How Dawix™ handles customer and website information.

Grievance Officer

Yesha Gupta — GoCure Solutions Private Limited

For privacy requests and grievances, contact Yesha Gupta by phone at +91 90566 86336 or email sales@dawix.in. For written requests, use the subject Privacy Request or Grievance.

Signup details before payment

When you save a Dawix signup, we store the owner name, mobile number and email, pharmacy details you supply, selected plan and any coupon or referral, and the accepted policy versions and acceptance time before payment. We use these records to verify the owner, resume signup, confirm payment and allocate the subscription. A saved signup does not itself create an active subscription. Sales follow-up about an incomplete signup requires the separate optional permission shown on the form; declining it does not prevent purchase. You can withdraw that permission or request review or deletion of an incomplete signup through sales@dawix.in, subject to applicable legal retention. Do not provide patient records in the signup form.

Business identity

Dawix™ is operated by GoCure Solutions Private Limited, with its registered address at Innov8 Rasvilas, Saket, New Delhi. For privacy questions, requests, or grievances, email sales@dawix.in with the subject Privacy or Grievance. This notice covers our website, business accounts, and pharmacy software, including customer information processed for subscribing pharmacies.

Indian law and the DPDP transition

This notice is reviewed against Indian law as at October 7, 2026, including the Information Technology Act, 2000 and the SPDI Rules, 2011 where applicable. The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. Their principal processing, consent, rights, security and breach-notification provisions are scheduled to commence eighteen months after the relevant Gazette publication. They did not all take effect in 2025. Until those provisions commence, this notice does not describe them as existing statutory entitlements. Protections already in force continue to apply. We will update required notices and procedures for the transition; no subscription term waives a mandatory protection.

Information we collect

Depending on the features used, we process pharmacy and account contact details; customer names, phone numbers, and optional email addresses; invoice line items, purchases, balances, and payment status; supplier and inventory records; uploaded source documents; support communications; and device, authentication, and service diagnostic information. Pharmacy records may reveal medicine purchases or health-related information. Data comes from users, pharmacy imports, service activity, and providers needed to deliver the requested feature. This does not mean Dawix™ collects a phone's address book. Users should avoid submitting unrelated patient information or full payment credentials in support messages or uploads.

How we use information

We process information to operate the selected features, maintain pharmacy records, synchronize devices, support imports, resolve support requests, administer accounts and subscriptions, secure the service, diagnose failures, and meet applicable legal obligations. Purposes and any required legal basis depend on the data and activity. Optional marketing or another materially different purpose requires an appropriate basis and notice; accepting service terms is not blanket consent. The pharmacy determines the purpose of its customer records in the ordinary course, while Dawix™ determines purposes for its own account administration and other independent activities. Actual processing determines legal roles.

Notice, consent, and choice

When we collect information directly, the collection notice must explain the data, purpose, recipients, and collecting and retaining business. Where consent is required for sensitive information, it must be obtained before collection and recorded, including through electronic communication where permitted. Providing a phone number for billing or completing account verification does not authorize unrelated marketing. You may decline optional information and send a consent-withdrawal request to sales@dawix.in; a service that needs that information may become unavailable. Required legal processing may continue. Once the DPDP consent provisions commence, applicable notices and consent flows must also meet their specific requirements, including clear affirmative consent and withdrawal with comparable ease. Agreeing to Terms is separate from consent to process personal data.

Subscription and renewal notices

We use the subscribing business's account email and in-app notices for subscription administration, including renewal reminders, expiry notices and information about available data access, export and deletion deadlines. These notices are addressed to the subscribing business, not to its pharmacy patients. They do not authorize unrelated promotional messages or reuse of patient contact details. Keep your account email current; email delivery can be affected by mailbox settings and independent providers.

Customer and pharmacy data

Pharmacies are responsible for establishing the required permissions and legal basis for customer, supplier, sales, prescription, and accounting data they enter into Dawix™. Customer names, phone numbers, and related billing records may be transmitted to and stored by Dawix™ to provide the service. Dawix™ remains responsible for its own obligations under applicable law; allocating responsibilities to a pharmacy does not exclude those obligations.

