Privacy Policy

Introduction

ScriptDesk is pharmacy management software made for retail pharmacies in India. It keeps a pharmacy's stock, bills, customers, suppliers, registers and accounts on the pharmacy's own computer, and it can connect to the ScriptDesk cloud, a service run by the publisher of ScriptDesk ("we", "us") that provides licences, software updates and announcements.

This document has two parts. Part A, the Privacy Policy, explains what information ScriptDesk handles, where it is kept, what leaves the pharmacy's computer and why, and the rights of the people the information is about. Part B, the Terms of Use, sets out the agreement between the pharmacy that uses ScriptDesk ("you") and us.

Please read both parts carefully. By creating a store in ScriptDesk, ticking the box that says you agree, or using ScriptDesk, you accept this Privacy Policy and these Terms of Use on behalf of your pharmacy. If you do not agree, do not use ScriptDesk. The version in force is shown at the end of this document; the version you accepted, and when, is shown in ScriptDesk under Settings, About.

This website

The website scriptdesk.in only tells you about ScriptDesk. It sets no cookies, uses no analytics or advertising trackers and loads nothing from other websites. It has no forms: when you write to us by email, we use your message only to answer you.

When you pay for ScriptDesk online, the payment is made on the payment page of Razorpay Software Private Limited, under Razorpay's own terms and privacy policy. We receive the confirmation of the payment (the amount, the date and Razorpay's payment reference); we never see or keep your card, bank or UPI details.

1. Who is responsible for which information

India's Digital Personal Data Protection Act, 2023 ("the DPDP Act") and the rules made under it use two important ideas. A Data Fiduciary decides why and how personal data is processed and is responsible for it. A Data Processor processes personal data on behalf of a Data Fiduciary.

Your pharmacy is the Data Fiduciary for the personal data of your customers, patients, prescribers and staff that you record in ScriptDesk. ScriptDesk is the tool you use to keep those records; the records are kept on your computer, under your control, and you decide what is recorded and for how long.

We are the Data Fiduciary for the information about your pharmacy and its owner that we receive when you connect to the ScriptDesk cloud or buy a licence, such as the store's name, licence details, contact person and the daily totals described in section 4. We do not receive, and ScriptDesk is designed never to send us, any personal data of your customers or patients.

2. Information kept on your computer

ScriptDesk keeps its records in a data folder on the computer where your store was created (the main computer). Depending on how you use it, this includes:

Your store: its name, address, GST number, drug licence number, the photo of the licence, the logo, the store's location if you record it, and settings such as expiry warnings, shelves and the fields you make compulsory.

People who log in: the owner's and staff members' names, mobile numbers, email ID or login ID, and photo if added. Passwords are never stored as written; only a salted, one-way fingerprint of each password is kept, so no one can read them back.

Customers and patients: names, mobile numbers, addresses if you note them, their purchase history, amounts owed and paid, and any notes you add. For Schedule H1 and Schedule X medicines, ScriptDesk keeps the details the law requires you to record, such as the patient's name and address, the prescriber's name, address and registration number, and the date of the prescription; for Schedule X it can also keep the patient's age and gender. If you note a patient's identity proof, only the last four digits of an Aadhaar number are kept.

Medicines and trade: products, batches, expiry dates, prices, stock movements, purchase bills, goods sent back to suppliers, suppliers' details, payments to suppliers, the day's cash closings, and the patient counselling given on bills.

Photos: pictures of medicine packs you take or choose when adding stock. Do not photograph prescriptions, patients or anything showing a patient's identity for this purpose.

Backups: copies of the whole store that ScriptDesk makes each day in its data folder, and any further copies you choose to keep on a pen drive or in a cloud folder such as Google Drive or OneDrive.

