PHARMXCHANGE — GLOBAL PRIVACY POLICY

Operator: PharmXchange Private Limited Version: 5.0 Effective date: This version takes effect on the date Version 5.0 is first published at the Canonical URL, subject to any notice or consent required by Applicable Law. Canonical URL: https://pharmxchange.in/privacy-policy

IMPORTANT PRIVACY SUMMARY

PharmXchange provides B2B discovery, structured RFQs, quotations, selected business profiles, contact-sharing and related digital services. We process information needed to operate those services, screen business submissions as appropriate, support customers, administer purchased features, prevent misuse, and respond to legitimate legal requests. Contact visibility differs by feature. Documentary verification is not a physical site inspection or a guarantee of another business's conduct. Using the Platform or agreeing to Terms is not automatic consent to unrelated marketing. You can ask about your data or make a privacy complaint using pharmxchange5@gmail.com or +91 92742 20185.

1. Who operates the Platform and who this Policy covers

1.1. The primary operator described in this Policy is PharmXchange Private Limited (CIN U62099GJ2026PTC173145, GSTIN 24AAQCP6770K1ZR), with registered office at 457-F, Office No. 4-D, Vardan Tower, Lakhudi Circle, Navrangpura, Ahmedabad City, Ahmedabad – 380009, Gujarat, India. Its separately reported GST place of business is 1001–1005 & 1008–1010, Tenth Floor, C/o The Co.Work Capital, TRUE VALUE COWORKING SOLUTIONS, OCEAN, Near Centre Square Mall, Opp. Vadodara Central, Sarabhai Campus, Vadodara, Gujarat – 390023, India.

1.2. This Policy concerns individuals using or represented in our websites, Android/iOS applications, buyer/manufacturer/seller Accounts, Third-Party Manufacturing (TPM) and Clearance Zone workflows, account verification, contact-sharing, enquiry forms, pricing and checkout journeys, customer-support interactions, exhibition/event contact forms, notifications and Company-authorized communications.

1.3. A business may provide information about its directors, officers, staff and authorized representatives. Business information can contain personal data if it identifies an individual. A User giving another person's information must have suitable authority and provide appropriate information or notice to the person, where required by law. Do not upload patient files, passwords, payment-card credentials, unrelated government identity records or sensitive medical data into ordinary RFQ, chat or listing fields.

1.4. For personal data that the Company determines why and how to process for its own Platform operations, PharmXchange acts as the responsible organization/controller or equivalent role to the extent established by the applicable law. Certain service providers process information on our instructions; independent business Users that receive contact data may also have their own legal obligations, and are not automatically our processors or agents.

2. What information we collect

We collect only information reasonably relevant to the Services and safety purposes described below, subject to actual feature settings and law. Depending on your role, category and country, this may include:

2.1. Account and individual identification: full name, business email, contact number with country code, OTP status, language, account identifier, contact preferences and login/session details.

2.2. Business identity and profile: legal/trading name, role (Buyer, Manufacturer, Supplier, distributor, etc.), registered address and operating location, country/state/city/postal code, corporate tax/VAT/GST registration when appropriate, categories, manufacturing or supply capabilities, public business profile details and representative authorization.

2.3. Verification and licensing: business registration number and documents, drug or manufacturing licences where required, regulatory licence category, authority, number, applicable expiry, supporting certification and other relevant evidence. Appropriate flows may use DigiLocker or another authorized document source or verification facility. Use of such a facility does not mean PharmXchange has access to all of a User's private government records, physically inspected their facility, certified their products or continuously validated a licence. The exact attributes returned depend on the actual integration and authorization.

2.4. TPM requirements and quotations: categories, molecules/products, dosage form, therapeutic area, requested quantity, delivery regions, specification, compliance needs, messages, technical attachments, quotations, MOQ, pricing, stated capacity, lead time and outcome events.

2.5. Clearance Zone stock and enquiries: stock listings and buyer demand, product/quantity/expiry/batch/storage or other listing particulars, expressions of interest, Seller acceptance, platform messages, intentional typed contact details and authorized profile/contact disclosure events.

2.6. Platform usage and technical information: IP address or coarse connection location where collected, browser/app version, operating system, device identifiers allowed by law/settings, language, time zone, events such as form submissions or app-store clicks, page visits, session tokens, referrer, campaign/UTM attribution and error/security logs. Precise device location and advertising identifiers are used only if a supported feature lawfully collects them with any required device permission or consent. IP and estimated geography may be inaccurate and are not the sole determinant of a contracting business's country.

2.7. Communications and consent: support requests, fraud/safety complaints, evidence you choose to submit, in-app chat and metadata, email/SMS/WhatsApp interactions where applicable, permitted call records where notice/authorization exists, optional marketing opt-ins and withdrawals, Terms/policy acceptance events and notification delivery status where the system actually records them.

