This policy explains what ring2doc Pharmacy (the “App”, also at bill.ring2doc.com) collects, why, who we share it with, how long we keep it, and your rights. It follows India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. The App is for pharmacies and their staff and is not meant for anyone under 18.
1. Who is responsible
MUSKAN KAMBOJ (Proprietor, trading as ring2doc), 10th Floor, Tower B1, DLF World Tech Park, NH8, Block A, Sector 30, Gurugram, Haryana 122001. For the shop owner’s and staff’s own data we are the Data Fiduciary. For the data about your customers that you type into the App, you (the chemist) decide why it is collected and we process it for you.
2. What we collect
- Shop owner and staff accounts: name, mobile number, email, hashed password, shop name, address, drug licence and GSTIN you enter, staff logins and roles.
- One ring2doc account: one account per person signs you in to every pharmacy, clinic and ring2doc app (Pharmacy and OPD) you use or are invited to. Your name, email, mobile number and password are kept once, on that account; each shop or clinic sees only its own records.
- Sign-in records: for each sign-in to your account, the time, the device and browser, the app, the approximate place worked out from the IP address, and the IP address, so we can email you when your account is used on a new device and show you your recent sign-ins.
- Your customers’ details: names and mobile numbers you put on bills or in the customer ledger, and what they bought.
- Prescriptions: when a clinic you are linked with sends a prescription, we show you its patient name, medicines, dosages and instructions so you can bill it.
- Bills and stock: bills, credit notes, purchases, medicine stock, batches, expiry, prices and GST data.
- Payments: wallet top-ups, bill payment links and Razorpay reference numbers. Customers’ card and UPI payment details are handled by Razorpay; we never see or store them.
- Payout KYC (only if you turn on online payments): your PAN number, bank account number, IFSC and beneficiary name, GST number if any, your address, and photos of your PAN card, GST certificate, business registration certificate (for a partnership or company) and an optional cancelled cheque or passbook. These are sent to Razorpay to open your payout account, and the photos are stored in our file storage (Cloudflare R2).
- Your UPI ID: the UPI ID, payee name and QR image you set under “UPI QR at counter”, so your counter QR and bills can show them.
- Purchase-bill photos: only when you choose “Scan invoice”, the photo of your supplier’s bill is sent to read it (see section 4).
- Technical data: IP address, device and browser type, app version, a push-notification token and error and request logs, for security and to deliver alerts.
3. Device permissions and why
- Camera: to scan medicine barcodes and to photograph a supplier bill. Barcode frames are read on your phone and are not saved or uploaded.
- Contacts: only when you tap “Pick from phone contacts”. You choose one contact and only its name and number fill the bill. Your address book is never uploaded.
- Bluetooth (nearby devices): to connect to your own thermal printer. Nothing about Bluetooth is sent to us.
- Fingerprint / face / screen lock: for the optional app lock. This stays on your device and is never sent to us.
- Notifications: to alert you to new prescriptions and to account events.
- Internet access: to sync your shop’s data.
4. Why we use it, and who we share it with
We use data to run the App for you: to sign you in, make and send bills, keep stock, sync between devices, collect payments, send alerts, prevent fraud, meet legal duties and fix faults. We do not sell personal data and we do not use it for advertising. We share the minimum needed with these providers:
- Railway and Vercel — hosting, the database and the app’s web delivery.
- Cloudflare and Cloudflare R2 — network protection and file storage.
- Razorpay — payments and bill payment links.
- MSG91 — SMS (sign-in codes and bills you send).
- Resend — email (codes and bills you send).
- Meta (WhatsApp Business Platform) — delivers WhatsApp bills and messages you choose to send; the recipient’s number goes to Meta for this.
- Expo / EAS — Android app updates and push notifications; an anonymous installation ID and push token.
- Sentry — error monitoring: when our servers hit an error, a technical report (which request failed, not your bills) is sent to Sentry.
- Pusher — live updates, for example a new prescription arriving.
- Google Cloud — reads supplier-bill photos you choose to scan. Only that photo is sent.
We do not share data with anyone else except where the law or a court requires it.
5. Security
Data travels over HTTPS (TLS). Passwords are stored only as one-way hashes. Access to production data is limited to authorised people. No system is perfectly secure, so please protect your password and lock your device.
6. How long we keep it
We keep your account data while your account is open. Bills, credit notes, GST data and wallet records are statutory records: the law requires us to keep them for 72 months (GST), and they are retained even after you delete your account. Also kept after deletion: the KYC you submitted for payouts (anti-money-laundering rules), the patient’s name on any bill that has a Schedule H, H1 or X medicine, which the Drugs and Cosmetics Rules require us to keep for 3 years from the sale, and a one-way fingerprint of the owner’s email and mobile number, so the ₹10 welcome credit is given only once. Security and request logs are kept for a short, rolling period; sign-in records (device, browser, approximate place and IP address) for 90 days. Other personal data is erased or anonymised after deletion, as set out below.
7. Deleting your account
- In the App: the shop owner can use Settings → Delete account and confirm with an email code. The account is closed straight away and nobody can sign in. For 30 days you can restore it from the link we email you, or write to us; after that, personal data is erased. If your message wallet still has money, write to us for a refund before you delete.
- On the web: ring2doc.com/delete-account, no sign-in needed. Staff can also ask there; shop owners can remove staff logins in Settings.
- Statutory records described in section 6 are kept, without the details we are not required to keep.
8. Your rights
You may ask to access the personal data we hold about you, correct it, erase it (subject to the legal retention above), withdraw consent, nominate someone to act for you if you cannot, and complain about how your data is handled. Your customers may ask the same of you as the shop; we help you answer. Write to us at the email below.
9. Children
The App is for adults running a pharmacy. We do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.
10. Changes
We may update this policy. The date at the top shows the current version, and material changes are shown in the App before they apply.
11. Grievance Officer and contact
Grievance Officer: Muskan Kamboj
Email: support@ring2doc.com · Phone: +91 93065-14494
MUSKAN KAMBOJ (Proprietor, trading as ring2doc), 10th Floor, Tower B1, DLF World Tech Park, NH8, Block A, Sector 30, Gurugram, Haryana 122001
We acknowledge complaints and reply within 7 working days. If you are not satisfied, you may approach the Data Protection Board of India.