Privacy policy

1. Who we are

MedsAcross (MedsAcross) decides how and why your personal data is processed. Under India's Digital Personal Data Protection Act 2023 we are the data fiduciary, and under the EU and UK GDPR we are the controller. You can reach us about privacy at support@medsacross.com.

2. The data we collect

• Contact and account data: name, work email, phone, organisation, role, country and login details.
• Organisation and licence documents: licences, registration certificates, tax IDs and import permits.
• Order data: quotes, orders, invoices, shipment and payment records.
• Named-patient data, kept to a minimum: usually a patient code or initials, age, sex and the prescription and approvals the route requires.
• Side effect reports: the reporter's contact details and the details of the reaction, with the patient's age and sex but never their name.
• Messages you send us, by form, email or chat.
• Technical data: IP address, browser and pages visited, and analytics only if you allow analytics cookies.

3. Why we use it

• To answer requests, verify buyers, prepare quotes and supply medicines, which is necessary for the contract with you or to take steps you ask for before one.
• To meet legal duties, such as export, tax, good distribution practice, pharmacovigilance and sanctions rules.
• With your consent, for marketing emails and for analytics cookies. You can withdraw consent at any time.
• For legitimate purposes such as keeping the site secure and preventing fraud, where the law allows them.

4. Patient data

We do not supply patients directly and do not ask patients for medical records. Physicians and hospitals send us only what the import route requires. Patient documents are stored encrypted, shared only through signed links that expire, and opened only by the staff who need them, mainly our pharmacists. Every access is logged.

5. Who we share it with

• Manufacturers and marketing authorisation holders, for supply and for side effect reports.
• Carriers, customs agents and insurers, to ship your order.
• Banks, to process payments.
• Regulators and authorities, where the law requires it.
• Service providers who host or operate our systems, under contracts that protect your data.

We do not sell personal data.

6. International transfers

We operate from India, so data from buyers abroad is processed in India and may be shared with carriers and manufacturers in other countries to complete a supply. Where the GDPR applies, we use safeguards such as standard contractual clauses. We do not transfer data to any country that the Indian government restricts under the DPDP Act.

7. How long we keep it

We keep account data while your account is active and for a period afterwards to answer questions and meet legal duties. Order, batch, distribution and pharmacovigilance records are kept for as long as Indian export, tax, good distribution practice and pharmacovigilance rules require. Marketing data is kept until you unsubscribe or withdraw consent. When data is no longer needed, we delete or anonymise it.

8. Security

We use encryption in transit and at rest for documents, two-factor sign-in for staff, role-based access, access logs and regular backups. If a personal data breach occurs, we report it to the Data Protection Board of India and to affected people as the DPDP rules require, and to the supervisory authority within 72 hours where the GDPR applies.

9. Your rights

Depending on the law that applies to you, you can ask to access your data, correct it, erase it, withdraw consent, object to some uses, receive a copy in a portable format and nominate someone to act for you. You can also raise a grievance with us.

Use our data rights form or write to support@medsacross.com. We may ask you to confirm your identity first. We answer within one month where the GDPR applies and within 90 days in all other cases. If you are not satisfied, you can complain to the Data Protection Board of India or to your local data protection authority.

10. Grievance officer

You can reach our grievance officer at support@medsacross.com.

11. Children

This site is for professionals and is not directed at children. Information about a child patient reaches us only through the treating physician or hospital, with the consent of a parent or guardian where the law requires it.

12. Cookies

We use essential cookies to run the site, and analytics cookies only with your consent. Our cookie policy explains each one.

13. Changes

We will update this policy when our processing changes, and show the date of the latest version below.