Privacy

Last updated: 7 August 2026

DravyaOS is offline-first by design. Your pharmacy's data — catalog, inventory, sales, purchases, payments, and customer or patient details — lives in a local database on your own machine. The cloud is an optional enhancement, never a requirement. This policy explains what stays local, what leaves your device only when you choose, and who processes it when it does.

Who we are, and our role

DravyaOS is provided by a sole proprietorship based in Delhi, India ("we", "us"). For the pharmacy data you enter, you are the data controller — you decide what to record about your shop and your customers, and you are responsible for having a lawful basis and any consent to do so. We act only as your data processor, and only for the data you choose to sync or send for AI processing. For visitors to our marketing website, we are the controller of the limited analytics described below.

What stays on your device

By default, everything. The app reads and writes to a local database first, so you can run your shop with no internet connection and no data leaving your computer. If you never enable sync or the AI add-on, your pharmacy data never reaches us.

What is synced (only if you enable it)

• When sync is on, your shop's records — catalog, inventory, sales, purchases, payments, and customer/patient details — are sent to your account so they can be shared across your own devices and restored after a reinstall.
• Sync traffic is encrypted in transit, scoped to your organization, and authenticated per device.
• You control whether sync is enabled, and can turn it off at any time.

Where synced data is stored. Synced data is held in a managed Postgres database hosted on our behalf by Railway (hosting region: Singapore). Scanned images and attachments, where used, are stored in object storage on Cloudflare R2. These providers act as our sub-processors and process the data only to run the service.

The AI add-on

AI features are optional and off unless you turn them on. When you use them — for example to read a photographed stock register or invoice — the image or text you submit is sent for extraction to our AI provider, OpenRouter, which routes it to the underlying model provider (currently Google's Gemini models) to return structured data. We do not use your data to train models, and we ask our AI sub-processors not to. If you never turn the add-on on, no data is sent for AI processing.

The demo inside the app

The app offers a demo that runs against bundled sample data. The first time a device opens it we ask for a phone number, once, so we can call you back if you would like help setting up, and optionally a name to greet you by — you can go back instead of giving either, the name field can be left blank, and a device that has answered is never asked again. What you give is sent to us together with the fact that the demo was opened, a random per-install id that is not linked to any account, and basic device information (operating system, app version, screen size). We are the controller of that information, we use it only to follow up on the enquiry, and we do not sell it or pass it to advertisers. Nothing you do inside the demo, and no real pharmacy data, is sent with it. To have the number deleted, write to us at the address at the foot of this page.

Our website and analytics

The DravyaOS website (dravyaos.com) uses Google Analytics, Google Ads and the Meta (Facebook) pixel to understand visits and measure our advertising. These set cookies in your browser. This is separate from the app — the app itself does not track you for advertising. Where the law requires consent for such cookies, we will ask for it before setting them.

The same website events (a page view, a download click, an email to us) are also sent to Meta from our server, so that ad measurement still works when a browser blocks the pixel. Those server events carry your IP address, your browser's user agent, the page address, Meta's own advertising cookies and a random visitor id we set in a cookie — the same information your browser would have sent — and each one is tagged so Meta counts it once, not twice. The random id is not linked to your name or any account. So that the address we report matches the one your browser uses, the page asks ipify.org for your IP once a day and remembers it in a cookie; ipify receives only that request. We do not send Meta your name, email address, phone number or anything you type into the app.

The chat on our website

The website has a chat assistant that answers questions about what DravyaOS does. Your questions and its answers are sent to our server, stored there, and read by us — we use them to see what people want to know and to catch the assistant answering badly. They are also passed to our AI provider, OpenRouter, purely to generate the reply. The same random visitor id described above is stored with the conversation so we can tell one session from another; we do not ask the assistant for your name, and you should not type anything confidential — including patient or prescription details — into it. If you go on to give us your contact details, that is the enquiry form below, not the assistant.

Sensitive data

Schedule-drug prescriptions and customer/patient details are treated as sensitive and protected at rest, with an audit trail for sensitive actions such as stock adjustments and write-offs. Because these can be health-related, take care to record only what you need and are permitted to keep.

Keeping data, and deleting it

Your local database stays on your machine until you delete it — keep your own backups. If you turn sync off, no new data is sent; to have your synced data or your account deleted from our servers, email us and we will action it within a reasonable period, subject to any records we must keep by law.

Your customers' rights

Because you are the controller of the pharmacy and patient data you enter, any request from your own customers to access, correct, or delete their details is yours to handle. As your processor, we will assist you in responding to such requests for data you have synced to us.

International processing

If you enable sync or the AI add-on, your data may be processed and stored outside the country where you operate, at the provider locations named above. By enabling these optional features you understand that this cross-border processing takes place.

Children

The app is business software for pharmacies and is not directed at children. We do not knowingly collect personal data from children through the app or website.

Security

We protect data in transit with encryption, authenticate every device, and protect sensitive records at rest. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security — safeguarding access to your own machines and accounts remains important.

Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the current version.

Contact

Questions about privacy, or a data request? Reach out at help@dravyaos.com.