Picture a pharmacy that keeps a WhatsApp group with its regular customers. Every month, the staff broadcast a refill reminder listing medicine names, dosages, and the customer's first name. It feels like good service. Under the Digital Personal Data Protection Act 2023 (DPDPA 2023), it is processing of personal data that needs a lawful basis — in practice, the customer's consent — and the Act's Schedule sets penalties that run into crores of rupees.
Many pharmacy owners have never thought about DPDPA 2023 in the context of their daily billing workflow. They know GST. They know Schedule H registers. But patient data? That's something hospitals worry about, right? Wrong. The DPDPA pharmacy obligation applies to anyone who "processes" digital personal data in India — and every time your billing software saves a customer's name, phone number, and prescription item together, you are processing personal data under the Act.
If you keep running your pharmacy the way you ran it in 2022, you are accumulating a liability that no amount of good customer relationships will neutralize. Here is what that liability looks like in practice.
Your WhatsApp Billing Workflow Is a Compliance Violation Waiting to Be Enforced
Walk into many neighbourhood pharmacies and you will find the same workflow: a customer calls, asks for their "usual medicines," the counter staff pulls up the last bill on the screen or checks a notebook, reads the items back, and sends the invoice photo on WhatsApp. Fast, friendly, and a DPDPA problem if nobody asked for consent.
Under DPDPA 2023, a customer's name together with their medicines is personal data, and sending it over a channel they never consented to is processing without a lawful basis. The Act requires a lawful basis for processing — and "we always did it this way" is not one. The penalties in the Act's Schedule are maximums, set by the Data Protection Board case by case: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹50 crore for breaches the Schedule does not list separately.
The more immediate risk is not a regulator walking in tomorrow. It is that one customer complaint to the Board — perhaps after a dispute, perhaps from a competitor — triggers a notice that requires you to produce:
- A record of what personal data you hold
- The consent basis under which you collected it
- Proof that you notified customers of their rights
If your records live in a desktop billing file, a notebook and a staff member's phone, producing these three documents is hard. That is not a technology gap — it is a legal exposure.
Your Schedule H/H1 Register Probably Has a Data Retention Problem Too
Rule 65(3)(h) of the Drugs and Cosmetics Rules requires pharmacies to record every Schedule H1 supply in a separate register kept for three years, giving the prescriber's name and address, the patient's name, and the drug and quantity. This is a legal mandate, and selling a Schedule H1 drug without a prescription is punishable under Section 27(d) of the Drugs and Cosmetics Act, 1940, with imprisonment of one to two years and a fine of not less than ₹20,000.
Here is the intersection point that is easy to miss: the same register that D&C Rules require you to keep for three years is also a dataset of personal health information governed by DPDPA 2023. You cannot delete it early (D&C compliance), but you must also limit who accesses it, secure it against breach, and be able to respond to a data subject request within a defined period (DPDPA compliance). These two obligations are not in conflict — but they require a system that can satisfy both simultaneously.
A paper register can satisfy the D&C Rules. But the moment its contents are digitised — photographed, typed into software, forwarded on WhatsApp — DPDPA 2023 applies to that copy, and a phone photo has no record of who opened it and no protection if the phone is lost.
Customer Data Scattered Across Three Systems Means You Cannot Respond to a Legal Notice
Picture a pharmacist whose setup looks like this: billing on one desktop software, customer phone numbers in a separate Excel file for the loyalty program, and prescription images saved in a WhatsApp folder on the owner's personal phone. Three data stores, zero unified consent record, no data map.
When DPDPA enforcement becomes active, a Data Subject Access Request (DSAR) requires you to tell a customer exactly what data you hold about them and where. If that data is across three systems — one of which is a personal WhatsApp account — you have a problem that no lawyer can fix quickly. You simply do not know what you have.
The cost here is not just a fine. It is the operational time required to respond. Responding to a single regulatory data inquiry with unstructured records can consume days of staff time — pulling bills, reconciling registers, and reconstructing a data map by hand. For a pharmacy running on thin margins, that lost time at any reasonable opportunity cost is a meaningful rupee figure — before legal fees.
What Compliant Patient Data Management Actually Looks Like Day-to-Day
The after-state is not complicated. It is boring in exactly the right way.
Before: Customer data lives in four places. Consent was never collected. The Schedule H1 register is a physical book locked in a drawer. Staff share prescription photos on personal phones.
