Medalune

Privacy Policy

Last updated: 13 October 2026

Medalune is software for medical stores and medicine distributors in India: billing, stock, purchases, accounts and related records. This policy explains what information Medalune keeps, why, who can see it, and the choices you have. It is written to follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Two kinds of information

  • Your account and business details, such as your name, mobile number, business name, GSTIN, drug licence numbers and address. Medalune decides how this is used and is responsible for it.
  • Records your business keeps in Medalune, such as bills, customers’ names and mobile numbers, patient and doctor details for Schedule H1 and X registers, stock, purchases, retailers and payments. Your business owns these records and decides how they are used. Medalune stores and processes them only to run the service for you.

2. What we collect

  • Account: name, mobile number, and your password (stored only as a secure hash).
  • Business: name, GSTIN, drug licence numbers, address, phone, email, UPI ID.
  • Records you enter or import, as described above.
  • Photos of distributor bills and of doctors’ prescriptions, only when you use AI photo reading. The photo is sent to Google’s Gemini service to read it, and Medalune does not keep it after reading. A prescription shows the patient’s name and medicines: read one only with the patient’s consent, as part of serving them. Google’s terms for this service allow it to use what it receives to improve its products, so do not use AI photo reading if that does not suit you; entering bills by hand and searching medicines work the same.
  • Technical records needed for security: sign-in times, IP address, browser type, and a log of important actions (for example, who cancelled a bill).

3. Why we use it

  • To run Medalune: billing, stock, reports, reminders and connections between businesses.
  • To keep accounts secure and prevent misuse.
  • To give support, and to manage your plan and subscription.
  • To meet legal requirements.

We do not sell personal information, and we do not use it for advertising.

4. Who can see it

  • People in your business whom you add as staff, according to the role you give them.
  • Businesses you connect with on Medalune. When a medical store and its distributor connect, they see only what the connection needs: orders, invoices, and each other’s business name, GSTIN, licence and address.
  • The Medalune team sees business details and usage counts to approve accounts and give support. It does not browse customers, patients or bills.
  • Service providers that host or run parts of Medalune for us: cloud hosting and database providers, Google (only for AI photo reading, as described above), and an SMS provider for sign-in codes when that is turned on.
  • Authorities, when the law requires it.

WhatsApp reminders open in your own WhatsApp; Medalune does not send WhatsApp messages on your behalf.

5. How we protect it

  • All connections are encrypted (HTTPS). Passwords are stored as one-way hashes.
  • Each business’s records are kept separate at the database level.
  • Database backups are encrypted and kept for 30 days.
  • If a breach affects your information, we will tell you and the authorities as the law requires.

6. How long we keep it

We keep your information while your account is active. Business records you need for tax and drug law (for example, GST invoices, which generally must be kept for six years) are your responsibility to keep: you can download them at any time. If you close your account, we delete your information within 90 days, except what the law requires us to keep. Backups are overwritten within 30 days.

7. Your choices and rights

  • See and correct your account and business details in Settings.
  • Download your records (reports and lists can be exported).
  • Ask us to delete your account and information.
  • Withdraw consent, for example by not using AI photo reading.
  • Raise a concern with us. If you are not satisfied, you may approach the Data Protection Board of India.

A customer or patient of a store who wants their record corrected or removed should ask that store, which owns the record. We will help the store do it.

8. Cookies and device storage

Medalune uses only what it needs to work: a secure cookie that keeps you signed in, and small settings saved on your device (language, theme, bills saved while offline). No advertising or tracking cookies.

9. Children

Medalune is for businesses and is not meant for anyone under 18.

10. Changes

If we change this policy in a way that matters, we will show a notice in Medalune before the change takes effect.

11. Contact

For privacy questions, requests or complaints, contact the Medalune team through the support contact shown in the app. We reply within 30 days. See also our Terms of Service.