Privacy Policy

1. Who we are and what this policy covers

Alve Tech is a pharmacy-management software service operated by Alvebron Healthcare Private Limited. The software is also referred to as Grow Pharmacy in some screens, account records and documentation. This policy covers our public website at www.alvetechies.in, the pharmacy workspace at app.alvetechies.in, the administration portal at admin.alvetechies.in, and our related onboarding, subscription, support and enabled business-messaging services.

Our service helps pharmacies and dispensing practices manage inventory, supplier purchases, patient bills, payments and dues, medicine returns, credit notes, reminders and operational reports. Alve Tech provides the software; the pharmacy or practice is responsible for the care, dispensing and transactions it performs.

2. Alve Tech and your pharmacy have different responsibilities

For enquiries about our software, subscription administration, staff accounts, security and our own customer support, Alvebron Healthcare Private Limited determines the relevant purposes of processing.

For patient, prescription-related, billing and dispensing information entered into a pharmacy workspace, the pharmacy or practice generally determines why the information is collected and how it is used. Alve Tech stores and processes it to provide the software on that organisation’s instructions, subject to applicable law. The pharmacy is responsible for its patient notices, necessary permissions, accuracy of records, staff access and retention obligations.

If you are a patient, contact the pharmacy shown on your bill first about your records. You may also contact our Grievance Officer; we will help route and assess your request. Being part of the same software platform does not make one pharmacy’s patient records available to other pharmacies.

3. Information we collect or receive

Medicine and dispensing records can reveal health information. We treat them as sensitive and use them for the service purposes described here. Do not put patient information into the public subscription-enquiry form. We do not require Aadhaar, biometric information, access to your personal contact list or precise device location for the ordinary pharmacy-management workflow.

4. How and why information is used

• Respond to software enquiries, arrange demonstrations, onboard pharmacies and administer subscriptions and invoices.
• Authenticate users, assign authorised access and operate the correct pharmacy workspace.
• Provide billing, inventory, imports, dues, returns, credit notes, reminders and requested reports.
• Deliver requested account invitations and service communications, and support enabled messaging features.
• Troubleshoot faults, maintain availability, investigate misuse and preserve an appropriate activity history.
• Meet applicable accounting, pharmacy-record, security and legal obligations, and establish or defend legitimate claims.

We collect information needed for a stated service purpose and obtain consent or other authorisation where required by applicable law. A pharmacy must obtain the permissions required for the patient information it supplies. Reading this policy, or merely browsing our website, is not blanket consent to unrelated marketing, disclosure of health information or connection to a Meta service.

We do not sell or rent patient records or Meta Platform Data. We do not use patient medicine histories to build advertising audiences. The pharmacy-management service does not use patient records to train general-purpose AI models. We may use statistics that no longer identify individuals to understand service performance and usage.

5. Who information may be shared with

• Your pharmacy’s authorised users: access depends on the account’s tenant membership and role. The pharmacy controls the staff it authorises.
• Alve Tech personnel and service providers: limited access as necessary for hosting, maintenance, account administration, support and security. Infrastructure administrators may require privileged access to investigate or maintain the service; routine platform administration is not a public patient-record directory.
• Amazon Web Services: AWS Lightsail supports application hosting and database infrastructure. Amazon SES is used for configured transactional email, such as invitations and account-related messages.
• Messaging and communication providers: Meta/WhatsApp and relevant communication services process information involved in messages you send or features you explicitly use, as described below.
• People you choose to share with: a pharmacy may print bills, download reports, or share records with its patient, accountant, prescriber or another authorised recipient. The pharmacy is responsible for choosing appropriate recipients.
• Legal and professional recipients: when necessary for a valid legal requirement, regulatory process, security investigation or professional advice, subject to applicable confidentiality and disclosure requirements.

We limit service-provider processing to the necessary purpose and require appropriate confidentiality and data-protection safeguards. A proposed business reorganisation involving personal data would be assessed under applicable law, with notice and other protections where required. Personal information is not made public merely because a pharmacy uses Alve Tech.

6. Meta, Facebook and WhatsApp

This section applies to communications with Alve Tech through WhatsApp and to an optional WhatsApp Business connection where that feature is offered and deliberately enabled. It does not mean that every pharmacy account is connected to Meta. The ordinary Alve Tech pharmacy sign-in uses its own email/password accounts; this policy does not represent that Facebook Login, Instagram permissions, contact-list access or advertising tracking is enabled.

For a supported WhatsApp business interaction, the information involved may include the recipient’s phone number and WhatsApp identifier, profile/display name if provided, message text or media supplied for the conversation, message identifiers, timestamps and delivery/read status where available. A business connection may also involve the authorised business account identifier, phone-number identifier, permission records and access credentials required to operate that connection.

We use such information only for the requested conversation, authorised business messaging, connection management, delivery/support troubleshooting and necessary security or legal purposes. An enabled messaging feature must explain its purpose and obtain the applicable permissions. A routine message does not give us permission to retrieve unrelated personal Facebook or Instagram content.

Message content and routing information are processed by WhatsApp/Meta when you use that service. A pharmacy must have the necessary authority before including patient-specific information in a message and should use the minimum information needed. Using the pharmacy software does not by itself give Meta access to the pharmacy’s patient database.

You can ask the sender to stop optional messages, withdraw a messaging permission, disconnect an enabled business connection through the available account controls or ask our support team to help. We will honour valid opt-out and deletion requests, subject to necessary legal exceptions. Disconnecting a service stops the relevant future access; request deletion separately for information already held. See our data-deletion instructions. Meta also handles data under its own Privacy Policy and WhatsApp’s Privacy Policy.

