Privacy Policy
Last Updated: 06 March 2026 | Compliant with IT Act 2000 & IT (Amendment) Act 2008
Webfire Degitech is committed to protecting the confidentiality of the pharmacy business data you entrust to MedFlow. This Policy explains how we collect, use, and protect your data across all operations of the Platform.
1. Data We Collect
We collect the following categories of data when you use MedFlow:
Account & Business Identity Data
Tenant (pharmacy) name, owner name, email address, phone number, and role (Owner, Branch Manager, Staff).
Operational Pharmacy Data
Product (medicine) inventory records, batch numbers, expiry dates, purchase orders from suppliers, GST billing data (CGST/SGST), sale records, customer names, and stock transfer logs.
Subscription & Payment Data
Subscription plan details, payment status, Razorpay Customer ID, Razorpay Subscription ID, and payment timestamps. We do NOT store raw credit/debit card numbers. All payment processing is handled by Razorpay.
Technical Usage Data
Session tokens, IP addresses, browser type, device information, and page access timestamps — collected automatically to maintain security and performance.
Support Communication Data
Content of support tickets and replies submitted through the MedFlow built-in helpdesk system.
2. Purpose of Data Collection
- To create and manage your pharmacy tenant account and associated user roles.
- To provide and maintain core Platform features: inventory management, GST billing, sales tracking, stock transfers, and reporting.
- To process subscription payments and manage billing cycles via Razorpay.
- To execute automated background tasks: subscription expiry checks, daily database backups, and email backup notifications.
- To respond to your support tickets and provide technical assistance.
- To send system alerts, billing reminders, and service announcements to your registered email.
- To ensure Platform security, detect fraudulent activity, and comply with Indian legal obligations.
3. Cookies & Session Management
MedFlow uses the following cookies and session mechanisms:
- Session Cookies: Used to maintain your authenticated login state. Stored in the database as a secure session. Expires after 120 minutes of inactivity.
- CSRF Token Cookie: A security token embedded in all forms to prevent cross-site request forgery attacks.
- Consent Cookie: Records your cookie consent preference to comply with best practices.
We do NOT use third-party advertising cookies or behavioural tracking cookies. MedFlow does not integrate with Google Analytics or similar tracking services at this time.
4. Data Storage & Protection
- All data is stored in a MySQL database hosted on a cPanel-based server located within the Platform's hosting infrastructure.
- Automated daily backups of the entire database are performed at 02:00 AM. Backup files are stored in a protected, non-publicly-accessible server directory and are retained for 7 days.
- All passwords are hashed using bcrypt (12 rounds). Plaintext passwords are never stored.
- Tenant data is logically isolated using multi-tenancy architecture. One tenant cannot access another tenant's data.
- Razorpay webhook payloads are verified using HMAC-SHA256 signature validation before any payment record is updated.
5. Third-Party Integrations
Razorpay (Payment Processor)
Used to process subscription payments. We share your name, email, and phone with Razorpay to create a customer profile for recurring billing. Razorpay's Privacy Policy governs their handling of this data: razorpay.com/privacy
Google Fonts (Google LLC)
Typography fonts (Outfit, Plus Jakarta Sans) are loaded from Google's CDN. This may result in Google receiving your IP address as a standard web request.
SMTP Mail Service
We use an SMTP email service to deliver backup notifications and system alerts to the registered administrator email. No personal customer data is included in these emails.
We do not sell, rent, or share your data with any other third party for marketing or advertising purposes.
6. Your Data Rights
As a user of MedFlow, you have the right to:
- Access: Request a copy of the personal and business data we hold for your account.
- Correction: Update your tenant profile, branch details, and user information directly within the Platform settings.
- Deletion: Request deletion of your account and associated data. Data will be permanently erased within 30 days of a verified deletion request.
- Portability: Request an export of your pharmacy's operational data (inventory, sales records) in a readable format.
To exercise any of these rights, contact: support@webfiredegitech.com
7. Policy Changes
We may update this Privacy Policy from time to time. Material changes will be communicated via email to your registered address or via a notice on the Platform. Continued use of MedFlow after such changes constitutes your acceptance of the updated Policy.
Data Controller: Webfire Degitech
Email: support@webfiredegitech.com | Website: med.webfiredegitech.com