Privacy Policy

200med is an open-concept, non-commercial experimental prototype and cybersecurity research project. It does NOT operate as a commercial e-pharmacy, business marketplace, or clinical healthcare facility, and conducts no commercial sales of medicines. It was created to demonstrate what is technically possible today using modern AI technology and autonomous agent tooling, and to research real-world cybersecurity, data privacy (DPDP Act 2023), and architectural resilience in decentralized civic and healthcare interfaces.

Open Concept & No Copyright: This is a public hobby and research endeavor. No proprietary copyright or commercial ownership is claimed over the concept. Anyone is free to take inspiration, replicate the architecture, or build their own version using AI and modern web technologies.

Contact & Support: For inquiries or feedback: contact@dharatidhorari.com

• Identity & Account Data: Name, mobile number, email address, and optional ABHA (Ayushman Bharat Health Account) identifier — used strictly to create and authenticate your account.
• Health & Medical Records: Prescription images you upload, e-prescriptions generated during consultations, diagnostic reports, and medical symptoms — used exclusively to fulfill medicine dispensing by licensed retail pharmacies and consultations with Registered Medical Practitioners (RMPs) with explicit, revocable consent.
• Sarthi Health Guide (Educational Monograph & Wellness Reference): Health and wellness questions entered in Sarthi Health Guide are answered using our rule-based educational catalogue referencing publicly published literature from ICMR Standard Treatment Workflows (STW), Indian Pharmacopoeia Commission (IPC NFI), PMBJP Jan Aushadhi, and Ministry of AYUSH (NAMASTE / API / HPI / UPI). In strict compliance with the Telemedicine Practice Guidelines, 2020 and CDSCO Medical Devices Rules, 2017, Sarthi Health Guide is a non-SaMD educational reference tool and is NOT a government platform or medical practitioner — it does not diagnose, triage, counsel, or prescribe medicines. Your name, mobile number, or email are never sent with educational lookups, and any accidental PII is automatically scrubbed.
• Geographic Location: Precise GPS coordinates are requested solely to locate nearby licensed partner pharmacies and calculate delivery distance. We never track your location continuously in the background.
• Partner KYC Documents: Drug licenses (Form 20/21 under the Drugs & Cosmetics Act, 1940), GSTIN certificates, and State/National Medical Council registration IDs for pharmacists and RMP doctors — stored in private, access-controlled cloud storage, restricted to regulatory verification.
• Payment Transactions: Where digital payment is selected, it is processed directly by Razorpay. 200med never stores credit/debit card numbers or UPI PINs.

To enforce strict Indian Data Sovereignty (0 bytes cross-border transfer), all external analytics and telemetry scripts (including Vercel Analytics and Speed Insights) are completely disabled. No third-party ad tracking scripts or tracking pixels are deployed.

• Fulfilling medicine dispensing orders through verified, licensed partner retail pharmacies against valid RMP prescriptions where required under the Drugs & Cosmetics Act, 1940 and Pharmacy Act, 1948.
• Scheduling secure teleconsultations with verified Registered Medical Practitioners (RMPs) under the Telemedicine Practice Guidelines, 2020.
• Providing educational, non-prescribing lifestyle & monograph information across Allopathy, Ayurveda, Homeopathy, and Unani.
• Sending critical transactional order updates and emergency healthcare alerts.
• Complying with statutory drug, telemedicine, and data protection regulations under Indian law.

Your personal data is shared strictly on a need-to-know basis under contractual Data Processing Agreements (DPAs):

• Assigned Partner Pharmacy: Order medicines and prescription copy shared only with the specific licensed pharmacy fulfilling your order.
• Consulting Doctor: Medical intake and symptom notes shared only with the Registered Medical Practitioner (RMP) you book.
• Service Processors (under standard DPAs): Supabase Mumbai Region (`ap-south-1`, encrypted India-hosted database & file storage), public clinical reference & translation gateways (scrubbed non-personal health terms only), Razorpay (PCI-DSS compliant payments), and Jitsi Meet (peer-to-peer encrypted consultation calls).
• Law Enforcement: Disclosed only when legally required under valid court order or statutory Indian legal mandate.

