1. Scope and terminology
For processing covered by India’s DPDP framework, the individual to whom personal data relates may be referred to as the Data Principal, and the entity determining the purpose and means of processing may be referred to as the Data Fiduciary. Bayes Pharma generally acts as Data Fiduciary for our own website, account, security and business-contact processing.
Where a customer organization determines why Customer Content is processed and instructs Bayes Pharma to process it, the allocation of responsibilities follows the customer agreement, DPA and applicable law.
2. Notice, consent and withdrawal
Where consent is the applicable basis for processing, we aim to provide a clear notice describing the personal data and purpose of processing and to obtain consent through a clear affirmative action. Consent can be withdrawn using the same or comparably accessible channel where required, although withdrawal does not affect processing already lawfully completed.
For optional public-site analytics, Bayes Pharma provides a direct allow/reject choice. You can later change that choice on Privacy Choices.
3. Why we process personal data
We process personal data to provide and secure accounts and software, respond to inquiries and support, administer customer organizations, prevent misuse, maintain reliable operations, communicate about services and comply with legal obligations. Depending on the circumstances, processing may be based on consent or another ground permitted by applicable Indian law.
We do not use a consent mechanism to override legal, contractual or security obligations that require us to retain or process information independently of consent.
4. Data Principal rights
As and when the relevant statutory provisions apply, eligible Data Principals may have rights that include obtaining information about personal-data processing, correction and updating of personal data, erasure where legally available, grievance redressal, and nomination of another individual to exercise specified rights in the event of death or incapacity.
We may verify identity and request details reasonably necessary to locate the relevant data. Legal, security, fraud-prevention and retention exceptions may apply.
5. Data Principal duties
Where Indian law imposes duties on Data Principals, users should provide authentic information when exercising rights, avoid impersonation, avoid suppressing material information, and not submit frivolous or fraudulent grievances. These duties do not reduce any privacy right you otherwise have.
6. Security, retention and personal-data breaches
Bayes Pharma uses reasonable administrative, technical and organizational safeguards designed to protect personal data. We retain data only for the relevant purpose, contractual requirements, security and audit needs, and legal obligations.
Where a personal-data breach triggers notification duties under applicable Indian law, Bayes Pharma will follow the legally required process for notices to affected Data Principals and/or the Data Protection Board of India, as applicable to the relevant role and processing context.
7. Children and persons with lawful guardians
Our public Services are intended for adult professionals and organizations and are not directed to children. We do not knowingly solicit children’s personal data through our public marketing sites. A contracted customer use case involving children or persons represented by lawful guardians must be specifically assessed under the customer’s legal, ethical, clinical and privacy governance before use.
8. Processing and transfers outside India
Bayes Pharma serves customers across India, Europe and the United States, so personal data may be processed outside India where permitted. We will apply contractual, organizational and technical safeguards appropriate to the processing and comply with restrictions or conditions on cross-border transfers that become applicable under Indian law.
9. Grievance redressal
For a privacy grievance, email info@bayespharma.com with “India privacy grievance” in the subject line. Include enough information for us to identify the relevant account or interaction, but do not include sensitive health or scientific data in ordinary email.
Nagaram, Keesara, Medchal Malkajgiri, 500083, India
10. Phased commencement
India’s DPDP framework is being operationalized in phases. This notice is intentionally written to apply rights and duties as and when the relevant provisions are legally in force. Bayes Pharma will update this notice and operational processes as further provisions, regulatory directions and implementation requirements take effect.