After (what to ask of any system): Every bill created in the pharmacy system captures a standardized consent acknowledgment at point of sale. Schedule H1 sales are recorded from billing data, timestamped, and kept in a system where access is restricted to the pharmacy's own staff. Prescription images are attached to the bill record inside the pharmacy system — not on anyone's phone. When a customer asks "what data do you have about me," the answer comes from one place, not four.
The data map exists. The consent record exists. The retention timeline is enforced by the software, not by a person remembering to shred a notebook. A D&C inspector and a DPDPA inquiry can both be answered from the same system, the same afternoon. That is what compliance looks like when the tooling is built for it.
How Nesayo Handles This
Picture the common pattern with a paper register: it runs two weeks behind, with counter staff batch-filling it on Sunday evenings from memory and billing receipts. On Nesayo, a Schedule H1 sale is logged at the moment of billing: the date, medicine, batch, quantity and bill number, with the patient and prescriber names entered on the bill. No Sunday catch-up session. Nesayo does not record the prescriber's address yet, so the pharmacist adds it to complete the Rule 65(3)(h) register.
The DPDPA pharmacy angle: because Nesayo's billing database is the single record of truth for customer data, there is no Excel sidecar file, no WhatsApp folder problem. Counter staff do not need to type patient details into a separate system — the bill and the H1 log entry are one action. The Payment Advisor AI agent (part of the Full plan, priced at ₹549 per month as of October 2026; see current pricing at nesayo.com/pricing) works on your distributor payables and does not send customer data to any outside channel. Billing is free forever — that is not a trial, it is the base product (per nesayo.com/pricing, as of October 2026). Paid plans start at ₹249 per month (Essential plan, as of October 2026) and add voice billing, prescription scanning and the AI agents, but the Schedule H/H1 flag and the H1 sales log are in the free billing layer. Nesayo does not yet record a consent acknowledgment on each bill, attach prescription photos to the bill, or delete records on a retention schedule, so keep your privacy notice and retention policy yourself.
The Morning Briefing agent puts a summary in front of the owner each morning, including stock that Expiry Guard has sorted into 30, 60 and 90-day expiry groups. By the time the shutter opens, the owner already knows what needs attention. That is a fundamentally different posture than discovering a three-month-old register gap during an inspection.
The Choice in Front of You Is Straightforward
Pharmacies that do nothing will not face a regulator tomorrow. Enforcement of DPDPA 2023 is ramping up, not instant. But every month of inaction is another month of WhatsApp prescription sharing, another month of paper registers with no audit trail, another month of customer data living in places you cannot account for. When the notice arrives — from a customer complaint, a competitor tip-off, or a routine inspection — the time to build a compliant system is not that afternoon. The pharmacies that respond to a DPDPA inquiry quickly are the ones that built the system before they needed it.
Spend 20 minutes at nesayo.com/demo — a sample pharmacy is pre-loaded, no signup required. Bill a Schedule H1 medicine, look at the expiry queue, and see how customer, bill and stock records sit in one system. The demo does not require your business data. It will show you the gap between where you are and where the regulation requires you to be.
---
FAQ
Won't migrating my existing billing data take weeks and risk losing years of records?
No. Nesayo imports your item master and opening stock from a CSV or Excel export, which most desktop billing software can produce, and the Nesayo team moves it across for you, free (file and photo imports run during your free first month of Full, or on a paid plan). Your existing data does not disappear. We do not delete the source files — we ask you to keep them, including your existing Schedule H1 register, for the 3-year D&C retention period.
What if my internet goes down during billing hours?
Nesayo runs as a Progressive Web App (PWA) with an offline billing fallback. Bills created during an outage are queued on the device and sync automatically when connectivity returns; keep the billing page open until the internet is back. For pharmacies in areas with inconsistent connectivity, that fallback keeps the counter moving.
Can I actually trust AI to handle something as sensitive as patient data compliance?
The AI agents in Nesayo — Morning Briefing, Expiry Guard, Refill Radar, Stock Sense, Payment Advisor — operate on your billing and inventory data inside the platform. They surface alerts and propose actions for your approval; they never change stock, invoices or payments on their own. The Schedule H1 sales log is written by ordinary billing logic at the moment of sale, not by AI inference. What Nesayo stores, and for how long, is set out at nesayo.com/privacy. The AI layer adds operational intelligence on top of your records, not instead of them.