Privacy Policy — Oushodh.app

This Privacy Policy explains how Oushodh.app ("we", "us", "our") collects, uses, shares, and protects your information when you use the Oushodh.app mobile application (the "App"). Oushodh.app is a business-to-business marketplace that connects pharmacies, hospitals, and clinics with verified wholesalers and distributors of pharmaceutical products in Bangladesh.

Oushodh.app is a registered business in Bangladesh (Trade Licence No. TRAD/DNCC/028574/2025, Dhaka North City Corporation), with its place of business at House 840–841, Baitul Aman Tower (4th floor), Adabor, Dhaka-1207, Bangladesh. For the purpose of this policy, Oushodh.app is the controller of your personal data. You can reach us any time at info@oushodh.app.

1. Information we collect

We collect the following categories of information, in each case to operate the marketplace and verify the parties trading on it.

Account and identity

Your mobile phone number, which is your login identifier.
Your name (first and last).
One-time passcodes (OTPs) used to verify your phone number. OTPs expire 10 minutes after they are sent; the encrypted copy kept for hand delivery is wiped about 24 hours after that.

Business and verification (KYC) data — sellers and pharmacies

Organisation/business name, contact person, and business phone number.
Business address (ward/village, union/area, upazila, district, post office, and postal code) and its pin on the map (GPS location), which verification requires.
Verification documents you upload, including your trade or drug licence, signboard photograph, and profile picture, together with their file metadata and your verification status and history.

Communications and marketplace activity

The orders you place or receive: the products and quantities, the prices, the delivery address with its pin and contact phone, the name and phone number each order is placed under, and any note added at checkout.
Messages you send and receive through the App, including text, photos, files (PDF) and voice notes exchanged with other users.
Ratings and reviews you give or receive (which may be shown to other users).
Listings you view, searches and scans you run, and reports you submit about listings or users.
When you tap to scan a medicine box: the picture the camera took, reduced in size (it can show what was around the box), and the text read from it. Continuous scanning sends no picture: the words it reads go to our servers only to find the medicine and are not kept; we keep only counts.
Your cart, and the products and shops you save.

Device and technical data

Push-notification device tokens and device details (device type and name, app version, operating-system version).
Sign-in timestamps, IP address, and browser/user-agent information recorded in our security and audit logs.
Crash reports: when the App crashes or meets an error, a report of the error with the device model, the operating-system and app versions, the screen it happened on, a short trail of the App's recent steps (the screens opened, the buttons tapped, the App's own log lines, with phone numbers masked, and the web addresses of its recent requests to our servers, which can include a word you searched for), and a random ID the crash-report tool gives this installation of the App. The App's crash reports do not carry your name or phone number.
Error reports from our servers: when a request from the App fails on our side, a report of the error, which can include the content of that request.

Delivery and deliveryman identity data

Proof of delivery: when a deliveryman marks an order delivered, partially delivered, or failed, the App takes a photo in the App at the door and records the phone's precise location and the time at that moment. The supplier and oushodh.app support see the photo, the location, and the time; the buyer sees the time only.
Deliveryman and employee identity records, entered by the employer: when a supplier adds a deliveryman or an employee, the supplier enters that person's NID number and photo, present and permanent addresses, parents' names, and an emergency contact. The NID number is stored encrypted and is shown only as its last four digits (•••• 4821), to the employing supplier and to oushodh.app support.
Invitation SMS: the supplier enters the deliveryman's or employee's phone number, to which the App sends a one-time sign-in invitation by SMS.
Vendors and quotations: a supplier may enter a vendor's business name, phone number and address to ask it for prices; the App sends that phone a one-time sign-in invitation by SMS. The rates and quantities a vendor enters on a supplier's request are stored with that request.

Cash, deposits and settlement (financial) data

Cash collected at the door: for cash-on-delivery orders the App records the amount the deliveryman collected on each invoice, what he brought back, and the supplier's settlement of it at the counter — the invoices settled, any shortfall kept open, and the receipt number issued for the sitting.
Deposits: when a deliveryman deposits collected cash to the supplier — by cash hand-over, mobile financial service (bKash, Nagad, Rocket) or bank — the App records the amount, the channel, the transaction ID (TrxID) of a mobile or bank transfer, and a photo or screenshot of the slip he takes in the App as proof. The supplier confirms or corrects the deposit and the App issues a receipt.
Supplier payout accounts: the bank and mobile financial service accounts a supplier enters so its deliverymen know where to deposit — account holder name, account or wallet number, bank and branch or provider. Notifications never carry an account number.
Receipts and ledgers: settlement and deposit receipts, and the running account between a supplier and each of its deliverymen, kept as the supplier's business records.

