Privacy Policy
Your trust is at the core of PILLS. This Policy explains what we collect, why, and how we protect it — including how long we keep it and how you can delete it.
What we collect
Account details (name, email, phone), addresses, prescriptions you upload, order history, payment confirmations (we never store card numbers — Zoho Payments tokenises them), device tokens for push notifications, and basic analytics.
Why we collect it
To fulfil your orders, verify prescriptions, prevent fraud, predict refills, comply with regulatory requirements (Drugs & Cosmetics Act, IT Act), and improve our products.
How we protect it
Encryption-at-rest (AES-256) and in-transit (TLS 1.3), prescription watermarking on upload, MongoDB role-based access for staff, mandatory 2FA for admins, periodic third-party security audits.
Who we share it with
Only with: (a) verified pharmacists for prescription review, (b) Shiprocket for fulfillment, (c) Zoho Payments for payment processing, (d) Indian regulators when legally compelled. We never sell your data.
Your rights
Request export, correction or deletion of your data anytime via Account → Security → Data requests. We respond within 30 days.
Data Retention Policy
We retain personal information only for as long as necessary to provide our services, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.
- Account data: Retained until the user deletes their account.
- Prescriptions (Rx), Orders & Invoices: Retained for 5 years in accordance with applicable pharmacy and legal record-keeping requirements.
- Health information & medication reminders: Retained until the user deletes their account or requests deletion.
- AI chat logs: Retained for 90 days, after which they are automatically deleted unless required for security or legal compliance.
- Support tickets: Retained for 2 years for customer service, dispute resolution, and compliance purposes.
Account & Data Deletion
Users may request account or personal data deletion by emailing support@pills.asia. We will action verified requests within 30 days, except where a longer retention period is required by law (e.g., pharmacy Rx records). Where legal retention applies, we will anonymize or restrict processing of the data instead of deleting it, and delete it fully once the retention window elapses.