1. Two kinds of data
- Your account — the owner’s and staff’s names, emails and phones. For this, MedBox24 decides how it is used and is responsible for it.
- Your shop’s records — bills, products, and the customers, doctors and suppliers a shop enters. The shop decides about these; MedBox24 only stores and processes them for the shop.
2. What we collect
- Account: name, email, phone and role of each person who signs in.
- Shop: name, address, phone, drug licence, GSTIN and logo.
- Records the shop enters: products, stock, bills, purchases, expenses, customers’ and doctors’ names and phones, and photos of bills and products.
- Payments: plan, amount, dates and Razorpay’s payment reference. Card and UPI details stay with Razorpay; we never see or store a card number.
- Technical: IP address, browser and device, sign-in times, and a log of who did what in the shop.
- On medbox24.in only (not inside the app): page visits counted with Google Analytics.
3. Why we use it
We do not show ads, sell data or use your customers’ details for marketing.
- To run MedBox24 for your shop and keep it secure.
- To send sign-in codes, tax invoices, alerts and notices by email.
- To help when you ask for support — only with the owner’s permission.
- To meet our legal and tax duties.
5. How we protect it
Some providers may process data outside India, as the law allows.
- Encrypted connections (HTTPS) everywhere.
- An encrypted backup every night; the newest 14 are kept.
- Roles for every staff member, a PIN lock on idle counters and a log of every change.
- MedBox24 staff see a shop only with the owner’s permission, read-only, and every visit is recorded.
6. How long we keep it
- Account details: while the account is open.
- Shop records: as our Terms of Service explain — by default 72 months after each year’s GST annual return is due, then a daily summary.
- Our invoices and payment records to the shop: as long as tax law requires.
- After an account is deleted: removed from our live systems within 30 days, and from backups within 14 days after that.
7. Your rights
You can ask to see the personal data we hold about you, correct it, have it deleted, withdraw a consent you gave, or nominate someone to act for you. Write to us from the email you sign in with. If you are a customer of a shop that uses MedBox24, please ask that shop first — we will help it answer you.
8. Delete your account
The shop’s owner can delete the shop and every account in it. Email support@medbox24.in from the email you sign in with, with the subject “Delete my account”, the shop’s name and its phone number.
- We reply within 7 days to confirm it is you.
- Download your records first — bills, stock and GST from Insights → Reports in Excel or PDF, and every photo from Subscription → Your data.
- We stop auto-debit, then delete the shop, its staff logins and its records within 30 days; backups clear 14 days later.
- We keep only what the law requires: our tax invoices and payment records for your plan, and a note that the account was deleted.
- A staff member who wants only their own login removed can ask the owner, or write to us.
10. Children
MedBox24 is for businesses. Do not create an account if you are under 18.
11. Changes
If this policy changes, we update the date at the top and tell owners in the app when the change matters to them.
12. Grievance officer
For any complaint about your data, write to our grievance officer. We reply within 48 hours and resolve it within 30 days.
- Email: support@medbox24.in
medbox24.in/privacy · © 2026 MedBox24. All rights reserved.