7. Enquiries, service messages and marketing choices

When you submit the website enquiry form, we use your details to respond about Alve Tech and the subscription you asked about. Account invitations, security notices, subscription information and support replies are service communications. Optional promotional communication requires the permissions applicable to that channel, and you can ask us to stop it using the contact below.

A refill reminder entered by pharmacy staff is a service record; entering it does not itself authorise unsolicited messaging. The pharmacy must obtain the appropriate patient permission before using an external communication channel. We may keep a minimal suppression record to respect an opt-out without retaining unnecessary message content.

8. Cookies and browser storage

The pharmacy application uses the essential growpharmacy_session cookie to keep an authenticated user signed in. It is configured with Secure, HttpOnly and SameSite protections. Session duration follows the service configuration and can end earlier through sign-out, revocation or account changes.

Browser storage may support interface functions, such as carrying a selected substitute medicine into billing. Clearing cookies or browser storage can sign you out or reset those functions. These policy and deletion pages do not install advertising pixels or third-party analytics. If we introduce non-essential tracking elsewhere in the service, we will provide the relevant notice and obtain consent where required before activating it.

9. How long information is kept

We keep identifiable information for the service purpose for which it was collected, and for a further period only where justified by applicable law, a necessary security purpose or a legitimate claim. Retention depends on the record and the pharmacy’s obligations; there is no single retention period for every category.

• Enquiry and account information: retained to respond, administer the relationship and resolve related issues; continued retention must be justified when that purpose ends.
• Patient bills, dispensing, tax, dues and return records: retained under the pharmacy’s instructions and applicable recordkeeping obligations. Subscription expiry or account suspension does not automatically delete legally relevant records.
• Security and activity history: follows the configured audit-retention period, ordinarily at least 120 days, with additional retention where necessary for an identified incident or legal obligation. Access expiry for a session or invitation does not necessarily erase its associated administrative record immediately.
• Meta-derived information: retained only while necessary for the authorised feature or another use permitted by Meta’s terms and applicable law. We delete data no longer needed, and act on valid user or Meta deletion requests as soon as reasonably possible, subject to a genuine legal retention requirement.
• Backups: copies are restricted from routine use. Approved deletions are applied to active systems and addressed in backup expiry or replacement; if a backup is restored, applicable deletion instructions must be reapplied. We explain relevant backup delays or legal holds when responding to a request.

Contact us for a record-specific retention explanation. Where part of a record must be kept, we limit its use to the reason for retention and consider deletion or de-identification of information that is no longer necessary.

10. Security and storage location

The service uses HTTPS, hashed account passwords, role-based access and logical separation of pharmacy data in PostgreSQL tenant schemas. We use access controls and operational safeguards appropriate to the information and investigate reported security concerns. No internet service can guarantee that unauthorised access or loss will never occur.

Our application infrastructure is hosted on AWS Lightsail in India. Email, messaging, support and infrastructure providers may process relevant information through systems in other countries. We assess such processing under applicable law and use appropriate safeguards; necessary sensitive-data transfers require the protections and authorisation applicable to them. We do not claim that every provider copy remains exclusively in India.

We will notify affected organisations, individuals and authorities of a personal-data incident where applicable law requires it. Pharmacy users should protect credentials, limit staff permissions and report suspected unauthorised access promptly.

11. Your choices and privacy requests

You may ask us to explain our processing, provide access to information about you where applicable, correct inaccurate details, withdraw consent, stop optional communications, or delete information that is no longer required. Other rights available under applicable data-protection law can also be raised through the contact below.

We may ask for proportionate information to verify your identity and authority before disclosing or changing records. A request concerning pharmacy-held patient data will normally be coordinated with the relevant pharmacy. Withdrawal may affect a feature that needs that information, but it does not invalidate earlier lawful processing or remove a lawful recordkeeping obligation.

Financial and dispensing records may need an auditable correction instead of silent removal. We explain any limitation or refusal and the reason, and help you identify an appropriate next step. Detailed request instructions are available at www.alvetechies.in/data-deletion/.

12. Children’s information

Alve Tech accounts are intended for adult pharmacy owners, authorised staff and business representatives. Children are not invited to create independent pharmacy-management accounts. A pharmacy may nevertheless record a child’s dispensing information as part of care or a transaction. The pharmacy is responsible for the lawful authority, parent/guardian involvement and protections required for that child’s information. We do not use children’s patient records for behavioural advertising.

13. Privacy contact and grievance handling

For a privacy question, correction, deletion request, consent withdrawal or complaint, contact our designated officer below. Include “Alve Tech privacy request” or “Alve Tech data deletion request” in the subject and enough information to identify the account or pharmacy concerned. Please do not send passwords, OTPs, full payment credentials or unrelated medical documents.

We acknowledge requests as soon as practicable and address privacy grievances expeditiously, within one month of receipt where required by applicable law. If verification, pharmacy coordination or a lawful retention requirement affects a deletion request, we explain what can be completed, any necessary restriction, and the next step. You may ask the officer to review an unresolved concern and use any further remedy available under applicable law.

14. Changes to this policy

We may update this policy when our service, enabled integrations or legal obligations change. The effective date and last-updated date appear at the top. We provide additional notice of material changes where appropriate and obtain fresh consent where required. Previous versions can be requested from our privacy contact.

This policy is read alongside the permissions and notices shown for a feature you choose to use. If information is to be used for a new purpose, the relevant notice and any required consent must be provided before that use.