Privacy Policy - eLupihaler

This Privacy Notice explains how Lupin Limited (“Lupin”, “we”, “us” or “our”) collects, uses, shares, stores and protects your personal data when you use the eLupihaler Application (“Application”). It is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

For the DPDP Act, Lupin may act as a Data Fiduciary and you are the Data Principal.

We have the following data touchpoints on our application through which we collect data for providing the application related services:

Through the Mobile application itself.

1. Personal Data We Collect

Depending on your use of the Application and the services enabled for you, we may collect the following categories of personal data:

Identity and contact details: name, mobile number, email address, date of birth/age, gender, patient ID/registration ID and OTP-based login or authentication details.
Personal Health Information: medication details, dosage frequency, medication schedule, height, weight, respiratory care information and other health-related information provided by you or generated through your use of the Application.
Device and inhalation usage information: eLupihaler device pairing details, inhaler usage details, date and time of inhaler use, inhalation duration, inhalation quality, flow-related information, medication adherence status, dose status, usage history and medication history.
Location and environmental information: current location, where enabled, and related environmental information such as air quality index, temperature and environmental alert information.
Consent, Usage and Security Information: Consent records, communication preferences, audit logs, access logs, application usage information, device identifiers, security records, and related information required to operate and secure the Application.
Other Information: Any additional information voluntarily submitted by you through the Application or generated during your use of the Application where necessary for the purposes described in this Notice.

2. Processing of Personal Health Information

The Application may collect and process Personal Health Information ("PHI") that you provide directly, upload through the Application, generate while using the services, or share through connected devices and health platforms.

PHI may include prescriptions, medication details, consultation records, medical reports, treatment information, appointment details, respiratory care information, therapy and wellness participation records, medical invoices, health measurements, connected-device data, and other healthcare-related information necessary to provide the Application's services.

We process PHI solely for purposes associated with:

respiratory care and digital therapy management;
prescription, medication and treatment management;
medication adherence and inhaler usage monitoring based on inhalation data capture and device-based health monitoring;
medication reminders, care communications and service notifications;
respiratory risk awareness and environmental alerts;
service analytics, quality improvement and operational reporting;
application security, fraud prevention and risk management; and
compliance with legal, regulatory and healthcare obligations.

PHI is protected through appropriate technical and organisational safeguards designed to protect against unauthorised access, disclosure, alteration or loss.

We may disclose PHI only to authorised healthcare professionals, affiliates, service providers, technology partners and other parties who require access to support the operation of the Application and who are subject to appropriate confidentiality, security and contractual obligations.

PHI is not sold, rented, brokered, licensed, used for behavioural advertising, used to create marketing profiles, or processed for purposes unrelated to the healthcare, patient support and Application services described in this Notice.

Where the Application requests access to device permissions, wearable devices, connected health devices, health platform integrations, camera access, storage access or other health-related data sources, such access will be requested only where reasonably necessary to provide the relevant functionality and, where required, based on your consent or device-level permissions.

3. Purposes for Which We Process Your Personal Data

We process your personal data only for lawful purposes connected with the eLupihaler Application and related healthcare or patient support services, including:

To register, verify, authenticate and manage account and patient profile;
To enable user onboarding, role selection, profile creation, OTP verification and first-time pairing of the eLupihaler device with the Application;
To provide respiratory care support, digital therapy management, patient engagement services, healthcare support services and application-enabled care support;
To provide guidance, awareness, training and support on the use of the eLupihaler device and related inhalation steps;
To manage prescriptions, medication schedules, dosage frequency, treatment information, medication reminders and related care instructions;
To monitor medication adherence, inhaler usage, missed, on-time and upcoming doses, medication history and connected-device generated usage data;
To capture, assess and display inhalation-related information, including date and time of inhaler use, inhalation duration, inhalation quality, flow-related information and other device-generated metrics;
To generate and display usage history, adherence reports, inhalation reports, graphs, qualitative grading, suggestions and other insights to support improved inhalation effectiveness;
To enable caregiver-related functionality, including caregiver requests, patient-caregiver mapping, access to medication records, adherence statistics and inhalation quality details, and caregiver disassociation where required;
To communicate service reminders, medication notifications, care plan updates, application alerts, program-related information and support communications;
To provide location-based environmental alerts, where enabled, including air quality, temperature, wind speed and related exacerbation-risk alerts;
To maintain consent records, access controls, audit logs, security monitoring and regulatory compliance records;
To retain, archive, delete or purge personal data and health data in accordance with applicable retention requirements, consent withdrawal, erasure requests and legal obligations;
To detect, investigate and prevent fraud, misuse, security incidents and other unlawful activities;
To improve care delivery, patient support services, operations and user experience; and
To comply with applicable legal, regulatory, contractual and healthcare-related obligations.

