Privacy Policy

1. Introduction

This Privacy Policy explains how Capzul Health Solutions Pvt. Ltd. ("capzul", "we", "us", or "our"), which operates the capzul mobile application and the website at capzul.in (together, the "Platform"), collects, uses, shares, and protects your personal data when you use our medicine-ordering, delivery, and related services (the "Services"). We act as a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). By using the Platform, you confirm that you have read and understood this Policy. Please also read our Terms & Conditions.

2. Scope

This Policy applies to all users of the capzul Platform in India. It does not apply to any third-party websites, apps, or services that we may link to, which are governed by their own privacy policies.

3. The data we collect

• Identity and account data, your name, mobile number, email address, date of birth, gender, and password.
• Delivery and location data, your delivery addresses and, with your permission, your device location (GPS) to enable delivery and to find nearby Partner Pharmacies.
• Health and prescription information, prescriptions you upload, the medicines and health products you order, dosage and refill schedules, any chronic-condition information you choose to share, and details of your prescribing doctor. This is the most sensitive information we handle and we treat it with particular care.
• Order and transaction data, your order history, invoices, amounts, and delivery records.
• Payment data, we use third-party, PCI-DSS-compliant payment processors. We do not store your full card or UPI credentials; we may retain limited details such as transaction identifiers or the last four digits of a card.
• Device and usage data, your IP address, device identifiers, app version, operating system, and how you interact with the Platform, collected through analytics and similar tools.
• Communications, your messages, calls, and chats with our support team (including via WhatsApp) and any feedback you provide.

4. How we collect your data

We collect data directly from you when you register, place an order, or contact us; automatically through your use of the Platform; and from Partner Pharmacies, delivery partners, or your prescribing doctor where relevant to fulfil your order.

5. Why we process your data

We process your personal data to:

• create and manage your account;
• receive, route, and fulfil your orders through licensed Partner Pharmacies and deliver them to you;
• verify prescriptions as required by law before dispensing prescription medicines;
• provide chronic-care features such as refill reminders and "never run out" support, where you opt in;
• process payments, generate invoices, and manage refunds;
• provide customer support and respond to your queries;
• send you service communications such as order updates and important notices, and, with your consent, offers and product updates;
• maintain the safety, security, and integrity of the Platform and prevent fraud or misuse; and
• comply with applicable laws, including the DPDP Act, the Drugs and Cosmetics Act, 1940, and tax laws, and respond to lawful requests from authorities.

We process your data only for the purposes for which you have given consent, or as otherwise permitted under the DPDP Act, including certain legitimate uses.

6. Consent and your choices

We rely on your consent to process your personal data. You may withdraw your consent at any time through the app or by contacting us, although this may limit our ability to provide some or all of the Services.

Processing your prescription is necessary to fulfil orders for prescription medicines. Where we process the data of a child (a person under 18 years of age), we require the verifiable consent of a parent or lawful guardian, and we do not carry out behavioural tracking or targeted advertising directed at children.

7. How we share your data

We share your personal data only as needed to provide the Services:

• Partner Pharmacies, to verify your prescription and to prepare and dispense your order. The Partner Pharmacy that accepts your order is the seller and dispenser of record for your medicines.
• Delivery partners, limited information (such as name, address, and contact number) needed to deliver your order.
• Payment processors, to process your payments securely.
• Service providers (data processors), cloud hosting, communications, analytics, and customer-support providers who process data on our behalf under contracts that require appropriate security and confidentiality.
• Legal and regulatory authorities, where required by law, court order, or to protect rights, safety, or prevent fraud.

We do not sell your personal data to anyone.

8. Prescriptions and medicine safety

Certain medicines, including Schedule H, H1, and X drugs, may be dispensed only against a valid prescription from a registered medical practitioner. We and our Partner Pharmacies may verify your prescription and may decline or cancel an order where a valid prescription is not provided. We retain prescription records as required under applicable pharmacy and drug laws.

9. Data security

We implement reasonable technical and organisational safeguards, including encryption in transit, access controls, and secure infrastructure, designed to protect your personal data. No system is completely secure, however, and we cannot guarantee absolute security.

10. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Services, and thereafter only for as long as required to meet legal, accounting, tax, or regulatory obligations (for example, retention of prescription and invoice records). After that, we delete or anonymise it.

11. Your rights

Subject to the DPDP Act, you have the right to: obtain a summary of the personal data we process about you; request correction, completion, or updating of your data; request erasure of your data; nominate another individual to exercise your rights in the event of your death or incapacity; and raise a grievance. To exercise these rights, contact our Grievance Officer (details in clause 17). We will respond within the timelines required by law.

12. Children

The Services are intended for users aged 18 and above. Where medicines are ordered for a minor, this must be done by a parent or lawful guardian. We process a child's personal data only with verifiable parental or guardian consent and in accordance with the DPDP Act.

13. Cross-border transfers

Your data is primarily processed in India. Where we use service providers located outside India, we transfer your data in accordance with the DPDP Act and any restrictions notified by the Government of India.

14. Cookies and analytics

Our website and app may use cookies, SDKs, and similar technologies to operate the Platform, remember your preferences, and understand usage. You can manage cookies through your browser or device settings.

15. Data breaches

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in accordance with the DPDP Act and the DPDP Rules.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Platform and, where appropriate, notify you. Your continued use of the Services after the changes take effect constitutes acceptance.

17. Grievance Officer and contact

In accordance with the DPDP Act and applicable IT rules, you may contact our Grievance Officer for any questions or complaints about your personal data:

Note: If capzul is later classified as a Significant Data Fiduciary under the DPDP Act, a Data Protection Officer based in India must also be appointed and named here.

18. Governing law

This Policy is governed by the laws of India, and any disputes are subject to the courts at Chandigarh.