Skip to content
PharmaBells

Legal

Privacy policy

Last updated 24 September 2026

This Privacy Policy describes how Cyberbells ITES Services Pvt Ltd (“Cyberbells”, “we”, “us”, “our”) collects, uses, stores, shares and protects information when you use the PharmaBells website (https://pharmabells.com), the PharmaBells web application and the PharmaBells mobile applications (together, the “Platform”). It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) and the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

By registering on, accessing or using the Platform you consent to the collection, use, storage and disclosure of your information as described in this Policy. If you do not agree, please do not use the Platform.

1. Definitions

  • “User”, “you” — a pharmacy, medical store, clinic or hospital counter (the “Subscriber”) and each individual who signs in under its account (its “Staff”).
  • “Customer Data” — information a Subscriber records about its own customers and patients: names, phone numbers, prescriptions, doctor references, purchase history, loyalty and wallet balances.
  • “Personal Information” — information that identifies a natural person, as defined under the SPDI Rules and the DPDP Act.
  • “Sensitive Personal Data” — passwords, financial information, and physical, physiological and mental health information, as defined under Rule 3 of the SPDI Rules. Prescription and medicine purchase records are treated as Sensitive Personal Data.

2. Information we collect

2.1 Information you give us. When you register or use the Platform you provide:

  • Business details — pharmacy name, legal name, address, GSTIN, PAN, drug licence numbers, FSSAI number and scans of those documents.
  • Account details of each Staff member — name, email, mobile number, role, and the password you choose (stored only as a one-way hash).
  • Operational data — medicines, batches, stock, purchases, suppliers, sales invoices, expenses, employee and attendance records.
  • Customer Data you enter at the counter, including prescriptions and referring doctors.
  • Support requests and any correspondence with us.

2.2 Information collected automatically. When you use the Platform we record sign-in times, IP address, device and browser type, the store selected, and an audit trail of actions taken in your account (who created, changed or deleted what, and when). The website itself sets no advertising or analytics cookies; the application uses only the cookies and local storage needed to keep you signed in.

2.3 Payment information. Subscription payments are processed by Razorpay Software Private Limited. Your card, UPI or bank details are entered on Razorpay’s secure pages and are never seen or stored by us. We receive only a payment reference, the amount, the method and a masked identifier.

2.4 Information we do not collect. We do not collect information from anyone under 18 years of age and we do not collect Customer Data from your customers directly; it enters the Platform only through you.

3. How we use information

  • To provide and operate the Platform: billing, stock, reports, notifications, printing and emailing invoices, licence reminders.
  • To create and secure accounts: verifying email and mobile, detecting unusual sign-ins, revoking sessions, rate-limiting.
  • To bill your subscription, issue GST invoices, and send renewal, payment and plan notices.
  • To respond to support tickets and communicate service updates, security notices and changes to this Policy.
  • To improve the Platform, using aggregated and de-identified usage patterns that cannot identify a pharmacy or a person.
  • To comply with law, including tax law and lawful requests from authorities.

We do not sell Personal Information or Customer Data. We do not use your Customer Data to market to your customers, and we do not use it to train models or build profiles of patients.

4. Customer Data — you are the data fiduciary

For the Customer Data you record, you decide why and how it is collected and are the data fiduciary under the DPDP Act; we process it on your instructions as a data processor. You are responsible for informing your customers, obtaining any consent required, and honouring their requests to access or erase their data. The Platform gives you the tools to do so: customer records can be viewed, exported, corrected and deleted from the application. Any message the Platform sends to your customers on your behalf (an emailed invoice, a loyalty notice) is sent because you asked it to.

5. Sharing of information

We share information only with the following, and only to the extent needed to run the Platform:

  • Infrastructure providers — cloud hosting, database and backup services, located in India where available.
  • Payment processor — Razorpay, for subscription payments and refunds.
  • Communication providers — email and SMS delivery services, for transactional messages you or the Platform trigger.
  • Professional advisers and successors — in a merger, acquisition or restructuring, under confidentiality, with notice to you.
  • Authorities — where required by law, court order or a lawful request from a government agency.

Each provider is bound by contract to use the information only to provide its service to us. A current list of sub-processors is available on request from the contact below. We do not share Customer Data with pharmaceutical manufacturers, distributors, advertisers or data brokers.

6. Retention

  • Account and operational data is retained for as long as your subscription is active.
  • After your subscription ends or you close your account, data is retained for 90 days so you can export it or reactivate, then deleted or irreversibly de-identified.
  • Records we must keep by law — tax invoices for your subscription, payment records — are retained for the period the law requires (currently eight years under GST law) and no longer.
  • Audit logs and sign-in records are retained for 12 months.

7. Security

We follow reasonable security practices and procedures as required by Section 43A of the IT Act and the SPDI Rules: all traffic is encrypted in transit (TLS); passwords are stored as salted one-way hashes; each Subscriber’s data is logically isolated; access to production systems is limited to named staff and logged; sessions can be reviewed and revoked by you; sign-in attempts are rate-limited and accounts lock after repeated failures; backups are taken daily. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your password private and give each Staff member their own login — shared logins defeat the audit trail kept for you.

If we become aware of a breach of Personal Information that is likely to cause harm, we will notify affected Subscribers and the Data Protection Board of India as the DPDP Act requires.

8. Your rights and choices

  • Access and correction — view and update account and business details from Settings at any time.
  • Portability — export your data as CSV from every list in the application.
  • Erasure — delete your account from Settings or the app (see Delete your account) or by writing to us; see Retention above.
  • Withdraw consent — you may withdraw consent by closing your account; the Platform cannot operate without the information described in Section 2.1.
  • Communications — transactional messages (invoices, security notices, renewal reminders) are part of the service. Product and marketing emails can be switched off from your notification preferences or the unsubscribe link in any such email.
  • Grievance — raise any concern with the Grievance Officer below; we respond within the time the law requires.

9. Children

The Platform is for businesses and is not directed at, and may not be used by, anyone under 18. If we learn that an account has been created by a minor we will close it and delete the associated information.

10. Cookies

The website (https://pharmabells.com) sets no cookies. The application uses strictly necessary cookies and browser storage to keep you signed in, remember your selected store and hold an unfinished bill. You can clear them from your browser at any time; doing so signs you out.

11. Links and third-party services

The Platform links to Razorpay for payment and may link to other sites. Their privacy practices are their own and are governed by their policies, which we encourage you to read.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced in the application and by email to the Subscriber’s registered address at least 15 days before they take effect. The “last updated” date at the top shows the current version. Continued use after the effective date is acceptance of the updated Policy.

13. Grievance Officer

In accordance with the IT Act, 2000, the SPDI Rules and the DPDP Act, 2023, the contact details of the Grievance Officer are:

  • Name: Akhil Kumar
  • Company: Cyberbells ITES Services Pvt Ltd
  • Email: akhil.cyberbells@gmail.com
  • Phone: +91 75600 29425 (Mon–Sat, 10am–7pm IST)
  • Address: 1st & 2nd Floor, SCO 11, Industrial Area Phase II, Chandigarh 160002, India

Complaints are acknowledged within 48 hours and resolved within 30 days of receipt.

14. Governing law

This Policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts at Chandigarh, subject to the arbitration clause in our Terms of Service.