Platform balance and commission (financial) data — suppliers

Payments to oushodh.app: when a supplier pays oushodh.app to top up its platform balance, we record the amount, the channel (for example bKash, Nagad, Rocket, bank or cash), the payment reference (the transaction ID of a mobile or bank transfer, or the receipt number for cash), the date we received it, and the member of our team who recorded it.
Commission per order: for every order placed with a supplier, the App records the commission rate, the commission taken from the supplier's platform balance, and any commission handed back, for example when the buyer cancels within 12 hours of ordering.
Opening platform balances and corrections: an opening platform balance or a correction made by our team, with its amount, the reason given, and the team member who made it.

Product requests — suppliers

When a supplier asks us to add a product that is missing from the catalogue, we collect the product's name and company, any other details the supplier adds (such as generic name, strength, dosage form, pack size and MRP), one or more photos of the product's box, who sent the request and when, and our team's answer.
Our team may use a box photo from a request as the product's picture in the catalogue.

2. How we use your information

To create and operate your account and authenticate you by phone and OTP.
To verify sellers and pharmacies through KYC review of submitted documents, so both sides can trade with confidence.
To enable search, listings, messaging, ratings, and other core marketplace features.
To send service and transactional notifications (for example, verification outcomes and new messages).
To keep the platform safe — detecting and preventing fraud, abuse, and policy violations, and handling reports.
To provide customer support and respond to your enquiries.
To find and fix faults in the App and our servers from their crash and error reports.
To comply with applicable laws and respond to lawful requests from competent authorities.
To record proof of delivery (a photo, the precise location, and the time at the door) and to let suppliers manage the deliverymen they employ.
To record cash collected, deposits, settlements and receipts between suppliers and their deliverymen, and to remind them of deposits waiting to be confirmed and invoices still to settle.
To keep each supplier's platform balance: to record its top-ups, take the commission on each order, hand back commission that is due, make corrections, and tell the shop owner when money is added, when the platform balance is low and when it runs out.
To review product requests and add approved products to the catalogue.

3. How we share your information

We do not sell your personal data. We share it only as described below.

With other users: when you trade or communicate on the marketplace, the other party sees the information necessary for that interaction — for example, your business profile, verification status, messages you send them, and ratings. The supplier you order from sees each order's products, quantities and prices, the name, shop name and phone number it is placed under, its delivery address with its pin and contact phone, and any note added at checkout. The deliveryman it sends sees each order's products, quantities and prices, the name and shop name it is placed under, its delivery address and pin, and the address's contact phone (or, if the address has none, the phone number the order is placed under). A deliveryman's proof of delivery (photo, location, time) is shown to the supplier he delivers for; the buyer sees the time only. A deliveryman's or an employee's identity record is visible to the supplier who employs them. A vendor's quotes are shown only to the supplier who asked for them; no other vendor sees them, and the supplier's own reference prices are never shown to vendors. A deliveryman's deposits, proof slips and settlement receipts are shown to the supplier he delivers for and to oushodh.app support; a supplier's payout account details are shown to its own deliverymen so they can deposit; the buyer sees none of this. A supplier's platform balance (its payments, commission lines, corrections and receipts) is shown to the shop owner, to staff the owner allows to see it, and to oushodh.app support; buyers see none of it. Product-request photos are seen by the person who sent the request, the shop owner and oushodh.app support; if our team uses a box photo as the product's picture, every verified account that views that product sees it.
With service providers who process data on our behalf:
- SSL Wireless — delivery of OTP and notification SMS to your phone number.
- DigitalOcean (Spaces object storage) — secure storage of uploaded documents, images (including the pictures taken when scanning), and voice notes.
- Google (Firebase Cloud Messaging) — delivery of push notifications to your device.
- Sentry — collection of the App's crash reports and our servers' error reports.
For legal reasons: with law-enforcement, regulators, or other authorities where required by law or to protect the rights, safety, and integrity of our users and the platform.

