Privacy Policy

Effective date: 23 October 2026 · Last updated: 23 October 2026

1.1 Who we are

DavaSetu ("DavaSetu", "we", "us") is a software platform operated by Youhexa Technologies Pvt. Ltd. (office address: 2nd Floor, Apex Tower, Mahatma Gandhi Marg, Hazratganj, Lucknow, Uttar Pradesh 226001). DavaSetu lets retail pharmacies in Uttar Pradesh create and manage their own public information website on a DavaSetu subdomain (for example, yourpharmacy.davasetu.co.in). On that website they can show pharmacy details, pharmacist details and stock listings.

DavaSetu is not an online pharmacy. We do not sell, dispense, prescribe or deliver medicines. We do not accept prescriptions. We do not process orders for medicines.

DavaSetu is an independent private service. It is not operated by, affiliated with, approved by or endorsed by the Uttar Pradesh Food Safety and Drug Administration (FSDA), any drug control authority or any other government body.

1.2 Who this policy covers

Pharmacy subscribers. These are pharmacy owners and the staff they invite who create an account ("Pharmacy Users").

Pharmacists. These are people whose details a pharmacy publishes on its website.

Visitors. These are members of the public who view a pharmacy's website or the DavaSetu marketing site.

1.3 Our role and the pharmacy's role

We act as the Data Fiduciary for the data we collect to run our own service. This includes account and login data, subscription and billing data, support requests, and security logs.

Each pharmacy decides what information about its business, its pharmacist and its stock to publish. For that content, the pharmacy is responsible for having the right to publish it and for its accuracy. This includes getting the pharmacist's consent. We process that content on the pharmacy's instructions to host and display its website.

Each pharmacy's data is kept logically separate from other pharmacies' data on our shared platform.

Because we host pages published by pharmacies, we treat DavaSetu as an intermediary under the Information Technology Act, 2000. We follow the due-diligence and grievance rules in the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

1.4 What we collect

From Pharmacy Users: Name, mobile number, email address, password (stored only in hashed form), role (owner/staff). Pharmacy details: pharmacy name, licence holder name, address, district, state, PIN, phone, map link, logo, store photos. Drug licence number(s), licence validity details and uploaded licence documents. Pharmacist details: name, registration number, photograph and supporting documents. Stock data: medicine name, brand, generic name, manufacturer, quantity, unit and, if the pharmacy chooses, MRP or selling price. Subscription and payment records: plan, amount, invoice, payment status, and Razorpay order and payment IDs. All payments are processed by Razorpay. We do not receive or store card numbers, CVV, UPI PINs or net-banking passwords. Razorpay handles these. Support messages and communication preferences.

From Visitors: basic technical data such as IP address, browser type, pages viewed and timestamps. We collect this for security, abuse prevention and site performance. We do not ask visitors to create accounts. We do not collect their health or prescription information.

Automatically: cookies or similar technologies that are needed for login sessions, security and preferences such as language. At launch we use only these essential cookies. We do not use analytics or advertising cookies. If we add any non-essential cookies later, we will update this policy and ask for your consent first.

1.5 Why we use it (purposes)

We use personal data only for these purposes: (1) To create and secure accounts, and to verify mobile number and email (OTP). (2) To set up and host the pharmacy's subdomain website and QR code. (3) To display the information the pharmacy chooses to publish. (4) To review onboarding details and documents for our internal platform checks. This internal review is not official government verification. (5) To process subscriptions, payments, renewals, invoices and refunds through Razorpay, and to record any manual plan activation or extension made by a DavaSetu administrator. (6) To send service messages: OTPs, stock-update reminders, licence-renewal reminders, subscription expiry and billing notices. (7) To provide support and resolve complaints. (8) To keep the platform secure, prevent fraud and abuse, and maintain audit logs. (9) To comply with applicable law, such as tax and accounting records, or lawful requests from authorities.

We do not sell personal data. We do not use pharmacist photos or registration details for advertising. We do not use data for purposes unrelated to the ones above unless we first give you notice and get your consent.

1.6 What is public and what is private

Public on the pharmacy's website: only the fields the pharmacy publishes. These may include pharmacy name, address, licence number, licence holder name, pharmacist name, registration number and photo, contact number, and published stock listings with their publication date.

Kept private: uploaded licence and pharmacist documents, account credentials, the pharmacy's private working inventory, any procurement/purchase prices (unless the pharmacy deliberately chooses to publish them), billing records and internal review notes.

