Who We Are

Raspa Pharma Pvt. Ltd. is a company incorporated under the laws of India, with its registered office at 204, Second Floor, Shri Hari Tower, Mira Bai Marg, Lucknow – 226001, Uttar Pradesh, India. We are the data controller of your personal information and are responsible for protecting it and using it fairly, lawfully, and transparently in accordance with applicable data protection laws.

Personal Data We Collect

The personal data we collect depends on how you interact with our website. When you submit an enquiry, register on the website, or correspond with us, we may collect your name, designation, organisation, postal address, email address, and telephone number. Healthcare professionals and authorised distributors who register on our website may also be asked to provide their medical registration number, specialisation, and institution details, which may be verified against public professional directories.

If you report an adverse drug reaction or product complaint, or participate in any patient support programme, we may collect relevant health information necessary to fulfil our pharmacovigilance obligations under the Drugs and Cosmetics Act, 1940 and CDSCO guidelines. We also collect technical and usage data automatically when you visit our website — such as your IP address, browser type, pages visited, and device identifiers — through cookies and similar technologies. This website is not intended for persons under the age of 18 and we do not knowingly collect data from minors.

How We Use Your Personal Data

We use personal data only for the purposes for which it was collected. This includes responding to your enquiries and requests; verifying the credentials of healthcare professionals and distributors; fulfilling our pharmacovigilance and regulatory reporting obligations to the CDSCO and PvPI; operating and improving our website; sending you communications about our products or services where you have consented or where we have a legitimate interest in doing so; processing job applications; and complying with applicable legal obligations.

Legal Basis for Processing

We process your personal data on one or more of the following lawful grounds under the DPDP Act, 2023: your consent, where you have provided clear and informed agreement for a specific purpose; a legitimate use, where processing is necessary to fulfil a contractual obligation or respond to a medical emergency; a legal obligation, including pharmacovigilance reporting and regulatory compliance; or our legitimate business interests, such as securing the website and preventing fraud, provided these do not override your rights. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Sharing of Personal Data

We do not sell, rent, or trade your personal data. We may share it with members of the Raspa Pharma group; trusted third-party service providers who support our website and operations and are contractually bound to process data only on our instructions; regulatory and government authorities such as the CDSCO, PvPI, or the Data Protection Board of India where required by law; professional advisors subject to confidentiality obligations; and, in the event of a business transfer or restructuring, the relevant successor entity under equivalent data protection commitments. Any cross-border transfer of personal data will be carried out in accordance with Chapter V of the DPDP Act, 2023.

Cookies

Data Retention and Security

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law. Pharmacovigilance data is retained in line with CDSCO guidelines and Schedule Y of the Drugs and Cosmetics Rules, 1945. General enquiry data is held for a reasonable period for record-keeping purposes, after which it is securely deleted or anonymised.

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, disclosure, or loss, in line with the requirements of the IT (Reasonable Security Practices) Rules, 2011. In the event of a personal data breach likely to cause harm, we will notify the Data Protection Board of India within 72 hours as required under the DPDP Act, 2023 and DPDP Rules, 2025. While we take all reasonable precautions, no electronic transmission is entirely secure and we cannot guarantee absolute security.

Your Rights

Third-Party Websites and International Users

This website may contain links to third-party websites. This Privacy Policy applies solely to data collected through our own website and we are not responsible for the data practices of any linked site. If you are accessing our website from outside India, particularly from the European Economic Area, your data will be transferred to and processed in India.