You hand the prescription slip to the counter. The pharmacist keys something in. Tablets are counted, packed, and handed back in a white paper bag. The whole transaction takes ninety seconds. You leave.
What you don’t see is the entry that’s now in a database: your name, your address, the doctor’s name, the drug, the dosage, the date. That record doesn’t stay at the pharmacy. In an industry built on data, prescription records are a commercial asset, and they have been for decades.
Is your prescription history really for sale? In the US, yes. Pharmacies have long sold “de-identified” prescription records to health data companies like IMS Health (now IQVIA), which resell prescribing intelligence to drug makers. In India there are no confirmed public reports of pharmacy apps selling records to brokers. But their privacy policies permit broad data use beyond filling your order. “De-identified” is not “anonymous”: drug, dose, doctor, date, and area are enough to re-identify a person. For the wider picture, see who’s selling your medical data.
How a US company built a $3 billion business on your doctor visits
The model was established long before Indian online pharmacies existed.
IMS Health, now rebranded as IQVIA, built one of the largest health data businesses in the world. It bought prescription records from pharmacies across the United States, stripped out patient names, and sold the cleaned data to pharmaceutical companies. The pitch to drug makers was simple: know exactly which doctors prescribe which drugs, in what volumes, in which zip codes. Then send your sales reps to the right doors.
IQVIA’s health data business has grown to a multi-billion dollar operation. The prescription data arm was the foundation. Pharmacies were paid for records that, on paper, had been de-identified. The drug companies got granular, actionable intelligence. And patients — who had no idea this was happening — got nothing, including no choice.
The de-identification problem surfaced later. Researchers showed repeatedly that removing a name and phone number doesn’t make medical data anonymous. Consider someone in a particular neighborhood, of a certain age, filling a specific prescription for a rare oncology drug on a specific date. That combination is close to unique. Re-identification from “anonymized” prescription data is not theoretical. It has been demonstrated in peer-reviewed research. The US eventually moved to restrict this practice for certain drug categories, but the infrastructure of prescription data commerce was already built.
That infrastructure is now replicating itself in India.
What online pharmacies in India actually collect
When you upload a prescription to 1mg, PharmEasy, Netmeds, or Apollo Pharmacy, it feels like a convenience. It functions like a data disclosure.
These platforms capture: your name, your phone number, your delivery address, the prescribing doctor’s name, the medication, the dosage, and the date. For repeat prescriptions — chronic medications for blood pressure, diabetes, thyroid conditions — that means a longitudinal record of your health over years. Every refill is another data point. The platform knows your medication history better than most of your relatives do.
Tata 1mg was acquired by Tata Digital, part of one of India’s largest conglomerates. PharmEasy is backed by substantial venture capital, including from SoftBank. These are no longer small startups optimizing for user experience. They are companies with investors, revenue pressures, and corporate incentives to find value in the data they hold.
What their privacy policies actually say varies. Most permit use of data for “improving services,” “analytics,” and “marketing.” Those categories are broad enough to cover a great deal. This is not unique to pharmacy apps. Nearly every platform in India uses similar language. But the sensitivity of prescription data makes the vagueness particularly concerning.
To be precise about what we know and don’t know: there are no confirmed public reports of Indian pharmacy platforms selling prescription records to brokers. That is what IMS Health did in the US. What is documented here is different. These platforms’ privacy policies permit uses of health data that go well beyond filling your order. Companies are permitted to do a great deal under their own terms. What they have disclosed doing publicly is far narrower. That gap is exactly where privacy risk lives.
What pharmaceutical companies want with this data
Prescription data from Indian pharmacies could reach pharmaceutical companies through direct sale, data partnerships, or aggregated analytics products. If it did, the use cases are well understood from the US market.
Drug makers want to identify which doctors prescribe their drugs heavily, to reward them. They also want to know which prescribe competitors’ drugs, to target with sales effort. They want to find patient populations for clinical trial recruitment. They want to understand demand by geography to optimize distribution. In some markets, they use patient-level data to target branded drug advertising directly to consumers.
The neighborhood chemist is not immune to this either. Busy independent pharmacies increasingly use point-of-sale and inventory software — these systems digitize every prescription filled. The data may sit on a local server. Or it may sync to a cloud platform the pharmacist chose based on price, not privacy practices. The pharmacist who’s been serving your neighborhood for twenty years may genuinely have no idea what the software vendor’s data-sharing arrangements look like.
What DPDPA 2023 says — and what it doesn’t yet require
India’s Digital Personal Data Protection Act 2023 applies a unified personal data framework. Health data, including prescription records, is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act does require explicit, purpose-specific consent for personal data processing across the board. A blanket “by using this service, you agree to our data use” buried in terms of service is not supposed to meet that standard.
Whether current online pharmacy consent flows actually meet DPDPA’s requirements is an open question. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. But 2026 is a phased “soft enforcement” period, with the heaviest penalties for core obligations arriving by mid-2027. Companies know this. The practical consequence is that the full compliance pressure DPDPA’s data-minimization and consent requirements imply has not arrived yet.
Apollo Pharmacy, as part of the Apollo Hospitals group, is integrated with ABDM — the Ayushman Bharat Digital Mission — which includes a health consent framework. ABDM’s consent architecture is more explicit than a typical app’s privacy policy. It specifies which data is being shared, with whom, and for what purpose. It also gives users a mechanism to revoke consent. That’s meaningfully better than the alternatives. It doesn’t mean Apollo’s data practices are perfect, but the architecture at least acknowledges the sensitivity of what’s being collected.
The re-identification problem, again
It is worth saying plainly: “de-identified” prescription data is not safe.
The fields that make prescription data commercially valuable — drug name, dosage, prescribing doctor, date, geographic area — are the same fields that make it re-identifiable. Picture a person in a specific pin code, filling a prescription for a psychiatric medication, on a recurring monthly basis. That is not a nameless data point. They are a person who can be found.
This isn’t a hypothetical risk. It is a documented property of health data that researchers have established over two decades of privacy research. Any company that tells you your prescription data is “anonymized” and therefore safe to share freely is either mistaken or not being straight with you.
How to protect your prescription data
Review the privacy policy of any online pharmacy you use, specifically what it says about data sharing and analytics. Look for explicit statements about whether data is shared with pharmaceutical companies, insurers, or third-party analytics platforms.
For chronic medications, consider a local neighborhood pharmacist using only a basic billing system. That may serve your privacy interests better than a large platform, even if the platform is more convenient. Convenience and data exposure are often the same transaction.
Under DPDPA Section 13, you have the right to request deletion of your personal data from digital platforms, including prescription records. This right exists now, even before enforcement begins. Most platforms have not made this easy — but submitting a formal deletion request creates a paper trail.
If you use Apollo Pharmacy or any ABDM-linked platform, check your consent settings within the ABDM health locker. You can see what data has been shared and revoke ongoing consents.
Don’t upload prescriptions to platforms that don’t explain clearly what happens to that data. The absence of a clear explanation is itself information.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.