Privacy Policy

1. Information We Collect

1.1 Account and Authentication Data

When you register for an account, we collect:

• Email address
• Password (stored as a one-way cryptographic hash; we cannot read your password)
• Last login date and time

1.2 Business Information

When you set up your store, we collect:

• Business name, type (medical store, pharmacy, clinic, hospital, or diagnostic center), and a unique business identifier
• Business address, city, state, and pincode
• Primary contact person's name, phone number, and email
• GSTIN and drug license number (if provided)
• Subscription and billing details

1.3 Data You Enter About Your Customers

As a pharmacy management tool, MedStore App allows you to record information about your customers. This may include:

• Customer name, phone number, email, and address
• GSTIN (for business customers)
• Date of birth and gender
• Medical history (free-text notes you choose to enter)

You are the data controller for your customer data. We process it solely to provide the service to you and do not use it for any other purpose.

1.4 Vendor and Supplier Data

You may store your suppliers' names, addresses, phone numbers, email, GSTIN, and drug license numbers.

1.5 Financial and Inventory Data

The app stores invoices, customer bills, payment records, stock transactions, and inventory details that you create during normal use of the platform.

1.6 Automatically Collected Data

• Audit trail of actions performed within the app (for your own accountability)
• Anonymous usage statistics via Google Analytics — on our website and web portal only. The offline Android app contains no third-party analytics, advertising, or tracking SDKs; it sends only a minimal first-party technical status beacon that carries no business or customer data (see Section 2.3).
• Cookies for session management and authentication (website and web portal)

2. The Offline Android App — Permissions & On-Device Storage

2.1 Your data stays on your device

The offline MedStore App stores your business data — stock, batches, customer bills, invoices, customers, and suppliers — locally on your device, in a database on the device itself. Your business data is not transmitted to or stored on our servers during normal use. The only times the app connects to our service are:

• Activation — a one-time device-code pairing to activate your app against your account.
• Optional cloud invoice scan — if, and only if, you choose to use the invoice-scan feature, the specific invoice image you select is sent to our service to be read, and the result is returned to your device.
• Periodic technical status beacon — a small, best-effort message about the app and device (never your business data), described in Section 2.3.

2.2 Permissions the app uses

• Internet — used for activation, the optional cloud invoice scan, and the periodic technical status beacon described below.
• Device authentication (biometric / screen lock) — used to protect access to the app. Fingerprint/face verification is performed entirely by Android; your biometric data is never accessed by, shared with, or stored by us.

The app does not request the Camera permission. When you capture an invoice photo, the app opens your device's own camera app, which returns the picture — the picture is saved on your device and is only sent to us if you use the optional cloud scan. When you import a file, you pick it through Android's system file picker; the app does not request broad access to your storage. The app triggers no permission prompts on start-up, and requests no location permission, contacts, microphone, or advertising identifiers (an approximate city/region is inferred from your IP address on our servers only, as described in Section 2.3 — the app itself accesses no device location).

2.3 Technical status beacon

About once a day, when the device happens to have an internet connection, the app sends our servers a small technical message so we can operate device licensing, understand how many devices are active, provide support, and detect misuse of licences. The attempt is best-effort — if there is no connection it is simply skipped, with no retry, and the app works exactly the same either way. This beacon contains only:

• App version and build number
• Device and activation identifiers — a randomly-generated device ID and, if your device is activated, its pairing/device code
• Licence and trial status (for example: on trial, trial ended, or activated) and days remaining
• Device model and Android version
• Your internet (IP) address, and an approximate location (city/region) derived from it on our servers

It contains no business or customer data — no stock, invoices, bills, customers, suppliers, or anything you enter into the app; those never leave your device. We do not collect precise or GPS location, and the app requests no location permission. This information is used solely to run our licensing, for our own analytics and support, and to prevent licence abuse; it is not sold or shared with third parties.

