Privacy Policy

This Privacy Policy explains what information Innobrains Technologies ("Innobrains", "we", "us" or "our") collects when you use MediPOS, our pharmacy software. It also explains how we use and protect that information and the choices you have. It applies to the MediPOS website, the Cloud edition, the Offline edition, the MediPOS Windows app and the MediPOS Owner app (together, the "Service"), and should be read with our Terms & Conditions.

1. Who is responsible for your information

• Your account and billing information: Innobrains Technologies decides how this is used and is responsible for it.
• Your pharmacy's records: the pharmacy decides what is recorded about its customers, staff, suppliers and stock. We store and process these records on the pharmacy's behalf and only on its instructions, to provide the Service.

2. Information we collect

Information you give us

• Account: your name, mobile number, email address, pharmacy name, city and address, and your password. Passwords and PINs are stored only as secure one-way hashes, never in readable form.
• Pharmacy records: everything you and your staff enter into MediPOS. This includes products, prices, batches and stock, sales, returns, purchases, suppliers, customers (for example names and phone numbers for udhaar), expenses and accounts.
• Billing: your plan, invoices, and the payment details and proofs you upload, such as a bank transfer receipt.
• Communications: messages you send us through the contact form, support tickets, email or WhatsApp.
• FBR details: if you switch on FBR integration, the NTN, POS ID, token and related settings you enter.

Information collected automatically

• Licences and devices: for the Offline edition and the Windows app, a machine identifier of each activated PC, its name, the MediPOS version and the times it checks in. Each check also reports whether MediPOS's files and the PC's clock are intact. We use these to enforce licences and to stop tampering.
• Security and activity logs: sign-ins, IP addresses, device and browser type, and an audit log of important changes (such as price changes, voids and permission changes). The audit log shows who made a change and when.
• Error reports: when MediPOS crashes, a technical report is sent to us so we can fix the problem. Before it is stored, we remove information such as phone numbers, email addresses, CNIC numbers, secret tokens and the values in database queries.
• Website visits: cookies needed to run the site (section 9). If enabled, Google Analytics shows us which pages are useful.

3. How we use information

• To provide the Service: signing you in; storing, showing, printing, syncing and backing up your records; delivering updates; and running the features you switch on, such as FBR integration and the Owner app.
• To manage your account: reviewing new accounts, running trials, invoicing, verifying payments, managing licences and devices, and handling refunds.
• To support you: answering questions and solving problems. Where needed, this may include looking at your account with your knowledge.
• To protect the Service: security monitoring, and preventing fraud, trial misuse, licence sharing and tampering.
• To communicate: sending service emails and notices, such as email confirmation, trial and renewal reminders, and important changes. We send marketing messages only where you have agreed to receive them, and you can opt out at any time.
• To improve MediPOS: using error reports and summary usage figures that do not identify your customers.
• To meet legal obligations: for example tax and accounting record keeping, and lawful requests from authorities.

We do not sell personal information, and we never use your pharmacy's records for advertising.

4. Your customers', staff and suppliers' information

When your pharmacy records information about its own customers, staff or suppliers, the pharmacy decides what is recorded and why. The pharmacy is responsible for having a lawful basis to do so and for telling those people where required. We use such information only to provide the Service to your pharmacy. We never contact your customers or suppliers, and we never share their information for anyone else's use.

5. Where your information is stored

• Cloud edition: your records are stored on servers used by us to run the Service. Inside the database, each pharmacy's records are kept separate from every other pharmacy's, and database rules enforce this.
• Offline edition: your records are stored on your own computer, and you control that computer. Only licence check-ins, update checks and error reports are sent to us, along with sync or cloud backups if you switch them on. Cloud backups are encrypted before they leave your PC.
• Our servers and service providers may be located in Pakistan or in other countries. Wherever your information is processed, we protect it as this policy describes.

6. Who we share information with

• Service providers: hosting, content delivery and security, email delivery and backup storage providers. They process information only to provide their services to us, under obligations to protect it.
• The Federal Board of Revenue: only if you switch on FBR integration, and only the invoice information FBR requires.
• Authorities: when the law, a court or a competent authority requires it, or to protect the rights and safety of our customers, the public or us.
• A successor business: if MediPOS or Innobrains is transferred to another business, your information may be transferred with it. It remains protected by this policy.

7. Access by our team

Only authorised Innobrains staff can access account information. They do so to provide support, verify payments, keep the Service secure or meet legal obligations. Access is limited by role, and our staff's changes to an account are recorded in its history.

8. How we protect information

• Encryption in transit: connections to the Service use encrypted HTTPS.
• Sign-in protection: passwords are hashed, and optional two-step sign-in is available, which is required for our own administrators.
• Separation and permissions: each pharmacy's data is kept separate, and permissions are set per user and per branch.
• Backups: backups are taken regularly and checked, and cloud copies are encrypted.
• Signed updates: Offline updates are signed so that only genuine MediPOS updates are installed.

No system is perfectly secure. If we learn of a security incident affecting your information, we will tell you without undue delay and explain what we are doing about it.

9. Cookies

• Essential cookies: MediPOS uses cookies that are needed for it to work. They keep you signed in, protect forms against forgery, and on a registered counter PC let staff sign in with their PIN. These cannot be switched off without stopping the Service from working.
• Analytics: the public website may use Google Analytics to count visits and see which pages are useful. You can block analytics cookies in your browser without affecting MediPOS.

10. How long we keep information

• Records while you have an account: account information and pharmacy records are kept while your account exists, including after a trial or plan ends, so that you never lose them.
• After a deletion request: when you ask us to close your account, we delete your account and Cloud records within 30 days. We keep only what the law requires, such as invoices and payment records for tax and accounting. Copies in our backups are removed as those backups are replaced.
• Error reports: these are deleted 90 days after the problem is closed.
• Offline edition: the records stored on your own computer stay under your control.

11. Your rights and choices

You can view, correct and export your records from inside MediPOS at any time. You may also ask us:

• for a copy of the personal information we hold about you;
• to correct information that is wrong;
• to delete your account and records, subject to section 10;
• to stop sending you marketing messages.

To make a request, email info@innobrains.pk from your registered email address. We may need to verify your identity, and we reply within 30 days. If your request concerns a pharmacy's records about you, for example as its customer, please contact that pharmacy. We will help the pharmacy respond.

12. Children

The Service is meant for businesses and is not directed at children. We do not knowingly collect children's information for our own use. Information a pharmacy records about its customers is handled as described in section 4.

13. Changes to this policy

We may update this policy from time to time. The date of the latest update is shown below, and we will tell you inside MediPOS or by email about important changes.

14. Contact

For any question or request about your information:
Innobrains Technologies, Jhang Road, Opposite Madina Hotel, Athara Hazari, Jhang, Punjab 35180, Pakistan.
Email: info@innobrains.pk