CureMitra Privacy Policy

CureMitra (the App), also referred to as MyPharma, is a next-generation pharmacy management and clinical intelligence platform. This Privacy Policy outlines how CureMitra collects, processes, secures, and discloses user, pharmacy, and patient data.

1. Information We Collect & Database Governance

Depending on the modules utilized across our mobile app, desktop dashboard, and server endpoints, we process and store the following structural data in our database:

• Account & User Profiles: Phone numbers (used for secure SMS-based OTP validation), user display names, ages, profile photo URLs, active device FCM tokens, session keys, and Razorpay subscription IDs.
• Pharmacy & Business Metadata: Store names, pharmacy addresses, drug license numbers, GSTIN details (GSTLegalName, GSTTradeName, state codes, and registration types), stock transfer transit records, current inventories, and auto-ordering configurations.
• Distributor & Purchase Data: Vendor contact numbers, distributor names, scanned vendor purchase invoices (including raw scanned PDF text and image URLs), purchase orders, and auto-order logs.
• Patient Records & Patient Accounts: Patient names, phone numbers, emergency contact details, blood groups, heights, weights, blood pressure logs, medical histories, vaccination files, and medicine usage timelines.
• Transactional & Invoice Billing: Total amounts, CGST/SGST/IGST/cess tax allocations, reverse charge indicators, buyer GSTINs, and digital signature URLs.

2. Mobile Device Hardware Permissions & Data Access

To deliver clinical-grade OCR scanning, automatic billing, and local deliveries, our mobile application requests access to the following device hardware:

• Camera & Photo Library: Accessed to snap pictures or upload copies of prescriptions, medicine strips, and invoices to interpret medicine names and tax lines via Google ML Kit Text Recognition OCR.
• Geolocated Location (GPS): Accessed to retrieve fine latitude and longitude coordinates to verify delivery drop-offs and track live courier routes. This coordinate access is enabled only with explicit location permissions.
• Bluetooth & Nearby Devices: Accessed to search for, connect to, and print physical invoices and receipts using local Bluetooth thermal receipt printers.
• Notifications: Accessed to dispatch alerts regarding low-stock alerts, medicine expiry timelines, and delivery statuses.

3. Third-Party Integrations & Data Synchronization

CureMitra syncs information with external partners to automate business operations. We maintain strict compliance boundaries when integrating with:

• GSP Sync Providers (Cleartax, Mastersindia, Vayana): Invoices and tax reports are synchronized directly with Cleartax, Mastersindia, or Vayana APIs to automate return filing (GSTR-1 return filing preparation).
• Razorpay Payment Gateways: Payments and billing subscriptions are handled securely via Razorpay's PCI-compliant infrastructure.
• Notification Dispatchers (WhatsApp, Email, SMS): SMS, email, and WhatsApp APIs are used to send purchase orders, low-stock alerts, and reminders to patients and distributors.

4. Data Retention & Security Standards

We enforce role-based access control (RBAC) layers (ADMIN, PHARMACIST, MANAGER, SALESMAN) for store access permissions. Database tables are protected by end-to-end encryption in transit. We retain personal and clinical files as long as your pharmacy account is active. If you request deletion, we take reasonable steps to purge account records, subject to legal, tax, or medical audit guidelines.

5. Your Choices & Control

• You can enable or disable GPS tracking, camera access, and Bluetooth printer permissions in your system settings. Disabling permissions will limit related scanning, delivery, and printing modules.
• You can request access to your records, request data portability exports, or initiate account deletion.

6. Contact Us

If you have any questions about this Privacy Policy or data access compliance, please reach out to us at:

Email: [email protected]