Healthcare Data Stewardship, Security Architecture & Privacy Policy.

This Privacy Policy describes the operational, technical, and regulatory principles governing data collection, processing, storage, and transfer at PharmoTech Solutions (“PharmoTech”, “we”, “us”, or “our”). PharmoTech operates as a specialized healthcare IT engineering firm delivering custom pharmacy management systems, doctor consultation applications, hospital information systems (HIS), diagnostic laboratory software, and clinical digital presence solutions.

By accessing our public website (https://pharmotech.in), submitting project inquiries, engaging in architectural consultations, or contracting with us for software engineering services, you acknowledge the data practices detailed herein.

Under Indian Digital Personal Data Protection (DPDP) Act frameworks, DISHA guidelines, and international data protection standards:

• PharmoTech as Data Controller / Data Fiduciary: We act as the data controller for personal information submitted directly to our marketing platforms, project quotation requests, prospective employee applications, and direct business communications.
• PharmoTech as Data Processor: When our engineering team designs, deploys, maintains, or provides cloud support for custom hospital portals, clinic apps, or retail pharmacy billing systems, the client institution acts as the Data Controller. PharmoTech processes institutional clinical records and patient data strictly pursuant to the client’s contractual instructions, role-based authorization matrices, and applicable Master Services Agreements.

End-users of healthcare systems engineered by PharmoTech (e.g., hospital patients, pharmacy customers) must direct individual data subject access or deletion requests directly to their healthcare provider or retail pharmacy.

We process information categorized strictly into the following functional classifications:

• Commercial Inquiries & Business Contact Data: Name, professional medical designation, institutional affiliation (e.g., clinic, hospital, retail pharmacy chain), verified business email address, phone number, and physical city/state.
• Technical Specifications & Scope Requirements: Architecture briefs, clinical workflow requirements, API endpoint parameters, third-party EHR integration specs, and sample non-production schemas provided during sprint planning.
• Automated System Telemetry: Anonymized client IP address, user-agent string, operating system version, browser rendering engine, referrer URL, and millisecond-level server response latency for defensive DDoS mitigation and Core Web Vitals monitoring.
• Engineering Support Artifacts: System logs, HTTP request-response headers, stack traces, and database connection state metrics voluntarily submitted by clients during active SLA troubleshooting.

PharmoTech maintains rigid clinical segregation protocols to guarantee that sensitive patient information is safeguarded with healthcare-grade rigor:

• Zero Marketing Aggregation: We never harvest, mine, profile, broker, or monetize patient healthcare information, diagnostic records, or pharmaceutical prescription histories for marketing or advertising purposes.
• Synthetic Test Data Standards: During software development, unit testing, and staging validation, our engineers utilize strictly synthetic, de-identified dummy datasets adhering to Safe Harbor de-identification methodologies.
• Separation of Environments: Development, staging, and production environments are strictly isolated across discrete Virtual Private Clouds (VPCs) with zero cross-environment data leakage.
• Business Associate Agreements (BAA): For US-based healthcare clients and international partners subject to HIPAA, PharmoTech executes standard Business Associate Agreements guaranteeing administrative, physical, and technical safeguards.

PharmoTech processes personal and technical data exclusively under valid lawful bases:

• Contract Performance: Delivering software development milestones, executing staging deployments, configuring cloud databases, and honoring 24/7 emergency infrastructure SLAs.
• Legitimate Technical Interest: Enhancing application load speed, hardening network firewalls against malicious automated bots, and diagnosing distributed system failures.
• Regulatory Compliance: Fulfilling tax obligations, maintaining corporate accounting records, and complying with lawful court orders or law enforcement directives within the Republic of India.
• Explicit Consent: Distributing technical whitepapers, engineering changelogs, or security advisories where the recipient has voluntarily opted in.

Our public web platform utilizes minimal, privacy-respecting client-side storage technologies:

• Strictly Necessary Cookies: Cryptographically signed session tokens required for CSRF protection, secure form transmission, and theme state persistence. These cannot be disabled as site security depends on them.
• Performance & Diagnostic Telemetry: Aggregated, cookieless metrics measuring page response time, JavaScript execution exceptions, and asset caching efficiency. We do not employ cross-site tracking pixels or invasive behavioral surveillance frameworks.
• Local Storage: Browser-local caching of FAQ category filter state and user-selected UI preferences to minimize redundant network roundtrips.

Visitors may configure their browser preferences to reject cookies or purge local storage at any time; basic informative content remains fully accessible.

