Privacy Policy
White Bench · whitebench.co and the White Bench applications
Effective date: November 1, 2026 · Last updated: August 4, 2026 · Version 1.0
This Privacy Policy describes how Fresh Box Media Private Limited, operating the White Bench platform (“White Bench”, “we”, “us”, “our”), collects, uses, shares and protects personal data. It is published in compliance with the Digital Personal Data Protection Act 2023 (“DPDP Act”), the Digital Personal Data Protection Rules 2025 (“DPDP Rules”), the Information Technology Act 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Note on entity: if the White Bench business is transferred to a separate legal entity, this Policy will be updated to name that entity as the data fiduciary and users will be notified of the change.
1. Who we are
For the purposes of the DPDP Act, the data fiduciary is Fresh Box Media Private Limited, having its registered office at Louis Wadi, Thane West, Maharashtra 400604. The data fiduciary determines the purpose and means of processing personal data on the White Bench platform, which includes the website at whitebench.co, the White Bench web and mobile applications and related services (together, the “Platform”).
2. Who this Policy covers
| User | Meaning in this Policy |
|---|---|
| Doctors | Registered medical practitioners who create a profile, hold a Certificate Wallet, attend or watch events or undertake engagements on the Platform. |
| Company users | Individuals acting on behalf of pharmaceutical and healthcare companies subscribed to the Platform. |
| Association users | Individuals acting on behalf of medical associations and similar bodies using the Platform. |
| Visitors | Anyone who browses the public pages of the Platform without an account. |
Each of the above is a “data principal” under the DPDP Act in respect of their own personal data. The Platform is intended only for persons aged 18 years and above. We do not knowingly process the personal data of children, and no feature of the Platform is directed at children.
3. Personal data we collect, and why
We follow the principle of data minimisation. We collect only the data each purpose genuinely requires, and we state that purpose at the point of collection. We do not collect patient data, prescription data or clinical records of any kind.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identity and verification data | Name, medical registration number, verification status against the National Medical Register, OTP verified mobile number, corporate identity details of companies and associations | To verify that every person and organisation on the Platform is who they claim to be | Consent, and legitimate use for the function you have requested |
| Professional profile data | Specialty, qualifications, city, years of experience, verified certificates, CME attendance and credit ledger, engagement history | To match doctors with relevant scientific work and events, and to maintain the verified professional record the doctor builds on the Platform | Consent |
| Contact data | Email address, mobile number, WhatsApp notification preference | To operate your account, send service communications and, where you opt in, event reminders and invitation alerts | Consent; notification preferences can be switched off at any time |
| Financial and tax data | Bank account details, PAN, honorarium amounts, TDS records, invoices | To settle honorariums through a regulated payment channel, deduct tax correctly under Sections 194J and 194R of the Income Tax Act and issue TDS certificates | Consent, legitimate use and legal obligation |
| Engagement and compliance records | Scopes of work, acceptances, declinations, completion records, audit logs, attendance verification records | To create the documented, audit ready record that Indian law, including UCPMP 2024, requires of engagements between companies and doctors | Legitimate use and legal obligation |
| Technical and usage data | Device information, IP address, log data, pages visited, cookies as described in Section 10 | To secure the Platform, prevent fraud and abuse, and understand how the Platform is used so we can improve it | Legitimate use for security; consent for any non-essential cookies |
| Communications | Messages sent through the Platform, support requests, grievance correspondence | To respond to you, resolve grievances and keep a record of what was agreed | Consent and legitimate use |
4. How we collect personal data
Directly from you, when you register, verify your identity, complete your profile, accept an engagement, add a certificate, register for an event or write to us. Automatically, through the technical and usage data described above when you use the Platform. From verified organisations, when a company or association registers a certificate that you then claim, or invites you to an engagement or event. From public registers, limited to confirming your registration status against the National Medical Register with your participation through OTP verification.
5. Consent, and how to withdraw it
Where processing rests on consent, we ask for it through a clear, specific and informed notice at the point of collection, in the manner the DPDP Act and DPDP Rules require. Notices are available in English and, on request, in the languages listed in the Eighth Schedule to the Constitution of India as the DPDP Act provides.
You may withdraw consent at any time from your Profile and Privacy settings or by writing to the Grievance Officer. Withdrawal is as easy as giving consent. On withdrawal we stop the processing that rested on that consent, though processing already done remains lawful, and records we must keep under law are retained as described in Section 9. You may also give, manage and withdraw consent through a registered Consent Manager once such services are available to you under the DPDP Rules.
