Privacy policy

1. Who is responsible

G.D. Pharmaceuticals Limited, Tripureshwor, Kathmandu, Nepal, is the controller of personal information collected through this website. Contact details for privacy requests are at the end of this policy.

2. What we collect

Inquiries: your name, organisation, email, phone and message when you contact us or apply for a job.

Side-effect reports: health information about a suspected adverse reaction, the medicine and batch, and the reporter's contact details. This is sensitive (special category) data.

Technical data: a keyed, irreversible hash of your IP address with each form submission, used to prevent abuse. Our servers keep standard access logs for security.

Analytics (only with your consent): pages visited and how they are used, through PostHog. Form inputs are masked.

3. Why we use it (legal bases)

To answer your inquiry or application: your consent, given on the form, and steps you ask us to take before a contract.

To assess side-effect reports and report them to the Department of Drug Administration: our legal pharmacovigilance obligations and the public interest in public health, together with your explicit consent.

To keep the website secure: our legitimate interest in preventing abuse.

Analytics: your consent, which you can withdraw at any time from "Cookie settings" in the footer.

4. Cookies and similar storage

Essential storage remembers your light/dark display choice and whether you have seen an announcement. Analytics cookies are set only if you choose "Allow analytics". If your browser sends a Global Privacy Control signal, we treat it as an opt-out and never load analytics.

5. Sharing and selling

We do not sell or share personal information for cross-context behavioural advertising. We disclose it only to the Department of Drug Administration and other regulators when the law requires, and to service providers who process it on our behalf under contract: our hosting and storage provider (Amazon Web Services), our email provider (OneSignal) and, with your consent, our analytics provider (PostHog). Some of these providers may process data outside Nepal under appropriate safeguards.

6. How long we keep it

General inquiries and job applications are deleted automatically 24 months after submission. Side-effect reports are kept for as long as pharmacovigilance law requires. Consent records are kept for as long as the data they relate to.

7. How we protect it

The site is served only over HTTPS. Names, contact details and messages are encrypted in our database (AES-256-GCM). Access to the admin console requires an individual account; every sign-in and change is recorded in an audit log.

8. Your rights

You can ask to see the personal information we hold about you, receive a copy in a portable format, correct it, delete it, or object to or restrict how we use it, and withdraw consent at any time. California residents can also ask what we collected and why, and will not be treated differently for using these rights. We answer within 30 days and may need to confirm your identity first. Side-effect reports we are legally required to keep may not be deletable. You can also complain to a data protection authority.

9. Children

This website is not directed at children under 16. A parent or carer may report a side effect on a child's behalf.

10. Contact

To use your rights or ask about this policy, email gdgroup@mos.com.np with the subject "Privacy request", or write to G.D. Pharmaceuticals Limited, Tripureshwor, Kathmandu, Nepal.