Privacy Policy

Last Updated: July 2026

1. Introduction

Welcome to Stemo, a platform operated by Safenest Technologies Private Limited ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our e-commerce platform.

2. Data We Collect

We collect the following types of information as a Data Fiduciary:

• Personal Information: Name, Phone Number, Email Address, Delivery Address.
• Sensitive Personal Data: Health information (Prescriptions), Financial information (Bank Account/UPI details for refunds).
• Technical Data: IP Address, Device ID, Browser Type, Cookies.

3. Purpose of Data Processing

We process your data for the following lawful purposes:

• To process and deliver your orders (Contractual Necessity).
• To verify prescriptions as required by the Drugs and Cosmetics Act, 1940.
• To improve our platform and user experience (Legitimate Interest).
• To comply with legal obligations (e.g., tax laws, cyber security regulations).

4. Consent

By using our platform, you explicitly consent to the collection and use of your information as described in this policy. You have the right to withdraw your consent at any time by contacting our Grievance Officer.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with:

• Service Providers: Logistics partners, Payment Gateways (Razorpay/UPI), and Cloud Service Providers.
• Legal Authorities: When required by law or to protect our rights and safety.

6. Data Security

We implement reasonable security practices and procedures as mandated by the IT Act, 2000, including encryption in transit (SSL/HTTPS), access controls, and strict per-store data isolation to protect your data from unauthorized access. Data is stored on servers located in India.

7. How Long We Keep Your Data

We keep personal data only as long as the purpose it was collected for requires, and then delete it. Some records we are legally required to keep for longer, and those periods override a request for deletion:

• Orders, invoices and payment records: eight years, as required for tax and accounting.
• Schedule H1 dispensing register: three years, as required by the Drugs and Cosmetics Rules, 1945.
• Prescriptions for Schedule X medicines: two years, as required by those Rules.
• Credit book (khata) balances: until settled, and then with the order records above.
• Medicine reminder data: deleted when you turn reminders off or delete your account.
• Search history: 90 days.
• Notification and delivery logs: 90 days.
• Security and audit logs: two years; failed sign-in attempts, 90 days.
• One-time codes: deleted within 24 hours of expiry.

When you ask us to delete your account we remove everything not in the list above, and unlink the rest from your account. Where a record must legally remain complete — an invoice, or a pharmacy register entry — the name and address on that document stay on it, because the law requires the record itself to be intact.

8. Your Rights (Data Principal Rights)

Under the DPDP Act, 2023, you have the right to:

• Access and review your personal data.
• Correct or update inaccurate data.
• Request erasure of your data (Right to be Forgotten).
• Nominate a representative in case of incapacity.

You can exercise the first three yourself from Account → Your data in any store you shop at — download a copy of everything held about you, correct your details, name a nominee, or delete your account. You do not need to ask us to do it for you.

9. Grievance Redressal

In accordance with the IT Act 2000 and DPDP Act 2023, if you have any grievances regarding your data, please contact our Grievance Officer:

To raise a complaint and receive a reference number you can track, use the complaint form. We acknowledge every complaint and respond within 90 days.