2.8. Purchases and billing: Plan/credit/Boost product identifiers, purchase amount and currency, billing business details, receipt and invoice records, checkout method, payment provider reference, status, refunds, entitlement logs, tax-related information and dispute history. We do not need you to supply complete card numbers or security codes to a support agent. The payment provider or store may separately collect payment instrument details under its own notice.

2.9. Events and incomplete enquiries: information submitted through demo, contact, CPHI/WHX or other event/advertising forms, including visitor roles, consent selections, campaign identifiers, contacts and comments, subject to the actual form notice and approved purposes. An enquiry does not automatically become a completed marketplace RFQ or subscription.

2.10. Information from others: complaints from another User, responses to RFQs, customer-support correspondence, lawful public registries, information supplied by a business on its representative's behalf, independent sources used for fraud prevention or documentary review, and reports from competent authorities.

3. Purposes and lawful basis for processing

3.1. We process relevant data to create and administer Accounts, authenticate contact methods, review appropriate business information, host business profiles, deliver RFQ and quotation matches, run chats and authorized Reveal, facilitate responses and listings, administer subscriptions, Coins and Boost, process support/refunds, secure the Platform, prevent fraud, investigate credible product-safety reports, deliver service notices, comply with law and maintain necessary records.

3.2. We may measure legitimate website/app performance, reliability, lead attribution, error handling and conversions, subject to applicable consent and device/platform settings. We may contact you in response to a submitted enquiry. A business-enquiry callback is not blanket authorization for unrelated promotional campaigns.

3.3. The lawful basis varies by data, jurisdiction and purpose, and may include performance of a requested service/contract, compliance with a legal obligation, applicable legitimate interests where permitted, and express or other valid consent where required. No single legal basis is asserted to apply in every country or for every category. Where mandatory law requires notice, affirmative consent or another condition, we process the relevant data only after that condition is satisfied.

3.4. Separate marketing choices. Where required by law, optional WhatsApp marketing and optional email marketing require separately controlled choices; permission to contact you about a submitted service request, acceptance of these Terms or receiving an OTP is not permission for unrelated marketing. Promotional SMS/push and third-party tracking may require further channel-specific permissions. You may withdraw marketing permission through the controls provided or by contacting pharmxchange5@gmail.com, subject to reasonable processing time and applicable law. Opting out of marketing does not prohibit messages needed to operate your Account, investigate fraud or comply with law.

3.5. Data of a minor or a person legally unable to consent is not intended to be obtained through our restricted B2B Accounts. If notified that an Account or collection is unlawful due to age or lack of authority, we may suspend access and act as required by law.

4. Who can see your details: the three Reveal workflows

4.1. A business profile is not automatically fully public. Visibility can differ by role, verified status, access rights and the feature. Information intentionally put in publicly accessible profiles, listings or forms may be viewed by the audience indicated by the feature. Do not treat a restricted profile or private chat as a secure NDA unless specifically agreed.

4.2. TPM Zone. The Buyer may approve a Manufacturer's quotation and proceed to the authorized chat/contact connection. A Manufacturer may also request Reveal after quoting; the Buyer receives the applicable request/alert and must accept before protected Buyer identity/contact fields are exposed through that workflow. Quoting or sending a request does not itself give a Manufacturer unrestricted Buyer contact access. The exact fields and recipient must follow the active disclosure UI. Where the active flow states that permitted TPM Reveal has no separate PXC Coin charge, no additional Coin is charged for that action.

4.3. Clearance Buyer-created demand. A Seller may respond to a Buyer's ready-stock requirement and, during the permitted conversation, a participant may intentionally type or otherwise share their own contact details in chat. A quotation by itself does not automatically publish all contact fields.

4.4. Clearance Seller-created stock. A Buyer may “Show Interest.” Chat and contact-viewing access are restricted until the Seller accepts the Buyer's request. After acceptance, the authorized parties can chat, and opening the other party's profile may display contact details. Acceptance is the access-enabling trigger; it does not necessarily immediately place both parties' contact fields on screen. The disclosure shown before the relevant sharing action identifies the trigger, the fields accessible and the audience.

4.5. We may retain lawful logs of permission, acceptance, click, messaging or disclosure events that are recorded in the relevant Service, for fraud prevention, troubleshooting and legal evidence. We cannot guarantee that a recipient will delete contact information already accessed; recipients independently owe confidentiality and privacy duties under applicable law and their agreements.

5. Disclosure to service providers and other recipients

5.1. Authorized business counterparties. We share business-profile, RFQ, quotation, chat and contact information with Users according to the described feature audience and Reveal permissions. We do not sell confidential verification documents to Users merely because they buy a subscription. Product-specific documents may become visible only through separate authorized sharing actions.