• End-to-end TLS/HTTPS encryption for all data in transit and India-hosted storage (Mumbai region `ap-south-1`, aligned with ISO/IEC 27001 controls).
• Row Level Security (RLS) policies enforcing database access isolation and 180-day security log retention (CERT-In Directions, 2022).
• Prescriptions and KYC files stored in private buckets accessible only via short-lived signed URLs.
• The implementation of these security measures is being tested in practice. Results are not yet independently verified.
• In the event of any personal data breach, 200med will notify affected Data Principals and the Data Protection Board of India (DPBI) (including a detailed 72-hour follow-up report under DPDP Rules, 2025) and report cyber incidents to CERT-In within 6 hours.

🇮🇳 100% Sovereign Indian Data Processing Guarantee:

• Zero Cross-Border Transfer: Under no circumstance is your personal data, medical questions, prescriptions, or identity records transferred outside the territory of India (DPDP Act, 2023 Sec 16).
• Indian Hosting & Serverless Compute: All database storage, authentication, real-time messaging, and application serverless API functions run strictly within Indian server regions (AWS Mumbai `ap-south-1` and Vercel Mumbai `bom1`).
• National Geospatial Policy (NGP 2022) Compliance: Your precise GPS location is never shared with foreign geocoding servers. Reverse geocoding executes 100% on-device using an offline Indian centroid directory with coarse spatial blurring (~1.1 km radius) in strict accordance with DST Guidelines (<1m threshold).
• No External Cloud AI Processing: Symptom checks and health queries are evaluated entirely within sovereign, local rule-based engines (referencing ICMR STW and Ministry of AYUSH NAMASTE catalogues). No queries are forwarded to foreign commercial LLMs (e.g., OpenAI, Anthropic, Gemini).
• RBI Data Localization: All payments are processed through RBI-authorized payment infrastructure (Razorpay) adhering to Indian banking data localization mandates.

• Statutory Pharmacy Retention (Drugs & Cosmetics Rules, 1945): In accordance with Indian drug safety laws, prescription dispensing records and sales invoices must be maintained by fulfilling pharmacies for a minimum of 2 (two) years.
• Non-Statutory Data: Your account profile, saved addresses, chat queries, and notifications are erased immediately upon user-initiated account deletion or withdrawal of consent.

• Right to Access: View the personal data and health records held about you.
• Right to Correction: Update or correct inaccurate personal details in your profile.
• Right to Erasure (Sec 12(3)): Permanently delete your account and personal data at any time directly through the website or mobile app.
• Right to Withdraw Consent (Sec 6(4)): Withdraw consent for data processing with the same ease as giving consent.
• Right to Nominate (Sec 14): Designate a family member or nominee to exercise your data rights in the event of death or incapacity.
• Right of Grievance Redressal (Sec 13): Redress grievances through our designated Grievance Officer, or escalate to the Data Protection Board of India.

To erase your account and associated personal data at any time:

1. Navigate to Your Account page.
2. Scroll to Data & Privacy Controls (DPDP Act 2023).
3. Click Delete Account & Wipe Data and confirm.

Your profile, login credentials, addresses, and chat history are wiped immediately.

200med is intended for users who are 18 years of age or older. We do not knowingly collect personal data from minors without verifiable parental or lawful guardian consent. During sign-up, users must confirm they meet the legal age requirement.

For inquiries, rights requests, security disclosures, or feedback on this open research prototype:
Contact & Support: contact@dharatidhorari.com

We acknowledge all complaints within 24 hours and aim to resolve them within 15 days (and strictly within the 90-day statutory window prescribed under DPDP Rules, 2025; 3 hours for court/government orders under IT Rules 2026). If unsatisfied, you may escalate to the Data Protection Board of India (DPBI).