4. Legal Basis for Processing

Where processing is based on consent, we will seek your consent for specified purposes through a clear affirmative action. You may withdraw consent at any time through the Application or by contacting us. Withdrawal will not affect prior lawful processing but may impact services that require such data. We process your personal data on the following legal bases:

We process your data for legitimate purposes including but not limited to:

fulfil any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force; and
provide services and benefits requested through the Application and to safeguard the Application, its users, and the organization against fraud, misuse, security incidents, unauthorized disclosures, and other legal or operational risks.

5. Your Rights as a Data Principal

Subject to applicable law, you may exercise the following rights under the DPDP Act:

to request details and access of the personal data that Lupin processes about you (“right to access”);
to have your personal data corrected, for example, if it is incomplete or incorrect (“right to correction”);
to have your personal data erased or deleted (“right to erasure”);
where you have provided consent to the processing of your personal data, the right to withdraw your consent. (“right to withdraw consent”);
where you can nominate an individual to exercise the above-mentioned data subject rights in case of death or incapacity (“right to nominate”); and
under the DPDPA 2023, individuals have the right to grievance redressal, allowing them to file complaints with Data Fiduciaries and receive a response. If unresolved, they can escalate the matter to the Data Protection Board of India. (“right to grievance redressal”).

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice, comply with applicable laws, protect legal rights, and meet regulatory, professional, archival, or record-keeping requirements. Retention periods are determined in accordance with the Lupin Data Retention Policy, applicable data protection laws, and relevant IT logging requirements, including CERT-In guidelines. Upon expiry of the applicable retention period, personal data will be securely deleted.

Where consent is withdrawn, we will erase your personal data once the purpose for which it was collected is no longer required, unless retention is necessary to comply with legal, regulatory, accounting, reporting, archival, or other obligations under the Digital Personal Data Protection Act, 2023, or any other applicable law and legal claims.

7. Disclosure of Personal Data

We may share your personal data with the following categories of recipients:

Internal departments and authorised personnel involved in the administration, operation, support, compliance, security, patient support programs, healthcare services, and management of the Application.
Healthcare professionals, affiliates, service providers, technology vendors, support partners, and third-party service providers engaged to support the delivery of healthcare and patient support services, application hosting, maintenance, analytics, communications, customer support, security, and other operational functions related to the Application.
Legal, regulatory, governmental, judicial, or law enforcement authorities, where disclosure is required to comply with applicable laws, regulations, legal processes, healthcare obligations, or to protect the rights, safety, security, or interests of Lupin, its users, or other stakeholders.

We do not sell, rent, broker, license, use for advertising, create marketing profiles from, or process your health data for purposes unrelated to healthcare, patient support services or other lawful purposes described in this Notice.

8. Security Safeguards

We use reasonable technical and organisational safeguards to protect personal data from unauthorised access, disclosure, alteration, loss or misuse.

9. Cross-Border Processing

Your personal data may be stored or processed in India or other jurisdictions where Lupin, its affiliates, service providers or business partners operate. Cross-border processing will be carried out in accordance with the DPDP Act, applicable government notifications and other applicable laws.

10. Children's Personal Data

The Application is not intended to process children's personal data. If this changes, Lupin will take steps required under applicable law, including obtaining verifiable parental or guardian consent where required.

11. How to Exercise Your Rights or Raise a Grievance

To exercise your rights, withdraw consent, request correction or erasure, or raise a grievance, contact Lupin at dpo@lupin.com. Please provide sufficient details to help us verify and respond to your request.

If your grievance is not resolved through Lupin's grievance redressal mechanism, you may have the right to approach the Data Protection Board of India in accordance with the DPDP Act and applicable rules, once the relevant procedures are in force.

12. Availability of this Notice

This Notice may be made available in English and, where required, in any language specified in the Eighth Schedule to the Constitution of India, at the option of the Data Principal.

13. Updates to this Notice

We may update this Notice from time to time. The updated Notice will be made available through the Application or other appropriate channels. For more details, please refer to Lupin's Cookie Policy page or you may contact Lupin's Data Protection Office at dpo@lupin.com.

This Privacy Notice was last updated on 29th Oct 2026