Last updated: 2 September 2026

Privacy Policy

GMB Agent mobile application & Griomed Healthcare Pvt. Ltd. web portal

This Privacy Policy explains how Griomed Healthcare Pvt. Ltd. (“we”, “us”, “the Company”) collects, uses, stores, shares and deletes personal information when you use the GMB Agent Android application (package com.griomed.gmb_agent) and the associated Griomed Healthcare Business web portal (together, the “Services”).

The GMB Agent app is a business tool for authorised agents and franchise partners of Griomed Healthcare Pvt. Ltd.. It is not intended for the general public, and it is not intended for anyone under 18 years of age.

  1. Information we collect
  2. Device permissions
  3. How we use information
  4. Health & prescription data
  5. Sharing and disclosure
  6. How long we keep data
  7. Security
  8. Your rights
  9. Account & data deletion
  10. Children
  11. Changes to this policy
  12. Contact us

1. Information we collect

We collect only the information needed to operate the agent network, fulfil orders and pay commissions. We do not sell personal data, and we do not use it for advertising.

CategoryWhat we collectWhy we need it
Account & identity Name, email address, phone number, password (stored only as a one-way hash), referral / sponsor code, agent rank and status. To create and authenticate your agent account and place you correctly in the network structure.
KYC documents Aadhaar number, PAN, address proof and photographs uploaded by you or on your behalf. Statutory identity verification, required before commission payouts and TDS deduction.
Financial information Bank account number, IFSC code, UPI ID, wallet balance, commission entries and withdrawal requests. To calculate and disburse your earnings and to maintain payout records.
Customer details you enter Customer name, phone number and delivery address that you record while creating an order or a medicine request. To fulfil and deliver that order. You enter this on behalf of your customer.
Prescriptions & medicine details Photographs of prescriptions, medicine names and request notes captured with the camera or picked from your gallery. So our pharmacy team can verify and fulfil a medicine request. See section 4.
Precise location GPS coordinates captured only at the moment you create an order, and only if you grant permission. To record where a field order was booked, for delivery accuracy and fraud prevention.
Business records Orders, sales, commission ledger entries, audit logs, and the server URL you configure at sign-in. To operate the business, resolve disputes and meet accounting obligations.

The app contains no advertising SDK, no analytics SDK and no third-party tracker. It communicates only with the Griomed Healthcare Pvt. Ltd. server that you or your administrator configure at sign-in.

2. Device permissions and why they are needed

  • Location (precise / approximate) — used only while you are actively creating an order, to attach the booking location to that order. The app does not track location in the background and collects no location while it is closed.
  • Camera — to photograph a prescription for a medicine request. The photo is used only for that request.
  • Photos / media — to attach an existing prescription image from your gallery, and to save your visiting card or income card image to your device gallery.
  • Internet — to communicate with the Griomed Healthcare Pvt. Ltd. server.

Every permission is optional and is requested at the point of use. If you decline one, the related feature is unavailable but the rest of the app keeps working. You can withdraw any permission at any time from Android Settings → Apps → GMB Agent → Permissions.

3. How we use your information

  • To create, authenticate and secure your agent account.
  • To record product sales, franchise sales and medicine requests, and to fulfil and deliver orders.
  • To calculate business volume, slabs, ranks and commissions, and to process withdrawal requests.
  • To complete KYC verification and to deduct and deposit TDS as required by Indian law.
  • To communicate with you about orders, payouts, KYC status and service updates.
  • To detect and prevent fraud, misuse and violations of our plan and safety policies.
  • To comply with legal, tax, accounting and drug-distribution obligations.

We do not use your personal data for behavioural advertising, and we do not make automated decisions with legal effect without human review.

4. Health and prescription data

Prescription photographs and the medicine names recorded in a request are treated as sensitive personal data. Specifically:

  • They are used solely to verify and fulfil that particular medicine request.
  • They are visible only to authorised Griomed Healthcare Pvt. Ltd. pharmacy and administration staff, and to the licensed pharmacy fulfilling the order.
  • They are never sold, never shared with advertisers, insurers or data brokers, and never used for marketing.
  • They are transmitted over an encrypted connection and stored on access-controlled servers.

As an agent, you must obtain the customer’s consent before uploading their prescription, and you must not upload prescriptions or customer details for any purpose other than fulfilling that customer’s order.

5. Sharing and disclosure

We do not sell or rent personal information. We share it only in these situations:

  • Within Griomed Healthcare Pvt. Ltd. — with authorised administrators and pharmacy staff who need it to process orders, KYC and payouts.
  • Fulfilment partners — licensed pharmacies, franchise partners and delivery providers receive only what is needed to dispense and deliver a specific order.
  • Payment and banking partners — bank and UPI details are shared with our banking partner solely to transfer your payout.
  • Your sponsor and upline — agents above you can see limited business information about your team (name, rank, joining date and business volume). They cannot see your KYC documents, your bank details, your customers’ contact details, or any prescription image.
  • Legal and regulatory — where required by law, court order, a tax authority or a drug regulator, or to protect our legal rights.
  • Hosting — our servers and backups are operated by our hosting provider under contract. Data is stored in India.

6. How long we keep your data

  • Account, order, commission and payout records — retained for at least 8 years after your account closes, as Indian tax and accounting law requires.
  • KYC documents — retained for the statutory period applicable to verified financial records, then deleted.
  • Prescription images — retained only as long as needed to fulfil and support the request and to meet pharmacy record-keeping rules, then deleted.
  • Order location coordinates — retained with the order record for the life of that record.

Anything we are not legally required to retain is deleted when you request deletion — see section 9.

7. Security

  • All traffic between the app and our server uses HTTPS/TLS encryption.
  • Passwords are stored only as salted one-way hashes and are never readable by us.
  • Access to KYC, bank and prescription data is restricted to authorised staff, and administrative actions are recorded in an audit log.
  • API access uses expiring tokens, and login and signup endpoints are rate-limited against brute-force attempts.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

8. Your rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may:

  • Access a copy of the personal data we hold about you.
  • Correct data that is inaccurate or out of date.
  • Withdraw consent for optional processing, and revoke device permissions at any time.
  • Request deletion of your account and data — see section 9.
  • Complain to us, and then to the Data Protection Board of India if you are not satisfied with our response.

Write to us using the details in section 12. We respond within 30 days.

9. Account and data deletion

To delete your GMB Agent account and the personal data associated with it:

  1. Email support@griomedglobal.co.in from your registered email address, with the subject “Account deletion request”.
  2. Include your registered name and your agent / referral code so that we can verify you.
  3. We verify the request and delete your account within 30 days.

What is deleted: your login credentials, profile, contact details, KYC documents, bank and UPI details, uploaded photographs and prescription images, and stored location coordinates.

What is retained, and why: order, sales, commission, TDS and payout records are kept in a restricted archive for the statutory period (at least 8 years), because Indian tax, accounting and drug-distribution law requires it. These records are used for compliance only and for nothing else. Any pending wallet balance is settled before deletion.

10. Children

The Services are intended only for persons aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have collected data from a person under 18, we delete it.

11. Changes to this policy

We may update this policy as the Services change or as the law changes. The revised version is posted on this page with a new “last updated” date, and material changes are also notified inside the app or by email. Continued use of the Services after a change means you accept the updated policy.

12. Contact us

For any privacy question, data request or grievance, contact our Grievance Officer:

Important: GMB is a product-based direct selling programme. All income is earned only on actual product and franchise sales (business volume) — no income is paid for joining or recruiting. Earnings depend on individual effort; no income is guaranteed. Payouts are subject to KYC, TDS and the safety policies described in the plan.