1. Our role

Medflow Innovations Private Limited is the Data Fiduciary for personal data processed through Medflow Marketplace. This policy explains what we collect, why, and the rights you have as a Data Principal.

2. What we collect

We collect only what we need to operate the marketplace:

• Account data — name, email address, mobile number and password (stored only as a secure hash).
• Order data — delivery addresses, order history, invoices and payment status.
• Business data — for corporate buyers and sellers: organisation name, GSTIN, PAN and verification documents.
• Technical data — device and browser information, IP address, and diagnostic logs used to keep the service secure and reliable.
• Usage data — pages viewed and searches made, used to improve the catalogue and search results.

3. What we do not collect

We do not collect your full card number, CVV or bank credentials — these are handled directly by our payment partner. We do not collect health records or clinical patient data. We do not sell personal data to anyone.

4. Why we process your data

We process personal data to:

• create and secure your account and authenticate you;
• process orders, payments, invoices, deliveries, returns and refunds;
• share the delivery details a seller needs to fulfil your order;
• verify sellers (KYB) and prevent fraud and misuse;
• meet tax, accounting and other legal obligations;
• provide support and respond to complaints.

5. Who we share it with

We share personal data only with parties who need it: the seller fulfilling your order, our payment partner, logistics providers, and our cloud hosting and infrastructure providers. Each is bound by contract to protect it. We also disclose data where required by law or a valid order of a court or authority.

6. Retention

Account data is retained while your account is active. Order, invoice and tax records are retained for the period required by Indian tax and company law (generally eight years). Diagnostic logs are retained for a short period and then deleted or anonymised.

7. Your rights

Under the DPDP Act, 2023 you have the right to:

• access a summary of the personal data we hold about you;
• correct or complete inaccurate data;
• request erasure where the data is no longer needed and no legal obligation requires us to keep it;
• nominate another person to exercise your rights in the event of death or incapacity;
• withdraw consent, and to raise a grievance with us and then with the Data Protection Board of India.

8. Security

Data is encrypted in transit using TLS. Access to production systems is restricted and authorisation is enforced at the database level, so each account can only reach its own records. Payment credentials never touch our servers.

9. Children

The platform is not directed at children. We do not knowingly create accounts for anyone under 18.

10. Changes

We will publish any change to this policy on this page and update the date above. Material changes will be notified to registered users.

Contact us

For any question about this document, write to info@medflowinnovations.com or call +91 80726 95371 (Mon–Sat, 9:30 AM – 6:30 PM IST). Our grievance officer responds within 1 business day.