1.7 Who we share data with

We share data only with: Service providers who help us run DavaSetu, under contract and only for our purposes — Razorpay, for payments, refunds and payment records; VPS hosting provider (India), for the server that runs DavaSetu, its database, file storage and backups; Cloudflare, for DNS, content delivery and security for davasetu.co.in and pharmacy subdomains. Visitor traffic, including IP addresses, passes through Cloudflare. Uploaded documents and photos are kept in our own S3-compatible file storage on the same server, not with a separate storage company. We have not yet appointed SMS/OTP or email delivery providers. We will add each one to this list before it processes any personal data. Authorities, where required by law or a valid legal order. A successor entity in a merger or acquisition, subject to equivalent protection and notice to you.

1.8 Where data is stored and how it is protected

Data is hosted on a virtual private server (VPS) located in India. Cloudflare and Razorpay process limited data as described in Section 1.7. Our safeguards include encrypted connections (HTTPS), hashed passwords, access controls between pharmacies, private storage for documents with time-limited access links, audit logs and backups. No system is completely secure. If a personal data breach affects you, we will inform you and the authorities as required by law.

1.9 How long we keep data

Account and pharmacy website data, including published stock snapshots and publication history: Kept while your subscription is active. When your account closes, or the 7-day grace period after expiry ends without renewal, we take your public website offline. Within 90 days of closure, we delete or anonymise this data in our active systems. Two exceptions, kept only in restricted storage and then erased: Registration information (account name, mobile, email and pharmacy registration details) is kept for 180 days after the account is cancelled, as Rule 3(1)(h) of the IT Rules, 2021 requires. Personal data and logs of processing linked to a transaction, such as payment and activation records, are kept for at least one year from the date of that processing, as Rule 8(3) of the DPDP Rules, 2025 requires from 14 May 2027. We follow this from launch. We will email you at least 48 hours before final deletion. Rule 8(2) of the DPDP Rules only requires this notice for some large platforms listed in its Third Schedule, but we do it for everyone.

Content removed after a complaint or legal notice: preserved for 180 days in restricted storage, as Rule 3(1)(g) of the IT Rules, 2021 requires.

Billing and invoice records: kept for at least eight financial years, as Section 128(5) of the Companies Act, 2013 requires. This also covers the GST requirement under Section 36 of the CGST Act, 2017: 72 months from the due date of the annual return. We keep them longer if an appeal, assessment or investigation is pending.

Security and access logs: kept for one year, as Rules 6(1)(e) and 8(3) of the DPDP Rules, 2025 require, and longer only if the law requires.

Backups: kept on a 30-day rolling cycle. Data deleted from active systems disappears from backups within 30 days.

1.10 Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 (see the Data Protection Note), you can: ask for a summary of the personal data we process about you; ask us to correct, complete or update it; ask us to erase it where it is no longer needed and we are not required by law to keep it; withdraw consent where we rely on consent (this does not affect processing already done); nominate another person to exercise your rights if you die or become incapacitated; raise a grievance with us. If you are not satisfied, you may approach the Data Protection Board of India once that remedy is available.

Pharmacists: to remove or correct your details on a pharmacy's website, contact that pharmacy or write to us at support@davasetu.co.in. If you withdraw consent, your details will be removed from the public pharmacy website within 48 hours of the withdrawal reaching us.

1.11 Children

DavaSetu is meant for businesses and adults. We do not knowingly collect personal data of anyone under 18. Visitors do not need to register. If you believe a child's data has been submitted to us, write to support@davasetu.co.in and we will delete it.

1.12 Contact and grievances

Ajay Sharma, Grievance Officer. Email: support@davasetu.co.in · Phone: +91 7607216033 · Office address: 2nd Floor, Apex Tower, Mahatma Gandhi Marg, Hazratganj, Lucknow, Uttar Pradesh 226001

Response times: We acknowledge every complaint within 24 hours and resolve it within 7 days of receiving it. Requests to remove unlawful content are acted on as quickly as possible, and within 36 hours. For complaints about content that exposes a person's private areas, shows nudity or sexual acts, or impersonates them (including morphed images), we take steps to remove or disable it within 2 hours.

These timelines come from Rule 3(2) of the IT Rules, 2021 (as amended up to 10 Feb 2026). They are stricter than the "not exceeding ninety days" limit in Rule 14(3) of the DPDP Rules, 2025. If you are not satisfied with the Grievance Officer's decision, you may appeal to the Grievance Appellate Committee within 30 days (Rule 3A of the IT Rules). Once the DPDP Act's provisions are in force, you may also approach the Data Protection Board of India.

General support: support@davasetu.co.in, +91 7607216033, Mon–Sat, 10:00 AM–7:00 PM IST.

1.13 Changes

We may update this policy. We will post the new version with a new "Last updated" date. If we make material changes, we will notify Pharmacy Users by email or in the dashboard.