Privacy Policy

Invyra is operated by Medicheck.co ("we", "us"), a company based in India. It provides a business-to-business inventory platform for pharmacies and pharmacy groups worldwide. This policy explains how we handle personal data on our website and in the Invyra app.

For website visitors, people who contact us, and account administration, we decide how personal data is used and act as the controller. For the inventory, request and account data that a customer organization puts into Invyra, that organization is the controller and we act as its processor, handling the data only on its instructions and under our agreement with it. If you use Invyra through your employer, please contact your employer about your data first.

• Account data: usernames, store and organization names, role, and your password (stored only as a one-way hash).
• Business data you enter: catalog items, stock and expiry records, transfer requests, offers, chats between stores, notifications, reward points and catalog images.
• Activity and security data: audit logs of actions taken in the app, sign-in attempts, and IP addresses used briefly to limit repeated failed logins.
• Contact form data: name, email, optional phone number, organization, subject and message.
• Technical error data: when the app crashes we may record the error, page or route, and browser type. We configure our error tool not to collect request contents, cookies, IP addresses or user details.

Invyra is designed for stock and inventory information, not patient records. Please do not enter patient names, prescriptions or other patient health information into free-text fields, notes or chats. If a customer does so, that customer is responsible for having a lawful basis and any required consents.

• To provide the service (accounts, inventory, requests, notifications): performance of our contract with the customer organization.
• To keep the service secure (audit logs, login rate limits, error monitoring, backups): our legitimate interest in protecting customers and the platform, and legal obligations where applicable.
• To answer enquiries and demo requests: our legitimate interest in responding to you, or steps you asked us to take before entering a contract.
• To comply with law and respond to lawful requests from authorities.

We use a single essential cookie to keep you signed in. It expires after 24 hours and is required for the app to work, so it does not need consent. We do not use advertising, analytics or tracking cookies, and we do not sell or share personal data for advertising.

We use trusted providers to run Invyra. They process data only on our instructions:

• Render: application hosting.
• Neon: database hosting.
• Google Firebase: storage of catalog images.
• Cloudflare: content delivery and network security.
• Sentry: error monitoring.
• GitHub: encrypted database backups.

Within a customer organization, data is visible to other users of that organization according to their roles. We never sell personal data. We may disclose data if required by law, or as part of a merger or acquisition, in which case this policy will continue to apply.

Invyra is used worldwide, and we and our providers may process data in countries other than yours, including India, Singapore, the United States and the European Union. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

• Sign-in sessions: 24 hours. Failed-login records: minutes to hours.
• Customer business data and audit logs: for as long as the customer's account is active, then deleted or returned under our agreement with the customer.
• Contact form messages: up to 24 months after our last exchange, unless they become part of a customer relationship.
• Database history and backups: up to 30 days after data is deleted from the live system.

We use encryption in transit, hashed passwords, organization-level data isolation, role-based access, login rate limiting, audit logging and encrypted backups. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify affected customers and authorities as the law requires.

Depending on where you live (for example under India's Digital Personal Data Protection Act, 2023, the EU and UK GDPR, the UAE Personal Data Protection Law, California's CCPA/CPRA and similar laws), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it. We will not discriminate against you for exercising these rights.

To make a request, use our support page. If your data is in Invyra through your employer, we may refer your request to that organization. You may also complain to your local data protection authority.

Invyra is a professional tool and is not intended for anyone under 18.

In line with Indian law, complaints or concerns about how we handle personal data can be sent to our Grievance Officer through our support page. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

We may update this policy and will change the effective date above; significant changes will be communicated to customer administrators. Questions: our support page.