To maintain 99.9% uptime across production healthcare deployments, our production servers record immutable system event logs:

• Logged Attributes: UTC timestamp, HTTP request method, target URI route, response status code, origin IP address (masked where possible), and upstream server execution duration in milliseconds.
• Log Masking: Sensitive parameters (e.g., user passwords, authorization bearer headers, prescription payloads) are automatically sanitized by reverse proxy middleware before log ingestion.
• Retention & Rolling Purges: Operational access logs are retained in encrypted cold storage for 90 days before automated cryptographic deletion, unless extended retention is mandated for active forensic investigation.

PharmoTech engages a carefully audited tier of cloud infrastructure sub-processors to maintain high-availability delivery. All sub-processors must maintain SOC 2 Type II, ISO 27001, or HIPAA compliance attestations:

• Cloud Compute & Storage: Tier-4 Indian data center regions (AWS Mumbai / GCP Delhi) and global edge networks (Cloudflare, Vercel) for distributed CDN caching and DDoS mitigation.
• Transactional Communications: Enterprise transactional SMTP providers (Amazon SES, SendGrid) strictly for delivering ticket confirmations, invoice receipts, and system alerts.
• Database & Analytics Infrastructure: Enterprise-managed PostgreSQL and Redis clusters protected by VPC peering and TLS encryption in transit.

We do not sell, rent, lease, or barter corporate contact data or client information to third-party data brokers under any circumstances.

Our engineering architecture enforces defensive defense-in-depth protocols across every layer of the technology stack:

• Encryption In Transit: Mandatory TLS 1.3 encryption across all public and internal microservice communication with HSTS preloading.
• Encryption At Rest: AES-256 bit hardware-level encryption across production databases, automated snapshots, and cold storage backups.
• Least Privilege Access (RBAC): Engineering staff access production infrastructure strictly via hardware Multi-Factor Authentication (MFA), bastion hosts, and time-bound Just-In-Time (JIT) access grants with audit logging.
• Vulnerability Management: Automated static application security testing (SAST), dependency vulnerability scanners (Dependabot/Snyk), and scheduled penetration testing.

As an Indian healthcare technology enterprise, our default hosting architecture prioritizes Indian data sovereignty:

• Domestic Data Residency: Production databases for domestic Indian hospitals, clinics, and pharmacies are hosted exclusively within certified Indian data center regions (Mumbai / Delhi NCR) in compliance with DISHA and national digital health directives.
• International Clients: For international healthcare systems (United States, United Kingdom, Middle East), cloud infrastructure is provisioned within the client’s specified geographic sovereign boundary with standard contractual clauses (SCCs).

We retain personal data strictly for the duration required to achieve the documented operational purpose:

• Pre-Sales Project Proposals: Retained for 24 months from the date of issuance to facilitate prospective client project resumption, after which records are securely archived or purged.
• Active Engineering Engagements: Maintained for the active duration of the Master Services Agreement plus 7 years to comply with Indian statutory taxation and corporate auditing mandates.
• Cryptographic Erasure: Decommissioned electronic media and expired databases undergo cryptographic shredding and zero-fill overwrites in accordance with NIST SP 800-88 guidelines.

Depending on applicable jurisdiction, individuals whose personal data is controlled by PharmoTech hold the following statutory rights:

• Right to Access & Portability: Request formal disclosure of all personal data held regarding your person or enterprise in structured JSON or CSV format.
• Right to Rectification: Request prompt correction of inaccurate, incomplete, or outdated business records.
• Right to Erasure (“Right to be Forgotten”): Demand permanent deletion of non-statutory personal data where processing is no longer necessary.
• Right to Withdraw Consent: Unsubscribe from marketing communications at any time via automated footer links or direct email request.

To exercise statutory data subject rights, submit a verified request to our Data Protection Office at dpo@pharmotech.in. We verify claimant identity before disclosing confidential records and respond within 30 calendar days.

In compliance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable DPDP provisions, our designated Grievance Officer / Data Protection Officer details are:

For rapid response regarding technical server incidents or live healthcare platform disruptions, please submit an escalated ticket via our Technical Support Center.

We reserve the prerogative to revise this Privacy Policy periodically to reflect technological advancements, evolving clinical workflows, or newly enacted statutory regulations.

When material revisions occur, we will update the version stamp (currently v2.4-2026) and publish a prominent disclosure banner across our engineering portal. We encourage healthcare partners and clients to periodically review this page to remain informed of our operational safeguards.