies	Yes, for requests
FCM push token	To send you push notifications when a pharmacy responds	Auto-collected on login
Request history	To show you your past medicine requests	Auto-collected
Ratings and feedback	To help improve pharmacy quality on the platform	Optional

2.2 Pharmacy Portal Users

Data	Why We Collect It	Required?
Pharmacy name, address, city	Profile and discovery by patients	Yes
Contact phone, WhatsApp number	Patient-pharmacy communication after a confirmed order	Yes
Email address	Account login, weekly reports, notifications	Yes
Service area (location polygon or radius)	To route relevant medicine requests to your pharmacy	Yes
Request responses and history	Dashboard, analytics, weekly reports	Auto-collected
Drug licence number	Verification during registration	Yes

2.3 Automatically Collected Data

App version and device operating system type (for debugging)
Time and date of requests and responses
Error logs (no personal data included in error logs)

      We do not collect: payment card details, Aadhaar numbers, PAN numbers, medical history, prescriptions, or any biometric data.
    

3. How We Use Your Data

To provide the service: Matching medicine requests to nearby pharmacies, sending notifications, enabling communication between patients and pharmacies.
To verify pharmacies: Confirming registration details, drug licence, and service area before approving pharmacy accounts.
To send push notifications: Notifying patients when a pharmacy responds and pharmacies when a new request arrives in their area.
To send weekly demand reports: Pharmacies receive a Monday email summarising medicine demand in their service area. No patient personal data is included in these reports — only aggregated, anonymised demand data.
To improve the platform: Understanding usage patterns, fixing bugs, and improving features. All analysis uses anonymised or aggregated data.
To comply with legal obligations: We may retain data as required by Indian law.

We do not use your data for advertising, profiling, or selling to third parties.

4. Who We Share Data With

4.1 Between Platform Users (by design)

When a patient confirms a pharmacy offer, the pharmacy receives the patient's phone number to enable direct contact. This is a core feature of the service and is consented to at the time of confirmation.

Pharmacies never see a patient's full name, Aadhaar, address, or any other personal information beyond what is needed for the specific medicine order.

4.2 Third-Party Service Providers

Provider	Purpose	Data Shared
Google Firebase (FCM)	Push notifications	Device push token only — no personal data
Fast2SMS / SMS provider	OTP delivery	Mobile number and OTP only
SMTP email provider	Transactional emails to pharmacies	Pharmacy email address

We do not share your data with any other third parties. We do not use Google Analytics, Facebook Pixel, or any advertising SDKs.

4.3 Legal Requirements

We may disclose data if required by law, court order, or government authority in India.

5. Data Retention

Patient accounts: Retained as long as the account is active. Deleted within 30 days of an account deletion request.
Medicine requests: Retained for 12 months for analytics and dispute resolution, then permanently deleted.
Pharmacy accounts: Retained for the duration of the business relationship plus 3 years for legal compliance.
Location data: Location is captured at the time of each medicine request and stored as part of that request. It is not tracked continuously.
OTPs: Expire within 10 minutes and are never stored after verification.

6. Security

All data is transmitted over HTTPS/TLS encryption.
Passwords are hashed using bcrypt — we never store plain-text passwords.
Our servers are hosted in secure data centres. Access is restricted to authorised personnel only.
JWT tokens expire after a short period and require refresh for continued access.
We do not log tokens, OTPs, mobile numbers, or location coordinates in our application logs.

While we take all reasonable precautions, no system is 100% secure. In the event of a data breach affecting your personal data, we will notify affected users as required by applicable law.

7. Your Rights

Under the Information Technology Act, 2000 and its amendments, and consistent with global best practices, you have the following rights:

Right to access: Request a copy of the personal data we hold about you.
Right to correction: Ask us to correct inaccurate personal data.
Right to deletion: Request deletion of your account and personal data.
Right to withdraw consent: You may withdraw consent to location sharing at any time via your device settings — note this will prevent medicine requests from functioning.
Right to opt out of notifications: Disable push notifications via your device settings at any time.

To exercise any of these rights, email us at admin@rxkhoj.com. We will respond within 30 days.

8. Children's Privacy

Rxkhoj is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at admin@rxkhoj.com and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users via email or in-app notification. Continued use of Rxkhoj after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

For any privacy-related questions, requests, or complaints:

Rxkhoj Privacy Team

📧 admin@rxkhoj.com

🌐 https://rxkhoj.com

We aim to respond to all privacy requests within 30 days.