5.2. Service providers. Depending on the Services used, we may use providers of hosting, authentication/OTP, app distribution, communications, payment processing, customer service, security monitoring, analytics/attribution, document verification, backups and infrastructure. These categories do not mean that every provider or integration is used for every User or country. We limit provider access to information relevant to the service supplied, subject to appropriate security, contractual and legal controls.

5.3. App stores and payments. A store or payment processor handling your subscription, top-up or Boost may process transactional identifiers, billing details and payment status independently as permitted by its own terms and data notices. A payment processor's involvement does not automatically make it the Company's grievance officer, product-trade escrow provider, or data controller for all Company services.

5.4. Support and fraud reports. Authorized Company staff may review reports and supporting material on a need-to-know basis. Reports may be sent to the official complaint address pharmxchange5@gmail.com, the additional fraud inbox team@thepharmxchange.com, and relevant responsible business-unit reviewers where the reporting workflow supports those notifications. We avoid broadly disclosing unproven accusations to unrelated users.

5.5. Legal requests and corporate changes. Information may be disclosed where legally required to competent regulators, courts or law enforcement, to protect rights against credible unlawful activity where permitted, or in lawful corporate succession subject to required privacy safeguards and notices.

5.6. Payment-channel accuracy and records. The provider and seller or merchant responsible for a purchase may differ between Apple-controlled billing, Google-controlled billing and a separately authorized Company or gateway transaction. Subject to the actual transaction, we may use the minimum necessary order, product, transaction, entitlement, refund, invoice and tax information to reconcile the relevant channel. Provider processing notices and rights may apply alongside this Policy. We do not characterize a storefront payment as a Razorpay payment, or vice versa, without transaction evidence.

6. Data location, international transfers and non-India users

6.1. PharmXchange is an Indian company. Operational providers, Users and support functions may be located in different countries. Depending on an authorized interaction, information you submit may be accessed by counterparties in another country or processed by infrastructure providers supporting the Platform. We do not state that all information is stored only in India or that a foreign transfer cannot occur.

6.2. Transfers, remote access and disclosure are subject to applicable laws and any required consent, notices, contractual safeguards or government restrictions. When a Service involves a transfer subject to additional conditions, we apply the safeguards or limits that Applicable Law requires. No clause promises GDPR compliance in all jurisdictions or that Indian law displaces foreign mandatory privacy protections.

6.3. European market exclusion. PharmXchange's current geographic eligibility policy excludes the entire European geographic region, including the EU/EEA, the UK, Switzerland and other European countries. Borderline/transcontinental territories are determined case by case. This commercial exclusion does not itself determine whether EU, UK, Swiss or other foreign data protection law applies to processing that actually occurs. Public pages may be viewable in places where paid or regulated features are unavailable. The current store-market reference is available in the Global App Availability and Purchase Eligibility page.

6.4. Outside India, Global features may be offered only to eligible businesses in permitted countries where payment, sanctions, regulatory, privacy and other legal conditions are satisfied. A business's actual incorporation, billing and establishment facts matter more than its phone code, travel location or chosen currency.

6.5. When country-specific law gives individuals additional rights or requires supplemental information, the applicable notice, rights process, representative, registration, transfer arrangement or other lawful condition applies to the relevant Service as required by that law. This Policy does not claim that a particular appointment, registration or arrangement applies in every jurisdiction.

6.6. Country distribution versus data processing. A country appearing on one or both mobile app stores is an app-distribution setting, not a representation that all Platform features, payment flows or international data transfers are legally available there. Store account-country, business establishment, billing information and physical access location may differ; the relevant facts and Applicable Law govern the actual processing purpose.

7. Retention, protection and deletion

7.1. We retain data only for a reasonably necessary and lawful period proportionate to the purposes above, including Account operation, current matching and chats, purchases, accounting and tax, applicable document/record duties, fraud prevention, contractual disputes, legitimate defense of claims and mandatory regulatory retention. Different classes of records may have different retention periods. We do not promise universal immediate deletion or a single fixed retention period where law and record type differ.

7.2. Users may ask for Account closure and, where legally applicable, access, correction, completion, portability, restriction, objection or deletion of personal information using pharmxchange5@gmail.com or an available authenticated privacy/deletion interface. We may require proportionate identity verification to avoid disclosing a record to an impostor. We will communicate the result and any lawful retention exception through an appropriate channel.

7.3. Removal of a public profile does not automatically erase external copies previously received by another User or information lawfully retained in tax invoices, security logs, legal holds and independent Users' systems. Upon Account closure, access to some Services may end, but a separately managed auto-renewing payment mandate may require an additional cancellation action with its provider.

7.4. We use security measures appropriate to our actual operations and the risks involved, which may include access restrictions, authentication, controlled document permissions, logging and incident review where implemented. No system can be guaranteed 100% secure, and we do not claim universal physical inspections, infallible identity verification or zero risk of fraud. Users should protect login credentials and report suspected unauthorized access promptly.

