Privacy Policy

Version 3 · Effective 22 October 2026

Who we are

Repha (রেফা) is a business-to-business app and website that connects licensed pharmacies in Bangladesh with medicine company representatives ("reps"). It is operated from Bangladesh by Shekh Ehsanur Rahman ("Repha", "we", "us"). Contact: support@ehsanur.com.

This policy covers the Repha app for Android and iPhone, the website at https://ehsanur.com/repha and the processing our administrators do to run the service. Repha is for pharmacy owners, pharmacy staff and reps. It is not for patients or the general public.

Information we collect

Account. Your name, email address, mobile number, role (pharmacy or rep), language and a password. We store the password only as a one-way hash; nobody at Repha can read it.

Pharmacy details. Shop name, address and area, drug licence details (such as the licence number and expiry date) and the location of the shop.

Rep details. Your company, designation, employee ID, work territory and, if you add it, your company email address.

Verification photos. Photos of your licence or company ID card, a photo of the shop front with the time and location it was taken, and a selfie with a short liveness check. We do not collect national ID (NID) numbers or NID images.

What you create in Repha. Connection requests, orders and order lists (including any photo of a list you attach), invoice photos, chat messages and photos, medicine prices you confirm or update, supply questions, reports, support requests and survey answers.

Device and technical data. Device model, operating system, app version, a device identifier (on Android, the Android ID that Android gives this app; on iPhone, an identifier the app keeps on the phone), a notification token, an app-integrity token (Firebase App Check), crash reports (Firebase Crashlytics), app usage events (Firebase Analytics) and, in our server logs, IP addresses. We use the device identifier only to recognise your phone in your device list, so a reinstalled app is not counted as a new device, and to prevent account misuse. It is not used for advertising.

Location. Only when you allow it: to record your shop's location during verification and to show nearby reps and pharmacies.

Camera and photos. Only when you take or choose a photo. When you scan a paper list to build an order, the text is read on your phone; the photo is uploaded only if you attach it to the order. Reading text from a photo can make mistakes, especially with handwriting and Bangla script, so you check every line before sending.

How we use it

• To create and secure your account, verify your email and keep you signed in.
• To check that pharmacies and reps are genuine, and to prevent fraud, fake accounts and misuse.
• To connect pharmacies and reps, and to deliver orders, chats, supply questions and notifications between them.
• To provide support, answer reports and enforce our Terms of Use.
• To keep the service working: fixing crashes, measuring which features are used, and protecting the service against abuse.
• To comply with the law and respond to lawful requests.

We do not use your orders, searches or chats to choose advertising, and we do not sell personal data.

What other users can see

Other verified users can see your profile: name, shop or company, area and verification badges. Your mobile number is shown only after you accept a connection. Verification photos are never shown to other users; only authorised Repha staff can view them, with a watermark, and every view is recorded.

When you confirm or update a medicine's price, every user sees the price, the date and whether a rep of the company or a pharmacy confirmed it. Your name is not shown.

Who we share information with

• The other party. When you connect, order, ask a supply question or chat, the pharmacy or rep on the other side sees what is needed for that.
• Service providers who process data for us under their own security terms: Namecheap (web hosting and email), Google Firebase (notifications, crash reports, usage analytics and app-integrity checks) and Google Drive (encrypted backups).
• Authorities, when the law requires it or to protect users from serious harm.

The app includes the Google AdMob software, but AdMob advertising is switched off. If we ever switch it on, we will update this policy first and ask for consent where required. Business advertisers on Repha receive no personal data.

Storage outside Bangladesh

Our hosting and Google's services may store data on servers outside Bangladesh, for example in the United States. Data travels only over encrypted connections, and the protections below apply wherever it is stored.

How we protect your information

• All connections use HTTPS.
• Verification photos are encrypted at rest (AES-256-GCM) with a key kept separate from the rest of the system.
• Staff access needs 2-step login, is limited by role, and is logged.
• Backups are encrypted.
• New passwords are checked against lists of leaked passwords using an anonymous range check: only the first five characters of the password's hash ever leave our server.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

How long we keep it

Your rights and choices

• See and correct your details in the app, or ask us to correct them.
• Get a copy of your data, or complain, by writing to support@ehsanur.com. We reply within 30 days.
• Withdraw permissions (location, camera, photos, notifications) at any time in your phone's settings. Some features will then stop working.
• Delete your account (below).

Deleting your account

Delete your account in the app (More → Delete account) or at https://ehsanur.com/repha/delete-account. You are signed out on every device straight away. You can change your mind for 30 days; after that your account is anonymised. Verification documents are kept for up to 1 year after deletion and then removed.

Feature details

Supply questions. When you ask about a medicine's availability, we store the medicine, quantity, required date and your note. Only your connected reps for that company can see it. Their replies and the history of changes are kept. A supply answer is not an order and does not guarantee stock.

Medicine prices. Verified reps of a medicine's company and verified pharmacies can confirm a price or enter the current one. We store the price, the date, your role and your account, so we can act on misuse. Other users see only the price, the date and "a rep of the company" or "a pharmacy".

Order notifications. To protect your privacy, lock-screen notifications never show medicine names or message text, only the order code, company name and status.

Voice-ordering survey. If you answer it, we store your answer, role, district and app version. No audio is recorded and the microphone is not used.

Business advertising. Repha shows ads only from approved businesses that do not sell medicine, on the Home screen. Ads are chosen only by your role, district and app language. To limit how often an ad appears, views, clicks and reports are linked to your account for up to 90 days, then the link is removed. Advertisers receive no personal data.

Invite pages. We count visits to invite links and QR-code pages. We do not store IP addresses or device details for this count.

Children

Repha is for adults working in the medicine trade. It is not meant for anyone under 18, and we do not knowingly collect children's data.

Changes to this policy

Each version of this policy is numbered and dated. If we make an important change, we tell you in the app and ask you to accept the new version before you continue.

Contact and complaints

Email support@ehsanur.com (grievance contact: Shekh Ehsanur Rahman). You can also reach support from the Support page on our website.