Privacy policy

For storefront accounts, browsing, and digital support: FavSkin operates the website and related systems. For sale, dispensing, prescription verification, invoicing, and pharmacy records: Lucky Medicos is the seller and dispensing pharmacy. Both may process overlapping order data as needed to fulfil your purchase.

Questions about privacy can be raised through Contact.

Account data: name, email address, password (stored as a secure hash, never in plain text), optional mobile number, and saved delivery addresses.

Order data: products ordered, amounts, payment method, delivery details, order status, courier/AWB references, and customer support messages related to the order.

Payment data: payment references and status from Cashfree. We do not store full card numbers, CVV, or raw card magnetic / chip data on FavSkin servers. Card entry happens on Cashfree’s hosted or tokenised flows.

Health-related data: prescription images or PDFs, and notes from verification calls when you order prescription medicines or use Upload prescription. Treat this as sensitive personal data; we limit access to authorised staff.

Technical data: cookies or similar identifiers needed for cart and signed-in sessions, approximate device/browser information, and security logs (for example failed login attempts) to protect accounts and prevent abuse.

• Create and secure your account (including email verification).
• Fulfil, pack, invoice, and ship orders from Lucky Medicos.
• Verify prescriptions and comply with pharmacy and drug-control rules.
• Process payments and reconcile Cashfree webhooks.
• Provide customer support and resolve disputes.
• Prevent fraud, abuse, and unauthorised access.
• Meet legal, tax, and record-keeping obligations applicable to a pharmacy business in India.
• Improve site reliability and inventory accuracy (using aggregated or operational metrics where possible).

We do not use your prescription files for advertising. We do not sell or rent customer lists.

We process data because it is necessary to perform the contract (your order), to comply with law (pharmacy, tax, consumer, and IT-related obligations), and — where required — based on your consent (for example, uploading a prescription). You may withdraw consent for optional processing where consent is the basis, without affecting processing we must continue for legal retention of past orders.

We use essential cookies or cookie-like storage for cart identity and authenticated sessions. These are required for the shop to function. Session tokens for customers are random identifiers stored server-side; they are not a substitute for sharing passwords. Clearing cookies signs you out and may empty a guest cart.

We share information only with:

• Cashfree — to process UPI/card payments and confirm payment status.
• Courier partners — name, phone, and address needed to deliver the parcel.
• Service providers — hosting, email delivery, or infrastructure vendors bound to process data on our instructions.
• Regulators and law enforcement — when required by applicable law, court order, or to protect rights, safety, and fraud prevention.

We do not share prescription images with couriers or marketing partners.

Prescription files are stored privately and accessible only to authorised staff. Access to customer and health-related information is limited to people who need it to process your order or meet legal duties. We use industry-standard protections such as HTTPS in production, hashed passwords, and access controls; no method of transmission or storage is 100% secure.

Order, invoice, and prescription-related records are retained as long as pharmacy, tax, and consumer-protection rules require, then deleted or anonymised when no longer needed. Account profile data remains while your account is active and for a reasonable period afterward if needed for disputes or legal claims.

Subject to law, you may request access to or correction of your account details, ask questions about processing, or request deletion of data that is no longer required to be kept. Prescription and invoice records may need to be retained even if you close your account. Contact us via Contact with enough detail for us to verify your identity and locate your records.

FavSkin is intended for adults who can form a binding contract under Indian law. We do not knowingly create accounts for children. Parents or guardians ordering for a minor remain responsible for the accuracy of information and for holding any required prescription.

Our primary operations and fulfilment are in India. If you access the site from outside India, you understand that your information may be processed in India subject to Indian law and this policy.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on the site or by email where appropriate. Continued use after an update constitutes acceptance of the revised policy to the extent permitted by law.