7.5. In the event of a personal-data or security incident, we will investigate, contain and communicate to affected people and regulators where and within the periods required by the law applicable at the time.

8. Cookies, device permissions and analytics

8.1. Our websites may use essential session/login/security technology and, where deployed, analytics and attribution identifiers or similar tools to understand site performance and lead-source effectiveness. The categories and providers used by each domain may differ. We provide the notices and choices required for the applicable technology and jurisdiction.

8.2. Browser controls may permit blocking or deleting cookies, subject to loss of features that require sessions. Where legally required, non-essential tracking must follow the valid notice/consent controls available in the relevant jurisdiction and device settings.

8.3. On mobile, the app may ask for notifications and other permissions only when needed and allowed. Device permission choices can usually be adjusted in operating-system settings; marketing notification preferences, where supported, should also be communicated clearly. Granting a device permission is not necessarily consent to every future purpose.

8.4. We may measure marketing page and store-link clicks, enquiry submissions and conversion stages. A failed or unaccepted lead submission is not represented as a completed successful lead. Analytics and advertising pixels are used consistently with the declared purposes, disclosures and applicable consent requirements.

9. Data quality and Users' obligations

9.1. You are responsible for providing information lawfully and accurately, keeping business/representative profiles and permissions updated, and not submitting private documents you are not entitled to disclose.

9.2. Do not include patient treatment details, medical histories, passwords, government identifiers unrelated to lawful verification, full card numbers or other unnecessary sensitive information in messages, quotes, stock listings, fraud reports or support emails.

9.3. Independent Users that receive contact information through chat or Reveal must use it only for an authorized and lawful relevant business purpose, not scraping, reselling, bulk marketing, public disclosure or discriminatory profiling. Those Users may independently be accountable under data-protection, confidentiality and anti-spam laws.

10. Complaints and privacy rights requests

10.1. Primary privacy, data-rights and grievance address: pharmxchange5@gmail.com. Official telephone: +91 92742 20185. Include your Account reference (if you have one), requested correction or concern and an explanation sufficient to investigate. Avoid sending passwords, unredacted cards, patient records or unnecessary ID evidence by ordinary email; we may provide a safer submission route when required.

10.2. Suspected counterparty fraud, fake documents and unsafe goods may additionally be reported to team@thepharmxchange.com, with pharmxchange5@gmail.com remaining the official reporting channel. That supplementary inbox is not a substitution for a specifically appointed officer where applicable law requires one.

10.3. We will respond and escalate rights requests and complaints within legally applicable times, taking reasonable steps to identify the correct account and inform the applicant of further available procedures when required. Where a particular law requires an expressly named grievance or data-protection officer, the Company will disclose the required appointment and contact details.

11. Applicable law and phased Indian data-protection duties

11.1. The Company's personal-data practices are governed by the laws actually applicable to the processing concerned. India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have staggered statutory commencement provisions. Compliance obligations apply according to their legally effective dates. Existing applicable information-technology, confidentiality and other binding duties continue to apply according to law.

11.2. Users abroad may have local rights that cannot be waived by a contractual choice of Indian law. Depending on applicability, those rights can include transparency, access, correction, complaint, withdrawal or erasure, with lawful exceptions. Contact us so the actual legal basis and request can be assessed rather than assuming every right is available identically worldwide.

12. Changes to this Policy

We may update this Policy in response to legal changes, new features, revised disclosures, processors, country availability or security needs. Material changes will be communicated through a lawful sufficient method and any required new permission will be obtained. Versions carry their effective date, and a change becomes binding only as permitted by Applicable Law. Historical public policy wording and accepted versions should remain retrievable where necessary to determine the rights applicable at the relevant time.

13. Contact and companion documents

PharmXchange Private Limited CIN: U62099GJ2026PTC173145 Registered address: 457-F, Office No. 4-D, Vardan Tower, Lakhudi Circle, Navrangpura, Ahmedabad City, Ahmedabad – 380009, Gujarat, India GST place of business (separate): 1001–1005 & 1008–1010, Tenth Floor, C/o The Co.Work Capital, TRUE VALUE COWORKING SOLUTIONS, OCEAN, Near Centre Square Mall, Opp. Vadodara Central, Sarabhai Campus, Vadodara, Gujarat – 390023, India Privacy / grievance email: pharmxchange5@gmail.com Telephone: +91 92742 20185 Additional fraud-report inbox: team@thepharmxchange.com

Related documents: Terms & Conditions, Refund & Cancellation Policy, Platform Disclaimer and Global App Availability and Purchase Eligibility page. These documents describe different subjects; Privacy rights are not extinguished by a general Platform disclaimer.