Med99 is a pharmacy management and billing service operated by Qubelex Private Limited ("Med99", "we", "us", "our"). This policy explains what personal data we collect through the Med99 website (med99.in), the Med99 Android app and the Med99 web app (web.med99.in) (together, the "Service"), why we collect it, and the choices you have.
This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, as applicable. By using the Service you agree to this policy. If you do not agree, please do not use the Service.
1. Two kinds of data
Account data is information about you as a Med99 customer — the pharmacy owner, business or staff member who signs up. For account data, we decide how it is used and we are responsible for it.
Store data is everything your pharmacy enters into Med99 to run the business: bills, invoices, inventory, purchases, suppliers, and the names, phone numbers and other details of your own customers. You decide what store data to enter and why. For store data, your pharmacy is responsible for it (the "data fiduciary") and Med99 only stores and processes it on your behalf to provide the Service. You are responsible for having a lawful basis, including any consent required, to record your customers' and suppliers' information in Med99.
2. What we collect
- Account and business details: name, mobile number, email address, pharmacy or business name, address, GSTIN, drug licence number, and your Merchant ID (MID) and Pharmacy ID (PID).
- Login details: credentials or one-time passwords used to sign in. Passwords are stored only in hashed form.
- Store data: as described above, whatever your pharmacy enters into the Service.
- Payment details: payments are handled by a third-party payment gateway. We do not see or store your full card number, UPI PIN, net-banking password or CVV. We receive the transaction ID, amount, status and plan purchased.
- Device and usage data: device model, operating system, app version, IP address, browser type, crash reports, error logs and basic usage events, used to keep the Service working and secure.
- Communications: messages you send to support, and data deletion requests, including the details you provide in them.
We do not knowingly collect biometric data, and we do not ask for financial account passwords.
3. How we use it
- To create and manage your account and provide the Service, including syncing your data between the Android app and the web app.
- To process subscriptions, trials and payments, and to issue invoices for them.
- To provide customer support and respond to requests, including data deletion requests.
- To send service messages such as security alerts, billing notices and important changes. We will only send marketing messages if you have agreed, and you can opt out at any time.
- To detect, prevent and investigate fraud, abuse and security incidents.
- To diagnose problems and improve the Service, using aggregated or de-identified information wherever possible.
- To comply with law, including tax and accounting obligations and lawful requests from authorities.
We do not sell personal data. We do not use your store data, or your customers' data, for advertising.
4. Who we share it with
- Service providers who help us run Med99 — cloud hosting and database providers, payment gateways, email and SMS providers, and crash-reporting and analytics tools. They may use the data only to provide services to us and must protect it.
- Authorities where required by law, court order or a lawful government request, or where needed to protect the rights, property or safety of Med99, our users or the public.
- A successor business if Med99 is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.
- People you choose — for example, when you share an invoice with your customer or give a staff member access to your pharmacy.
5. Where and how we store it
Your data is stored with reputable cloud providers and may be processed on servers in India or other countries, subject to applicable law. We use reasonable security practices, including encryption in transit (HTTPS), access controls, and limiting staff access to what is needed for support and operations.
No system is completely secure. You are responsible for keeping your login details confidential, for controlling which staff can access your pharmacy, and for keeping your own exports or backups of records you are legally required to keep. If we become aware of a breach affecting your personal data, we will notify you and the authorities as required by law.
6. How long we keep it
- We keep account and store data for as long as your account is active.
- When data is deleted at your request, we delete it from our live systems within 30 days of verifying the request, and it is removed from backups as they expire, normally within 90 days.
- We may keep limited records where the law requires or permits it — for example, invoices and payment records for your Med99 subscription (which tax law requires us to keep), records of the deletion request itself, and information needed to resolve disputes, prevent fraud or enforce our terms.
- Aggregated or de-identified data that cannot identify you may be kept.
7. Your rights
Subject to applicable law, you can:
- ask for a summary of the personal data we hold about you and how it is used;
- correct or update inaccurate or incomplete data — most details can be changed inside the app;
- ask us to delete your data, using our data deletion request form;
- withdraw consent you have given (this does not affect processing already done, and some features may stop working);
- nominate another person to exercise your rights in case of death or incapacity; and
- raise a grievance with us, and if it is not resolved, with the Data Protection Board of India.
We may need to verify your identity before acting on a request. If you are a customer of a pharmacy that uses Med99, please contact that pharmacy first, because they control the records they keep about you; we will help them respond.
8. Cookies and local storage
The website and web app use cookies and browser storage that are needed for them to work, such as keeping you signed in, remembering preferences and protecting forms from spam (for example, the security check on the data deletion form). We do not use advertising cookies.
9. Children
Med99 is a business tool for pharmacies and is not meant for anyone under 18. We do not knowingly collect personal data from children as Med99 users. Store data your pharmacy records about its customers, including minors, is your pharmacy's responsibility, as described in section 1.
10. Third-party links and services
The Service may link to or work with third-party services such as Google Play and payment gateways. Their own privacy policies apply to how they handle your data.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date and, for significant changes, tell you in the app or by email. Continuing to use the Service after a change means you accept the updated policy.
12. Grievance Officer and contact
If you have a question, complaint or request about your personal data, please contact our Grievance Officer:
Rohan Kumar Ande, Grievance Officer
Qubelex Private Limited
Building No: 136, Senthan Green Park, Ameenpur, Hyderabad, Telangana 502032
Email: rohankumar.a@med99.in
Website: qubelex.com
We will acknowledge your message promptly and try to resolve it within 30 days.