Privacy Policy

Hetero Healthcare Limited ("Company", "we", "our", or "us") is committed to protecting the privacy and confidentiality of all individuals ("Data Principals") who interact with the Nitof website ("website"). This Privacy Policy describes how we collect, use, store, share, and protect personal information in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This Policy applies to:

These Terms constitute a legally binding agreement between you and Hetero Healthcare Limited and are governed by the laws of India.

• All visitors to the Nitof website.
• Healthcare professionals accessing product information.
• Individuals who contact us through the website, forms, or email.
• Any person whose personal data is processed by Hetero Healthcare in connection with this website.

We may collect the following types of information:

Personal Identification Information.

• Full name, email address, phone number, and postal address.
• Professional credentials (for healthcare professionals) such as registration number and specialty.
• Date of birth and gender (where applicable for pharmacovigilance or medical queries).

Health & Medical Information.

• Information related to smoking history or cessation treatment voluntarily submitted.
• Adverse event or product complaint reports.
• Any health data shared voluntarily through contact forms or medical queries.

Technical & Usage Data.

• IP address, browser type, operating system, and device identifiers.
• Pages visited, time spent, click patterns, and referring URLs.
• Cookie identifiers and session data.

Note: Sensitive Personal Data (SPDI): Health information, including any data related to medical conditions or treatment, is treated as sensitive personal data under Rule 3 of the IT (SPDI) Rules, 2011, and handled with heightened protections.

We process your personal data under the following legal bases as defined under the DPDP Act, 2023:

• Consent: Where you have explicitly opted in or submitted data voluntarily through our website.
• Contractual Necessity: To respond to queries, provide requested information, or fulfill professional engagement requests.
• Legal Obligation: To comply with regulatory reporting duties under CDSCO, pharmacovigilance obligations, and applicable pharmaceutical marketing guidelines (UCPMP 2024).
• Legitimate Interests: For website analytics, fraud prevention, and improving website functionality, provided such interests do not override your fundamental rights.

Hetero Healthcare uses collected data for the following specified, explicit, and legitimate purposes:

• Responding to medical, product, or general inquiries submitted via the website.
• Sending product-related educational information (only with consent from healthcare professionals).
• Pharmacovigilance: Reporting adverse drug reactions or product quality complaints to regulatory authorities (CDSCO) as mandated by law.
• Improving website usability, content, and user experience through analytics.
• Ensuring legal and regulatory compliance, including record-keeping obligations.
• Internal training and quality assurance purposes with anonymized data.

We do not sell, trade, or rent your personal data to third parties. We may share data strictly as described below:

Regulatory Authorities

Adverse drug reactions, product quality complaints, and pharmacovigilance data may be reported to CDSCO, the National Pharmacovigilance Programme (NPP), and WHO-UMC as mandated under Schedule Y of the Drugs and Cosmetics Act, 1940.

Service Providers

• We may engage data processors (e.g., website hosting, analytics, email delivery) who process data strictly on our behalf under binding contractual obligations, including data processing agreements that require DPDP Act compliance.

Legal Disclosures

• We may disclose data where required by a court order, statutory authority, law enforcement, or government directive under applicable Indian law.

Business Transfers

• In the event of a merger, acquisition, or restructuring of Hetero Healthcare, personal data may be transferred subject to appropriate confidentiality and data protection safeguards.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• General website inquiries: 2 years from last interaction.
• Pharmacovigilance / adverse event records: Minimum 5 years (or as mandated by CDSCO guidelines).
• Healthcare professional records: Duration of engagement plus 3 years.
• Technical/log data: Up to 12 months.

Upon expiry of the retention period, data will be securely deleted or anonymized in accordance with best practices.

Hetero Healthcare implements reasonable technical and organizational security measures in line with the IT (SPDI) Rules, 2011 and DPDP Act, 2023, including:

• Encryption of data in transit (SSL/TLS) and at rest.
• Role-based access control limiting data access to authorized personnel only.
• Regular security assessments and vulnerability testing.
• Incident response procedures and data breach notification protocols.

In the event of a personal data breach that is likely to result in risk to your rights or freedoms, we will notify the Data Protection Board of India and, where required, affected individuals, as prescribed under the DPDP Act.

Under the DPDP Act, 2023 and applicable regulations, you have the following rights:

• Right to Access: Obtain a summary of your personal data being processed and information on processing activities
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of personal data where the purpose has been fulfilled and no legal obligation requires retention
• Right to Grievance Redressal: Have your grievances addressed in a timely manner
• Right to Nomination: Nominate another individual to exercise rights on your behalf in the event of incapacity or death
• Right to Withdraw Consent: Withdraw consent at any time (without affecting the lawfulness of prior processing)

To exercise any of these rights, please contact our Grievance Officer (details in Section 11).

The Nitof website may use cookies and similar technologies to enhance user experience. Categories of cookies used:

• Strictly Necessary Cookies: Essential for website functionality - cannot be disabled
• Performance & Analytics Cookies: Used to understand how visitors interact with the website (e.g., Google Analytics) - enabled only with consent.
• Functional Cookies: Remember your preferences and settings - enabled only with consent

You may manage cookie preferences through the cookie consent banner on first visit or via your browser settings. Withdrawing consent for non-essential cookies will not affect the website's core functionality.

Our website may contain links to third-party websites, including healthcare portals, regulatory bodies, or medical information platforms. Hetero Healthcare is not responsible for the privacy practices or content of such external websites. We encourage you to review the privacy policies of any third-party site you visit.

If you have any concerns, complaints, or requests related to this Privacy Policy or your personal data, please contact our designated Grievance Officer:

Grievance Officer - Data Privacy.

Hetero Healthcare Limited Address: Hetero Corporate,
Sy No. 83/1, Plot No.16/A/1 & 16/A/2, 19th & 20th Floor Hetero Tower,
Commerzone, Silpa Gram Craft Village,
Madhapur, Hyderabad, Shaikpet, Telangana, India – 500 081.
Email: sales@heterohealthcare.com
Phone: 1800 103 4696
Business Hours: Monday to Friday, 9:00 AM - 5:30 PM IST

We will acknowledge your grievance within 72 hours and aim to resolve it within 30 days of receipt. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India as established under the DPDP Act, 2023.

The Nitof website and products are intended for adults aged 18 years and above. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that data from a minor has been collected without verifiable parental consent, we will delete such data promptly.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or regulatory guidance. The "Last Updated" date at the top of this Policy will be revised accordingly. We encourage you to review this Policy periodically. Where changes are material, we will provide a prominent notice on the website.