3. Why the information is kept

The information in ScriptDesk is kept so that your pharmacy can sell medicines lawfully and safely and run its business: to make bills and tax invoices; to keep stock, batches and expiry dates; to keep the registers and records that the Drugs and Cosmetics Act, 1940, the Drugs Rules, 1945, and the Pharmacy Practice Regulations, 2015, require; to give and record patient counselling; to keep accounts and the working your accountant needs for GST; to keep track of what customers owe and what you owe suppliers; to remind regular patients when a medicine may be finishing; and to protect the store against loss through backups.

You should rely on the right legal ground for each of these purposes. Much of it is required by law. Where it is not — for example, sending a patient a reminder on WhatsApp — you should have the patient's consent, and you must stop if the patient asks you to.

4. What leaves your computer, and why

Nothing leaves your computer unless you use one of the features below. Each is described with exactly what it sends.

The ScriptDesk cloud. If you connect your store to the ScriptDesk cloud (Settings, ScriptDesk cloud), the main computer sends a report about once a day. The report contains your store's details (name, address, GST number, drug licence number, the owner's name, mobile number and email ID, and the store's location if recorded), the version of ScriptDesk, the number of products, and totals for each of the last seven days: the number of bills, the value of sales, the GST in them, the value of returns and of credit given. It also contains the names of the medicines that sold most in the last thirty days with the number of packs. It never contains a customer's or patient's name, mobile number, address, bill, prescription or any other detail that could identify a person. In return the cloud tells ScriptDesk your licence's status, the announcement to show on your dashboard, and whether a new version of ScriptDesk is available.

Software updates. When a new version is offered, ScriptDesk downloads the installer from the address it was given and checks its digital fingerprint before installing it. Downloading it reveals your computer's internet address to the server it comes from, as any download does.

AI reading of pack photos. If you choose to use it and enter your own key for Anthropic's Claude service, the photo of a medicine pack you take is sent to Anthropic to read the name, salt, batch number, expiry and price printed on it. The photo is processed under the agreement between you and Anthropic, and may be processed outside India. Use it only for photos of packs.

WhatsApp. When you choose to send a bill, an order, a reminder or a note of dues on WhatsApp, ScriptDesk opens WhatsApp on your computer with the message written out. Nothing is sent until you press Send in WhatsApp, and what you send is governed by WhatsApp's own terms and privacy policy.

Copies outside this computer. If you choose a folder on a pen drive, or one kept in the cloud by Google Drive, OneDrive or a similar service, ScriptDesk places a full copy of the store there every day. A full copy contains everything listed in section 2. If the folder is kept by a cloud service, that service's terms apply to it; keep its account protected.

The browser link and other computers. Other computers and phones in your shop can use ScriptDesk through the main computer, over your shop's own network only, after logging in. Their requests do not travel over the internet.

The ScriptDesk customer app. When the customer app is available and you choose to take part, the products you list, their prices and availability, your store's details and location, and the orders customers send you will pass through the ScriptDesk cloud so that orders reach the right pharmacy. This policy will be updated before that service starts.

5. What we do with the information we receive

We use the information the ScriptDesk cloud receives to provide and support your licence, to send you updates and announcements, to keep the service secure, to keep our accounts, and to understand how ScriptDesk is used so that we can improve it. We may prepare statistics that combine the reports of many pharmacies, such as which medicines sell most in a region, in a form that does not identify any pharmacy or any person.

We do not sell information about your pharmacy. We do not use it to advertise to your customers, and announcements shown in ScriptDesk never use your customers' information. We share it only with the companies that host and run the service for us under contract (for example, our cloud hosting provider), with our professional advisers, and with authorities where the law requires us to.

6. Your duties towards your customers and patients

Because your pharmacy decides what personal data to record, the DPDP Act places duties on you. In particular, you should:

Tell people what you record and why, in plain language, and obtain consent where the law requires it — for example, a short notice at the counter explaining that names, mobile numbers and medicines bought are recorded for billing, the registers the law requires, counselling and reminders.

Record only what you need. ScriptDesk asks for more details only where the law requires them, such as for Schedule H1 and X medicines.

Keep the information accurate, and correct it when a person asks.