Tenant separation and personnel access

Customer records are associated with the relevant pharmacy, and application access is controlled through pharmacy and user permissions. Tenant separation is intended to prevent other pharmacies from accessing those records; it does not mean the records are inaccessible to the Dawix™ backend. Authorized personnel and service providers may need access for service delivery, support, security, or legal requirements. Such access must be limited to the authorized purpose and protected by appropriate access controls and confidentiality obligations. We do not claim that tenant separation alone makes the service anonymous, end-to-end encrypted, or incapable of administrator access.

Phone contacts and invoice sharing

The iOS WhatsApp invoice-text feature opens the selected number with a prefilled message. It does not save a phone contact, read the device's address book, or upload that address book to Dawix™ servers. This is separate from customer and billing information entered into or synchronized with Dawix™. The user reviews the recipient and message and chooses whether to send it in WhatsApp. WhatsApp manages its own permissions and data handling under its terms and privacy practices.

Invoice sharing

The pharmacy should confirm the customer's choice to receive invoice information through WhatsApp or another selected channel. Invoice sharing is initiated by the user and is subject to the recipient app's permissions, terms, and privacy practices. Prefilled text can be edited in that app; it is a summary of the stored invoice, not a digitally authenticated copy. Permission to deliver an invoice does not by itself authorize marketing or unrelated use of the customer's details.

Payments

Payments may be processed through third-party payment providers such as Razorpay. Dawix™ does not store card, UPI, or netbanking credentials on the marketing website. Payment providers may process payment data under their own terms and privacy practices.

Data sharing

We do not sell customer data. Relevant providers may process limited data for hosting, databases, authentication or message delivery, payments, diagnostics, support, and enabled document-processing features, with appropriate service contracts. Users may also direct sharing through WhatsApp, SMS, or another app. Sensitive information is disclosed only with the permission, contractual authorization or legal basis required for that activity. Lawful official requests and orders may require disclosure; they do not authorize disclosure of unrelated pharmacy records. Contact sales@dawix.in for the providers, processing locations and safeguards applicable to your deployment.

Transfers and processing locations

This notice does not promise that all information is stored only in India. Where SPDI Rule 7 applies, a transfer must provide the same level of protection required by those Rules and be necessary for the lawful contract or supported by the person's consent. Transfers must also comply with applicable sector-specific restrictions. When the DPDP transfer provisions commence, applicable government restrictions and conditions must also be met. Using an overseas provider or accepting these Terms does not by itself establish that a transfer is lawful. Ask for deployment-specific details before supplying data subject to a location restriction.

Retention and deletion

We retain information for the lawful purpose for which it is needed or for a period required by law. The purchased subscription term starts at Dawix Desk activation, when the contracted service is first made available to the customer, and runs for the purchased number of calendar months. Purchasing or paying earlier does not start that term early. Under our non-renewal policy, the three-calendar-month data-recovery window starts when that paid term expires without renewal. Declining renewal before expiry does not start the window early or shorten the paid term. The window ends three calendar months after the paid expiry date. For example, a six-month subscription activated on January 1 expires on July 1, and the recovery window ends on October 1. During that window, the access policy provides only the Data tab for recovery and export; ordinary business workflows are unavailable. Data-only recovery access is planned; until available, contact support to arrange available exports. At the end of the window, pharmacy business data eligible for deletion, including historical archives, must be erased, subject to the legal exceptions below. An individual's valid withdrawal or erasure request must be considered separately rather than automatically postponed until subscription expiry. Restricted backups must expire under the applicable schedule, and restoration must reapply completed deletions. Contact sales@dawix.in for an export, deletion request or the applicable category-specific schedule. This notice does not promise an automated deletion facility. Copies downloaded or shared with recipients are subject to those holders' separate responsibilities.

Records that law requires us to retain

A three-month exit window does not override mandatory retention. Applicable ICT security logs have a rolling 180-day CERT-In retention requirement. GoCure's own GST records are generally retained for 72 months from the annual-return due date for the relevant financial year, and company books and related vouchers for at least the preceding eight financial years, with longer periods where law requires. These obligations do not make every pharmacy's patient record part of GoCure's own accounts. When DPDP Rule 8(3) commences, its minimum one-year period from processing for covered personal data, associated traffic data and processing logs must also be observed for the specified statutory purposes. Further lawful retention may be required by an applicable order or proceeding. Retained records must have a documented reason, limited access and a review or expiry date; they are not available for unrelated marketing or indefinite customer archive access.

