StockMed Privacy Policy

1. Developer Identity & Healthcare Scope Disclaimer

This Privacy Policy governs the StockMed mobile application (Android / Web) operated by StockMed Technologies Private Limited ("StockMed", "we", "us", or "our"), having its registered operations at Varanasi, Uttar Pradesh, India (https://stockmed.store).

This policy details our standards regarding the Access, Collection, Use, Processing, Storage, Sharing, Retention, and Deletion of user data in strict compliance with the Google Play User Data Policies, the Digital Personal Data Protection (DPDP) Act, 2023 (India), and the Information Technology Act, 2000.

2. Data We Collect & How It Is Handled

We practice strict data minimization. We only collect data that is required for the application's core functionality:

A. Personal Information

• Name & Contact Person: Collected during registration to identify authorized store personnel.
• Email Address: Collected for authentication, password recovery, and transactional account notices.
• Phone Number: Formatted in E.164 standard (e.g. +91...) for OTP verification and B2B communication between trading partners.
• Physical Address & PIN Code: Captured to associate retailer store locations with authorized local wholesale stockists.

B. Commercial & Regulatory Business Data

• Medical Store / Business Name: Used for commercial trade invoicing and pharmacy search directories.
• Drug License Numbers (Form 20/21/20B/21B): Required under the Drugs and Cosmetics Act, 1940 to verify licensed status.
• Goods and Services Tax Identification Number (GSTIN): Required for generating commercial B2B tax invoices under Indian tax regulations.

C. Location Information (Coarse & Precise GPS)

• Purpose: Used exclusively to pin the physical pharmacy/godown location during registration and to calculate straight-line Haversine distances ("450 m away", "1.2 km away") for nearby store discovery.
• Permission Behavior: Location is optional. Users can manually enter their State, City, Locality, and 6-digit PIN code without granting GPS permissions. StockMed does NOT track device location in the background or monitor continuous movement.

D. Camera Access & Document Scanning (OCR)

• Feature Moment: Requested only when a chemist or wholesaler chooses to scan a printed medicine bill, wholesale invoice, or physical shortage note.
• On-Device ML Kit OCR: Physical document images are scanned locally on the device using Google ML Kit. Offline text extraction occurs without network data transmission.
• Google Gemini AI Multimodal Vision: For complex tabular invoice parsing, temporary image bytes are processed via secure TLS connection to the Google Gemini 1.5 Flash Vision API.
• Zero Raw Image Retention: StockMed DOES NOT store original bill or prescription images on cloud servers or Firebase Storage. Images are processed ephemerally in RAM and immediately discarded once structured text is extracted.
• PrivacyGuard PII Sanitization: Before any text or query is processed, our proprietary on-device PrivacyGuard filter automatically detects and masks Aadhaar numbers, PAN cards, credit cards, passwords, and private tokens.

E. Biometrics (App Lock)

• StockMed provides optional Biometric App Lock via the standard Android `BiometricPrompt` framework. StockMed never has access to, does not collect, and does not store raw fingerprint or facial biometric data. All biometric verification is handled strictly by the local device operating system hardware keystore.

F. Device & Diagnostic Data

• Firebase Crashlytics: Collects non-personally identifiable crash stack traces, OS version, and device model to resolve software bugs.
• Firebase Cloud Messaging (FCM): Collects device push notification tokens to alert users about order status changes and stock availability updates.
• Zero Advertising SDKs: StockMed contains NO advertising SDKs, NO third-party behavioral trackers, and does not sell user data to data brokers.

3. Google Play Data Safety Inventory

4. Data Retention & Deletion Schedule

We do not retain personal information indefinitely. Data is preserved only as long as necessary to fulfill legitimate operational purposes or statutory obligations:

5. Google Play Account & Data Deletion

In accordance with Google Play requirements and Section 12 of the DPDP Act 2023, StockMed provides genuine, complete account and personal data deletion mechanisms:

A. In-App Immediate Deletion (Recommended)

1. Open the StockMed app and sign in.
2. Tap the Menu icon (⋮) in the top-right corner → select Privacy Center.
3. Scroll down to the Delete Account & Personal Data card.
4. Tap Delete Account, provide an optional reason, and confirm.
5. Your profile, inventory, shortage notes, and Firebase Auth account are instantly purged.

B. Web-Based Deletion Request (Zero-App Required)

Users who have uninstalled the application or cannot access their device can submit a deletion request via our public portal:

6. Third-Party Service Providers & Cloud Security

We work only with reputable cloud infrastructure providers who adhere to strict data security standards:

• Google Firebase (Google Cloud Platform): Authentication, Cloud Firestore database, and Cloud Messaging. Data is encrypted in transit using TLS 1.3 and at rest using AES-256.
• Google Gemini AI (Google Cloud): Ephemeral multimodal image text parsing. No customer training or permanent image retention.
• Google ML Kit: 100% on-device, offline machine learning text recognition.

Database Access Controls: Server-side Firestore Security Rules strictly isolate data by user UID and role. Retailers cannot inspect another retailer's private stock records, and wholesalers access only authorized order notes routed to their 5-digit code.

7. Children's Privacy Protection

StockMed is an enterprise B2B pharmaceutical supply chain tool intended solely for registered adults, pharmacy owners, and authorized trade representatives aged 18 and older. We do not knowingly solicit, collect, or process personal data from children under the age of 18. If we discover that personal data of a minor has been mistakenly submitted, we purge it immediately.

8. User Rights Under DPDP Act, 2023

As a Data Principal under Indian law, you possess enforceable statutory rights:

• Right to Access: Request a full machine-readable summary of your personal data stored with StockMed.
• Right to Correction & Updating: Update inaccurate business profile, address, or licensing information.
• Right to Erasure: Request the deletion of personal and store profile records (subject to statutory tax retention).
• Right to Nominate: Designate a representative in the in-app Privacy Center to exercise your data rights in the event of death or incapacity (Section 14).
• Right to Grievance Redressal: Submit inquiries or complaints directly to our designated Grievance Officer.

9. Grievance Officer & Contact Details

For any privacy concerns, data rights requests, or statutory complaints under the DPDP Act 2023, you may contact our designated Grievance Redressal Officer: