Privacy notice

PharmaBridge (“we”, “us”) operates a business-to-business marketplace for pharmaceutical and cell & gene therapy materials. For personal data processed through the platform we act as the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Legal entity name and registered address: placeholder, to be confirmed.

We collect only what we need to run the marketplace:

• Account details: your email address, name, phone and role, and the company or companies you belong to.
• Company details: legal and trade name, addresses, GSTIN, PAN, CIN, licence and certificate numbers, manufacturing sites, and (for buyers) information about your programme that you choose to share.
• Uploaded documents and extracted fields: the files you upload (for example GST certificate, PAN, licences, GMP certificates, CoAs, catalogues) and the values read from them, including who confirmed or corrected each value.
• Bank details: account holder, account number and IFSC, stored encrypted and shown masked.
• Marketplace activity: products, requests for quotes, offers, orders and messages between companies.
• Shipments and lot tracking: shipment status updates, lot scans at each checkpoint and temperature logs, each with who recorded it and when. A scan or status update carries your location only if you choose to attach it (see Location and photos).
• Site visits: manufacturing site addresses and an optional map pin, visit checklists, notes, and geotagged photos taken by our staff during a visit. Photos may show employees at the site.
• Consent records: what you agreed to, for which purpose, against which version of this notice, when, and from which IP address and browser; and when you withdrew.
• Rights requests: requests you make about your data (access, correction, erasure, nomination, grievance), including a nominee’s name and email, and our responses.
• Usage and audit logs: a record of sign-ins and changes (who did what, and when).
• Security data: IP address and device or browser information, used to protect accounts and the platform.
• Enquiries: what you send us through the contact form.

Some of this, such as names, email addresses, phone numbers, locations, photos of people, PAN of individuals and bank details, is personal data under the DPDP Act. Much of the rest is business information about companies.

• To create and secure your account and sign you in with a one-time email code.
• To pre-fill onboarding forms from your documents, if you turn on AI reading, so you can check and confirm them.
• To verify suppliers, logistics partners and buyers before they can trade.
• To show verified listings to buyers and run quotes, negotiations and orders between companies.
• To track shipments and lots between suppliers, buyers and logistics partners, including temperature records.
• To carry out site visits and award the Site verified badge.
• To send service emails, such as login codes, verification updates and order notifications.
• To record your consent and handle your rights requests.
• To keep an audit trail, prevent fraud and misuse, and investigate security incidents.
• To answer enquiries and handle disputes during the proof of concept.
• To learn whether the proof of concept works, using aggregated measures (for example how often AI-filled fields needed correcting).

We process personal data on the basis of your consent, and for certain legitimate uses permitted by the DPDP Act, such as complying with law (for example keeping tax and commercial records).

Consent is given by each person, for each purpose. When you first sign in, we show you a short notice and ask you to tick a box to agree to using PharmaBridge. AI reading of documents is a separate, optional purpose that you can turn on there or in any upload area. Agreeing doesn’t consent for your colleagues; each of them is asked too. When this notice changes significantly, we ask again.

You can withdraw consent at any time, as easily as you gave it, purpose by purpose, in the app at /account/privacy. Withdrawing AI reading stops future AI processing straight away. Withdrawing consent to use PharmaBridge signs you out on every device and opens an erasure request for your personal data. Withdrawal doesn’t affect processing already carried out, and records we must keep by law stay for the periods in How long we keep it.

Documents are sent to Anthropic’s Claude models, which act as our sub-processor, to pre-fill forms and your supplier questionnaire, to read your specifications and the certificates of analysis for your lots, to answer questions you ask about your vault, and to check a qualification pack a supplier shared with you for gaps. Anthropic reads the documents and returns the result to us.

• Only with your separate consent. No document is sent to Anthropic unless the person using the feature has turned on AI reading. A buyer’s QA reviewer who has turned it on can run the gap check on the copies of a pack a supplier shared with them. Without it, you can always do the work by hand.
• This processing may take place outside India. Documents are stored permanently only in our Azure Central India storage; they are sent to Anthropic for processing only.
• Every AI-filled value or finding is shown with the document it came from. Filled values must be confirmed by a person, and qualification decisions are always made by a person.
• Anthropic’s retention and use of data sent through its API is governed by our agreement with it placeholder: terms and retention period to be confirmed.

• Lot scans and shipment updates: your device’s location is read only when you tick “Attach my location” or “Add my current location”. It is saved with that scan or update and seen by the companies on the order or shipment and by our staff.
• Site map pin: read only when you tap “Use my location”, saved with the site, and seen by your company and our staff.
• Site-visit photos: taken by our staff during a visit and saved with the location and time they were taken. They are seen by the company that was visited and our staff. They may show employees at the site; our staff avoid photographing people where they can.

We don’t track your location in the background.

• Microsoft Azure (Central India): hosting, database and document storage.
• Microsoft Graph / Microsoft 365: sending service emails from our mailbox.
• Anthropic: AI document reading, questions, CoA and specification reading, and pack checks, as described above.

These providers process data on our instructions. We don’t sell personal data or use it for advertising.

• Your company: members of your company account, according to their role.
• Buyers: a verified supplier’s listings, company name and certificate details (such as licence and GMP validity). Never PAN, bank or GST documents.
• The other party in a negotiation: quotes, offers and orders are visible only to the two companies involved. A supplier sees a buyer’s company name, not its programme details.
• Counterparties to an order: the buyer and supplier see the shipment, lot and temperature records for their order, including who recorded each step and any location attached to it.
• Logistics partners: the carrier on a shipment sees the shipment and lot details it needs (the parties, addresses, product and quantities), and records status updates, scans and temperatures.
• Site visits: the visited company sees the checklist results, photos and summary of its own visit; buyers see only whether a site holds the Site verified badge.
• Our team: verification and support staff, with access limited to what their role needs.
• Authorities: where required by law.

• Each company’s data is isolated in the database with row-level security.
• Bank account numbers and PAN are encrypted at column level and masked in the app.
• Documents are kept in private storage and opened only through short-lived links.
• Changes are recorded in an append-only audit log.

If a personal data breach happens, we inform the people affected and the Data Protection Board of India without delay, as the DPDP Act and Rules require. We tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. These periods are pending legal review placeholder: to be confirmed by counsel.

• Account and profile data (name, email, phone): while your account is active, then up to 3 years after it is closed, unless you ask us to erase it sooner. Commercial and tax records that mention you may need to be kept longer (8 years for GST and accounting records).
• Company records and uploaded documents: the life of the company account plus 8 years.
• Quotes, orders, shipments, lot scans and temperature logs: 8 years, as commercial and traceability records.
• Site visits and photos: the validity of the Site verified badge plus 8 years.
• Consent records: the life of the account plus 8 years, as proof of consent.
• Session and sign-in records (with IP address and browser): 1 year.
• Audit and security logs: at least 1 year; audit records of verification, orders and consent are kept for 8 years.
• Login codes: 30 days.
• Contact-form enquiries: 1 year.
• Documents sent to Anthropic for AI reading: we keep no copy outside our Azure Central India storage. Anthropic’s retention is set by its API terms placeholder: Anthropic retention terms to be confirmed.

After these periods we delete the data or make it anonymous.

Under the DPDP Act you can do the following in the app, at /account/privacy after signing in:

• Access a summary of the personal data we hold about you and how we use it, as a download.
• Correct or complete inaccurate data (most company data can also be edited in the app).
• Erase data that’s no longer needed, subject to legally required retention.
• Nominate someone, by name and email, to exercise your rights in the event of death or incapacity.
• Withdraw consent for any purpose, at any time.
• Raise a grievance with us, and, if you’re not satisfied, with the Data Protection Board of India.

We answer every request and grievance within 30 days. You can see its status, due date and our response in the app.

Grievance officer: placeholder, name and contact to be published.

PharmaBridge is for businesses. It isn’t intended for anyone under 18, and we don’t knowingly collect their data.

We’ll update this notice as the proof of concept develops and after legal review. Each version is numbered; this is version 2026-10-30. When a change is significant, we ask each registered user to read it and consent again in the app; earlier consents stay on record.

To exercise your rights, use /account/privacy after signing in. For any other question, contact us and choose “Security or data question”.