4. Where your data is stored and how we protect it

Your data is stored on secured servers and object storage operated by our infrastructure provider (DigitalOcean), which may be located outside Bangladesh (for example, in Singapore). Crash and error reports are stored by Sentry, which may also be outside Bangladesh. Where data is transferred internationally, we take steps to ensure it remains protected consistent with this policy.

We protect your data with encryption in transit (HTTPS/TLS), access controls, and audit logging of administrative actions. One-time passcodes are stored only transiently and expire automatically. No method of transmission or storage is completely secure, but we work to protect your information using reasonable technical and organisational measures.

5. How long we keep your data

We keep your personal data only as long as necessary. While your account is active, we retain it to provide the service. The closure of your account starts at once when you close it in the App, or once we have verified an emailed request. Deletion completes 30 days after the closure starts, and we then delete your personal data — your profile, saved addresses, cart, saved products and shops, the list of your recent searches, device tokens and notifications; for an employee's account, the identity record the employer entered (NID number and photo, parents' names and emergency contact) and the profile photo go with it. Your business's record stays with the business, because its other members and its orders rely on it: its details (including its contact name and phone) and address, its KYC documents (trade or drug licence, signboard, photos), its orders (which keep the name and phone number they were placed under, their delivery address with its pin and contact phone, and any note added at checkout), and the messages and voice notes in its conversations, which are no longer linked to you; an employer keeps a former employee's name, phone number and present and permanent addresses on file. Ratings you gave and reports you filed are deleted with your account. The ratings and reports about a business stay with that business, and a report that named you stays without the link to your account. Our usage records — the products and shops viewed and the searches and scans run from your account — stay without a link to it. The pictures you took when scanning stay with those records. Your business's pin stays with its address. Photos and files sent in a conversation are deleted 12 months after they were sent; the message itself stays. For security, fraud prevention and dispute resolution, our security and audit logs — the record of actions taken on accounts, the log of the text messages we sent, and the record of each time our support looked up a passcode for a phone number — stay after your account is deleted, no longer linked to it, with no set end date; some entries keep the phone number they concern, or the IP address and browser a request came from. A one-time passcode expires 10 minutes after it is sent. An encrypted copy of the text that carried it, kept so our support can deliver it by hand if the text fails, is wiped about 24 hours after it is sent. Residual data in backups is purged within 90 days of deletion. Where applicable law later requires longer retention, we keep only what the law requires. A deliveryman's or an employee's identity record is kept on file after they stop working for the supplier (an employee's, until their account is deleted, 30 days after its closure starts). A deliveryman's account is closed by the employing supplier or by oushodh.app support on request, not from within the App, and his identity record is never deleted. An employee closes their own account from within the App, and the identity record the employer entered (NID number and photo, parents' names and emergency contact) goes with it. Cash, deposit and settlement records — amounts, receipts and proof slips — are kept for as long as the supplier's account is active, as the business records of both parties, and are not deleted from within the App. A supplier's vendor records — the vendor's business name, phone number, address and the quotes it gave — are kept as the supplier's business records for as long as the supplier's account is active; a vendor who closes their own account keeps those quotes on the supplier's side. Platform balance records (payments, commission lines, corrections and receipts) are kept for as long as the supplier's account is active, as the business records of both parties, and are not deleted from within the App. Product requests and their photos are kept with the request; a box photo our team has used as a product picture stays in the catalogue.

6. Your choices and rights

Access and correction: you can view and update most of your profile and business information within the App.
Deletion: you can delete your account and your personal data at any time; records a business holds stay with it. See our Account & data deletion page for how to do this both inside the App and through an email request.
Notifications: you can manage push notifications in your device settings.
Deliverymen and employees: your identity record is entered and kept by the supplier who employs you; ask your employer to correct it. A deliveryman's account is closed by the employer or by oushodh.app support on request (call +8801958022440), not from within the App. An employee can close their own account from within the App, and the identity record the employer entered (NID number and photo, parents' names and emergency contact) goes with it.
Vendors: the supplier who added you keeps your business name, phone number and address; ask that supplier to correct them. Your quotes are seen only by that supplier. You can close your own account from within the App.

7. Children

Oushodh.app is a business-to-business service intended for licensed businesses and the adults who operate them. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the App. Continued use of the App after changes take effect means you accept the updated policy.

9. Contact us

Oushodh.app: House 840–841, Baitul Aman Tower (4th floor), Adabor, Dhaka-1207, Bangladesh
Email: info@oushodh.app