Subscriber registration records

Where CERT-In's subscriber-record requirement for covered data-centre, VPS, cloud or VPN services applies, prescribed subscriber registration details must be retained for five years after cancellation or withdrawal, or longer where law requires. That requirement concerns the prescribed registration records, not indefinite retention of every patient or pharmacy transaction. Its applicability must be assessed for the actual service arrangement.

Historical records and exports

Historical business records remain personal data where an individual can be identified. Archiving does not remove privacy obligations or create permission for indefinite storage. Retrieval of historical archives through the Import Data section is planned and is not promised as currently available. Until that capability is offered, request available export arrangements through support. A subscription exit archive is subject to the same deletion and legal-retention rules as other pharmacy data. The pharmacy must keep the copies it is independently required by law to preserve.

Requests, choices, and grievances

Email sales@dawix.in with the subject Privacy Request or Grievance, the relevant pharmacy and the contact detail used for the record. Do not send passwords, OTPs or medical documents initially. We may verify identity proportionately. You may request review and correction of supplied information, withdrawal of consent, or deletion, subject to applicable law. For pharmacy-controlled records, contact the pharmacy as well; we will assist or route the request without treating that allocation as a waiver of rights. Privacy grievances will be addressed expeditiously and within one month of receipt; any shorter mandatory deadline applies. When DPDP rights provisions commence, applicable rights also include a processing summary, correction, completion, updating, erasure, grievance redressal and nomination. The statutory grievance process must be exhausted before a complaint to the Data Protection Board where the Act requires it. Other competent complaint and remedy routes remain available. Device-permission withdrawal alone does not erase existing records.

Cookies and analytics

The website and product may use session storage, cookies, logs, or diagnostic tools for sign-in, security, and reliability. Any optional analytics or marketing technologies must be identified and configured with the choices and consent required by applicable law. Diagnostic data can itself contain personal information, so payloads, provider settings, and retention require review. This notice does not claim that no logs or third-party diagnostics exist.

Security

We use reasonable technical and organizational safeguards appropriate to the service and data, including access controls and measures to reduce unnecessary exposure. Pharmacy users must protect accounts and devices and report suspected incidents. No internet service can guarantee absolute security. Suspected incidents should be reported through the official contact route; Dawix™ will investigate and provide notifications and assistance required by applicable law and agreement. Security statements are not a certification or a guarantee that all attacks can be prevented.

Security incidents and notifications

Report suspected incidents immediately to sales@dawix.in with the subject Security Incident. We will investigate and provide legally required notifications without waiting for a completed investigation. CERT-In reporting for covered reportable cyber incidents is due within six hours of noticing the incident or it being brought to notice; available facts can be supplemented. Once DPDP Rule 7 commences, affected individuals and the Board must be informed without delay, and the detailed Board report is due within 72 hours of awareness unless the Board permits an extension. That future 72-hour step does not replace the earlier CERT-In deadline. We will notify an affected pharmacy promptly so it can meet its own duties.

Children

Dawix™ accounts are intended for authorized adult business users. Pharmacy records may nevertheless concern children. Under the DPDP framework a child is a person under 18; when its child-data provisions commence, verifiable parental consent and the applicable restrictions on detrimental processing, tracking, behavioural monitoring and targeted advertising must be observed unless a specific statutory exemption applies. A pharmacy subscription is not a blanket exemption. Current applicable safeguards and permissions continue to apply. Do not enter unnecessary child or patient information, or put medicine or diagnosis details into a phone contact for invoice sharing.

Updates to this notice

We will identify the date of changes and give additional notice or obtain consent where required for material changes in processing. A revised notice does not retroactively authorize an unrelated use of information already collected. Actual product behavior, provider arrangements, and notices must remain consistent.

Contact

For privacy questions, data requests, or grievance redressal, contact GoCure Solutions Private Limited at sales@dawix.in or Innov8 Rasvilas, Saket, New Delhi. Include the relevant pharmacy and enough information to identify your request, but do not send passwords, OTPs, or unnecessary patient records. This contact route does not restrict any complaint or remedy available under applicable law.