Let people see the information you hold about them, and erase it when they ask and you no longer need to keep it — bearing in mind that the law may require you to keep certain records, such as registers, prescriptions and tax records, for a number of years.

Protect it, as described in section 8, and if it is exposed to someone who should not have it, act at once to contain it and inform the Data Protection Board of India and the people affected, as the law requires.

Take extra care with children. The personal data of a person under eighteen may be processed only with the verifiable consent of a parent or lawful guardian, except where the law allows otherwise.

Do not use customers' information to market to them without their consent.

7. How long information is kept

Records on your computer stay there until you delete them. ScriptDesk lets you correct customers' details and delete products that have not been sold, and the owner can erase the whole store. Bills, returns, registers and purchase records cannot be deleted one by one, because the law requires them to be kept; you are responsible for keeping them for as long as the law requires and for disposing of them securely after that.

Daily copies kept by ScriptDesk on your computer are replaced after a week; copies in a folder you choose are replaced after fourteen days.

We keep the information the ScriptDesk cloud receives for as long as your store is connected and your licence is in force, and afterwards for as long as we need it for our accounts, to resolve disputes and to meet our legal obligations. After that we delete it, or keep it only in a form that does not identify your pharmacy.

8. Keeping information safe

ScriptDesk protects the information it handles in several ways. Passwords are stored only as salted fingerprints. A store's records open only after logging in, and staff cannot change the store's details, logins or backups. Other computers and phones may reach the main computer only from the shop's own network and only after logging in, and the connection between ScriptDesk computers is protected with keys made from the store's connection code. Calls to the ScriptDesk cloud are encrypted (HTTPS), and each store's computer identifies itself with a secret that only it holds. Updates are installed only after their fingerprint has been checked.

The store's data file on your computer is not encrypted by ScriptDesk. Its safety therefore also depends on you: use a strong password for ScriptDesk and for Windows, lock the computer when you leave the counter, keep Windows and your antivirus up to date, switch on disk encryption (such as BitLocker) where your computer supports it, give staff their own logins rather than the owner's, keep backups, and keep pen drives with copies of the store in a safe place.

No system is completely secure. If you believe the ScriptDesk cloud or your connection to it has been misused, tell us at once.

9. Your rights

Under the DPDP Act, the owner of a pharmacy, as the person the information we receive is about, may ask us for a summary of the personal data we hold, ask us to correct, complete, update or erase it, withdraw consent where we rely on consent, nominate another person to exercise these rights in the event of death or incapacity, and raise a grievance with us. If you are not satisfied with our answer to a grievance, you may complain to the Data Protection Board of India.

To exercise these rights, write to us at info@scriptdesk.in. We will answer within the time the law sets, and in any case aim to answer within thirty days. Withdrawing consent for the ScriptDesk cloud may mean disconnecting your store from it, which you can also do yourself in Settings.

Your customers and patients exercise their rights with your pharmacy, because you hold their information. ScriptDesk gives you the means to show, correct and delete what you hold, within the limits of the records the law requires you to keep.

10. Cookies and similar technology

The browser link in your shop and the ScriptDesk cloud's dashboard use only the cookies strictly needed to keep a person logged in and to protect forms from being sent by other web sites. They do not use advertising or tracking cookies.

11. Where information is processed

Your store's records are on your own computer, in India. The ScriptDesk cloud is hosted in India. Some services you may choose to use — AI reading, WhatsApp, Google Drive or OneDrive — may process information outside India under their own terms. We will not transfer the information we receive to any country that the Government of India has restricted.

12. Changes to this policy

We may change this policy when ScriptDesk or the law changes. The version in force is stated at the end. When we make a change that matters, ScriptDesk will show a notice and ask you to read and accept the new version; until you do, you may continue to use the parts of ScriptDesk that work on your own computer.

30. Contact

For questions about this policy or these terms, to exercise your rights, or to raise a grievance, write to the publisher of ScriptDesk at info@scriptdesk.in. Please include your store's name and the mobile number registered with it, so that we can find your records.