2.4 Saving a copy, restoring and deleting your data

Save a copy of my data. In the offline app you can save a copy of your data as a .zip file to a place you choose on your phone, for example Files, Google Drive or WhatsApp. You can later restore it inside the app using "Restore from a saved copy". Saving and restoring work without internet. We do not receive the copy. We never see where you save it.

The saved copy is not encrypted. It contains your business and customer data, so keep it safe and share it only with people you trust.

Android system backup. Android's automatic system backup does not include your store data in the offline app. To keep a backup of your data, use "Save a copy of my data" regularly.

Deleting. Your business data lives on your device. Uninstalling the app deletes the data on your phone. We cannot recover it for you, because we never receive it. If you want to keep it, save a copy first.

3. How We Use Your Information

• To provide, operate, and maintain the MedStore App platform
• To authenticate your identity and secure your account
• To process your subscription and billing
• To provide customer support when you contact us
• To send important service-related communications (e.g., subscription expiry, system updates)
• To improve our platform based on anonymous usage patterns

We do not use your data or your customers' data for advertising, profiling, or selling to third parties.

4. Health Data

MedStore App allows you to optionally record medical history notes about your customers. This data:

• Is entered voluntarily by you (the store operator)
• Is stored in your isolated tenant database accessible only by your account
• Is never shared with other tenants, third parties, or used by us for any purpose beyond providing the service
• Is never used for research, analytics, or marketing
• Can be deleted by you at any time through the app

5. Data Storage and Security

• For the web portal, your data is stored on servers located in India. For the offline Android app, your business data is stored on your own device (see Section 2.1) and is not held on our servers during normal use.
• Each business tenant has an isolated database; your data is never mixed with other tenants' data
• Passwords are stored using one-way cryptographic hashing (bcrypt) and cannot be reversed
• All communication between your device and our servers is encrypted using TLS/HTTPS
• Authentication uses industry-standard JSON Web Tokens (JWT) with RS256 signatures
• We conduct regular access reviews to limit who can access production systems

6. Third-Party Services

We use the following third-party services:

• Google Analytics — For anonymous website usage statistics. Google's privacy policy applies to this data.
• Razorpay — For payment processing. We do not store your payment card or bank details. Razorpay's privacy policy governs payment data.

We do not sell, rent, or share your personal data with any other third party.

7. Data Retention

7.1 While Your Account is Active

Your account and business data is retained for as long as your account is active. You can download all your data at any time through the "Download My Data" feature in your account settings.

7.2 Account Deletion Process

When you request to delete your account:

• Your account is marked for deletion, and a 60-day scheduled deletion window begins
• During these 60 days, all your personal data, business information, customer records, and store data are retained
• You can cancel the deletion request within 30 days of submitting it, which will restore your account immediately
• After 60 days have passed, all personal data and store data is permanently deleted and cannot be recovered

7.3 Subscription Cancellation

If you cancel your subscription (without requesting account deletion), your data is retained for 90 days in case you wish to reactivate, after which it is permanently deleted.

7.4 Audit Trail and Logs

Audit trail records of actions performed within your account are retained for the lifetime of your account. These are deleted when your account is permanently deleted.

7.5 Immediate Deletion

You may request immediate deletion of your data (without the 60-day waiting period) by contacting us with a written request (see Section 10).

8. Your Rights

You have the right to:

• Access your personal data at any time through your account dashboard
• Download My Data — Export all your store data, customer records, and business information from your account at any time using the "Download My Data" feature available in your account settings
• Correct any inaccurate information through the app settings
• Delete your account and all associated data through the account deletion request (60-day retention period applies), or request immediate deletion by contacting us at info@progalaxyelabs.com
• Withdraw consent for optional data processing (such as analytics cookies)

To exercise any of these rights, contact us using the details in Section 10.

9. Geographic Scope

MedStore App is available only in India. All data is stored and processed on servers located in India in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

• Email: info@progalaxyelabs.com
• Phone: +91 7075190199

Operated by: Progalaxy eLabs, India

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the revised policy.