Privacy policy.

In this Privacy Notice, the following definitions are used:

(a) Data

Includes non-personal information, personal information and sensitive personal information about you, which either directly or indirectly in combination with other information, could allow you to be identified when you visit our stores, website and/or mobile application.

(b) Data Protection Laws

Any applicable law for the time being in force relating to the processing of Data.

(c) Partners

Select third parties with whom we have contracts for the businesses described in this Privacy Notice.

(d) Service Providers

Includes entities to whom we will disclose your Data in order to process information for a specific purpose pursuant to a written contract.

(e) Chemist Box

Chemist Box Private Limited, a company incorporated in India whose registered office is at 1st Floor, Sisodia Palace, Boring Canal Road East, Patna, Bihar 800001.

(f) User or you

The natural person who accesses our stores, website or mobile application.

Chemist Box gathers Data for a number of reasons that are detailed in this privacy notice. Without limitation, the following categories are included in this data:

• Contact details — including first and last names, email addresses, postal addresses, countries, employers, phone numbers, and other similar information.
• Financial data — including information about payment methods, transactions, transaction histories, preferences, modes of payment, patterns of spending, trends in expenditure, and other data of a similar nature.
• Technical data — usage of websites, devices, and mobile apps; Internet Protocol (IP) addresses; and similar data gathered automatically through the use of cookies, pixels, and related technologies.
• Transactional information — including the transaction's date, total, previous and preferred transactions, and related information.
• Health-related information — such as details of treatment plans and medications prescribed by a medical practitioner, dosage information like frequency of dosage, alternative medications, medications you order through the platform, laboratory test results, and any information deduced therefrom, including information or records relating to your medical or health history.
• Product and service information — when you request products and/or services directly from us, or take part in marketing programmes, we collect your account membership number, registration and payment information, and programme-specific information.
• Personal information — any other personal information submitted in responses to surveys or questionnaires, including age, sex, date of birth, marital status, nationality, information about provided official identity cards, occupation, ethnicity, and religion.
• Your evaluations, comments and viewpoints regarding our services, programmes and goods.
• Membership information — information on your loyalty programme membership, account information, and profile or login information.

We gather data in the manner listed below:

• Information you provide to us — we collect and keep any data you enter on our website, via our mobile application, or otherwise provide to us (for example, at our stores).
• Information we gather automatically — every time you interact with us, we utilise cookies, pixels and other similar technologies to collect and store specific sorts of information.
• Email communications — to help us make emails more relevant, we frequently get a confirmation when you open an email from us or click a link within it (if your device allows such capabilities). By clicking the unsubscribe link in every marketing email, you can decide not to receive emails from us.
• Automatic information from other websites — when you engage with third-party websites that use our technology or with whom we have a formal arrangement, we acquire and retain certain information about you. The collection, processing and use of such information are subject to the privacy policies of the relevant website operators.
• Information from other sources — for instance, when you permit a third-party website to communicate directly with our website or mobile application and send or receive Data about you.

Regarding the way we gather and utilise your data, you have alternatives. For instance, you may view, modify or delete your Data via our website or mobile application. You have the option to refuse providing Data when prompted.

Depending on how you interact with our stores, website, or mobile application, Chemist Box may gather your Data in a variety of ways. For illustration:

• when you sign up with us to receive our goods and/or services;
• when you make a purchase, or attempt to make a purchase, at one of our locations, on our website, or through a mobile application;
• when you respond to surveys we conduct ourselves or for us;
• when you choose to receive communications from us, including promotional offers;
• from the data gathered during your visit to one of our locations, on our website, or through a mobile application.

When you use our mobile application or visit our website, we automatically collect some information. By using this data, we can enhance our content and navigation. Your IP address is among the data automatically gathered.

IP addresses, operating system information, browsing information, device information and language settings are all collected by our site servers or affiliates who offer analytics and performance enhancement services. The number of visits, typical time spent on the site, pages visited and comparable data are all aggregated using this data. Chemist Box makes use of this data to monitor site usage, update content, guarantee safety and security, and improve the functionality of our website or mobile application.

Depending on the settings on your browser, we might automatically collect your Data via cookies, pixels and other similar technologies.

Any or all of the above Data may be required by us from time to time to provide information relating to Chemist Box and to improve your experience when using our website or mobile application. Specifically, Data may be used by us for the following reasons:

• carry out our obligations arising from any contract entered into between you and us;
• provide products and/or services and communicate with you about products and/or services offered by us;
• provide you with offers, personalised services and recommendations and improve your experience on our website and mobile application;
• operate, evaluate and improve our business, website and mobile application;
• generate aggregated data to prepare insights to enable us to understand customer behaviour, patterns and trends with a view to learning more about your preferences or other characteristics;
• provide privileges and benefits to you, and run marketing and promotional campaigns based on your profile;
• communicate with you (including to respond to your requests, questions, feedback, claims or disputes) and to customise and improve our services;
• enhance your shopping experience and bring you access to membership programmes, rewards and offers;
• enforce the terms of use of our website and mobile application;
• protect against and prevent fraud, illegal activity, harm, financial loss and other legal or information security risks; and
• serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorised or required by applicable law.

Where required by relevant legislation, we treat these conclusions as personal information (or sensitive personal information, as the case may be). By relevant legislation, we will only use your personal information — including sensitive information — with your permission, as required to deliver goods and/or services to you, as required to satisfy a legal requirement, or as required by a legitimate interest.

We do not provide any goods or services for use by minors on our website or mobile application. If you are under 18, you may use our website or mobile application only with the involvement of a parent or guardian.

For usage on or through our website or mobile application, we might make available to you services, goods or software offered by Partners. Customer data pertaining to those transactions may be given to such Partner if you decide to use such service.

Partners

These Partners are obligated to treat your Data with care and in line with this privacy statement and any relevant legal requirements.

Service Providers

We could give Service Providers access to your Data — for example, for keeping and analysing Data; safeguarding and securing our systems; delivering search results and links; offering customer support; processing your information for profiling; analysing users; and processing payments. These Service Providers are required to only process Data in accordance with express instructions and as necessary to perform services for the purposes set forth in this Privacy Notice, and to safeguard the security and confidentiality of the Data they process by implementing appropriate technical and organisational security measures and confidentiality obligations binding employees accessing Data.

Protecting Chemist Box

We may release Data when we believe release is appropriate to comply with applicable law or legal process, enforce or apply the terms of use of our website or mobile application and other agreements, protect Chemist Box against harm or financial loss, when we believe disclosure is necessary to protect individuals' vital interests, or in connection with an investigation of suspected or actual fraudulent or illegal activity. This may include exchanging information with other companies and organisations for fraud protection, risk management and dispute resolution. This does not include selling or otherwise disclosing personal information of users for commercial purposes in violation of this Privacy Notice.

Business transfers

As we continue to develop our business, we might sell or buy subsidiaries or business units. Your Data (including in relation to loyalty programmes) may be transferred as part of such a transaction. Any Data that we receive from a third party pursuant to such transactions will be processed in accordance with this Privacy Notice and applicable law.

Third parties

We may also share your Data with other third parties where:

• you request or authorise us to do so;
• we need to comply with applicable law or respond to valid legal process; or
• we need to operate and maintain the security of our website or mobile application, including to prevent or stop an attack on our computer systems or networks.

We contractually obligate these third parties to only treat sensitive personal data as instructed by us, as required to carry out services for us, or as required by law. We also require that they take necessary organisational and technical security measures to protect the security and confidentiality of the sensitive personal data that they handle on our behalf.

Please be aware that Partners may have different privacy policies than Chemist Box does. When you submit Data on these websites, their privacy policies will control how your Data is used.

We will take organisational and technical precautions to protect your data and store it on secure servers. Measures to cope with any suspected data breach are included in the technical and organisational measures. Please report to us right away by email at the address listed in section 16 below if you suspect any misuse, loss or unauthorised access to your Data.

We retain your Data for as long as is required to provide our products and/or services, to provide access to and use of our website or mobile application, or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements — or for as long as processing and retaining your Data is required and permitted by applicable law. Actual retention times can vary because these requirements change for different data types and uses.

Your Data may remain on backup or archive media for audit, legal, tax or regulatory purposes even after we delete it, including in response to the exercise of your rights under section 11 below.

When we process Data about you, we do so with your permission and/or as required to run our business, comply with legal and contractual requirements, safeguard the security of our systems and our clients, or advance other legitimate purposes of Chemist Box as outlined in this Privacy Notice. The following rights pertain to your sensitive personal information, and you can exercise them by contacting us as indicated in section 16:

• Right to access, review and modify
• Right to correction
• Right to withdraw consent

It is crucial that the information we have on you is correct and up to date. If your personal information changes while it is still in our possession, kindly let us know.

Data collected under this Privacy Notice is hosted on servers located in India.

We take measures to guarantee that the Data we collect in accordance with this Privacy Notice is processed in accordance with its terms and any applicable legal requirements. We have put in place suitable contractual arrangements with Partners and Service Providers with whom we share your Data in order to guarantee that it is adequately protected.

We ask for the following app permissions during onboarding, in order to optimise the experience for you:

• Location — helps us show you location-specific data such as availability of products at your nearest store. You can change this at any time.
• Camera — to allow you to take a photo of a prescription and upload it directly to the app.
• Photos / media / files — media access is needed to store and retrieve your uploads, such as prescription uploads, on your device.
• SMS — to support automatic OTP confirmation, so you don't have to enter the authentication code manually.
• Receive SMS — this helps our payment partner send you payment-related SMS.
• Access Wi-Fi state — helps us optimise your experience based on connection strength.

Any provision of this privacy notice (or portion of a provision) that a court or other competent authority finds to be invalid, unlawful or unenforceable will be deemed to be deleted to the extent necessary, and the validity and enforceability of the remaining provisions of this privacy notice will not be affected.

Our company is always evolving, and so our Privacy Notice might change. We may send you email reminders of our notices and conditions from time to time, but you should visit our website and mobile application frequently to see the most recent updates. As soon as the latest version is available, it will take effect. Any modifications will be posted on our website and mobile application, and your first use of our website or mobile application, or first purchase of the products and/or services afterwards, will be regarded as your acceptance of the revised Privacy Notice.

Send us an email if you would like to request access to, a review of, an update to, or a withdrawal of your consent for your personal information. Please contact us to learn more about the Service Providers and Partners with whom we may disclose your Data in accordance with this Privacy Notice and applicable legislation. We will respond to your request within 30 days.