6. How personal data is shared
We do not sell or rent personal data. We do not share it for advertising. Personal data is shared only in the limited ways below, and only to the extent each purpose requires.
| Recipient | What is shared and why |
|---|---|
| Companies and associations on the Platform | A doctor’s professional profile, verified credential count and engagement responses are visible to verified organisations only through the Platform’s engagement and event workflows. Contact details are never shared. Organisations reach doctors only through a formal request on the Platform. |
| RBI authorised payment partner | The details required to settle honorariums, deduct tax and complete regulatory checks, including bank account, PAN and payment amounts. The partner is a regulated entity with its own legal obligations, including KYC and record keeping under law. |
| Service providers (data processors) | Hosting, communications, analytics and support vendors who process data only on our documented instructions, under contracts that bind them to this Policy’s standards. The current list of sub processors is available at [● link] and material changes are notified. |
| Auditors and professional advisers | Where necessary for audit, accounting, legal advice or insurance, under duties of confidentiality. |
| Regulators and law enforcement | Where disclosure is required by law, by a court or by a competent authority, including the Data Protection Board of India, tax authorities and the Ethics Committee for Pharmaceutical Marketing Practices. We disclose only what the lawful request covers. |
| Credential verification requesters | A doctor’s individual certificates are shared with a hospital, insurer or recruiter only when the doctor generates a share link, and every link can be revoked by the doctor. This service operates on the doctor’s consent alone. |
| In a business transfer | If the White Bench business is reorganised, financed or transferred, personal data may pass to the successor entity under the same protections, with notice to users. |
7. Where data is stored, and cross border transfers
Personal data is stored on servers located in India. If any processing ever requires a transfer outside India, it will be made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, under contracts that hold the recipient to the standards of this Policy, and this section will be updated to say so.
8. How we protect personal data
We apply reasonable security safeguards as required by Section 8 of the DPDP Act and the security requirements of the DPDP Rules, including encryption of data in transit and at rest, masking of financial identifiers, role based access on a least privilege basis, maker checker controls on critical actions, append only audit logs, network and application security testing, and contractual security obligations on every processor. No system is perfectly secure, which is why Section 12 describes exactly what happens if something goes wrong.
9. How long we keep personal data
We keep personal data only as long as the purpose it was collected for continues, or as long as the law requires, whichever is longer. Indicative periods are below. Where retention beyond your relationship with us is required by law, records are retained in a form no longer linked to your active profile wherever the law permits.
| Data | Retention period | Reason |
|---|---|---|
| Account and profile data | For the life of the account, then erased within [● 30] days of erasure request or account closure, subject to the rows below | Service operation |
| Engagement and compliance records | At least 8 years from the end of the relevant financial year | Income Tax Act and Companies Act record keeping requirements, and UCPMP audit readiness |
| Financial, tax and settlement records | At least 8 years from the end of the relevant financial year | Income Tax Act requirements; the payment partner retains its own records under applicable RBI and PMLA rules |
| Verified certificates and CME ledger | For the life of the doctor’s account, as the durable record the doctor builds; exported or erased on the doctor’s request, subject to statutory retention of underlying engagement records | The core service to doctors |
| Technical logs | [● 12] months, unless needed longer for a specific security investigation | Security and fraud prevention |
| Grievance correspondence | 3 years from closure of the grievance | Accountability under the DPDP Rules and IT Rules |
10. Cookies
The Platform uses strictly necessary cookies to keep you signed in and keep the Platform secure. Any analytics or preference cookies beyond these are used only with your consent, which you can manage from the cookie banner and withdraw at any time. We do not use advertising cookies. A full cookie list is maintained at [● link].
11. Your rights
As a data principal under the DPDP Act you have the rights below. They can be exercised free of charge from your Profile and Privacy settings or by writing to the Grievance Officer, and we will respond within the timelines the DPDP Rules prescribe.
| Right | What it means |
|---|---|
| Access | A summary of the personal data we hold about you, the processing activities and the identities of those it has been shared with. |
| Correction and updating | Correction of inaccurate data and updating of incomplete data. Doctors can also request corrections to verified identity fields, which we re verify before changing. |
| Erasure | Erasure of personal data that is no longer necessary, subject to retention the law requires as set out in Section 9. |
| Data export | A copy of your data, including your certificates and CME ledger, in a usable electronic form from your settings. |
| Grievance redressal | A working grievance mechanism as set out in Section 13. |
| Nomination | You may nominate a person to exercise your rights in the event of death or incapacity, from your settings or in writing to the Grievance Officer. |
The DPDP Act also places duties on data principals, including the duty not to impersonate another person, not to suppress material information when providing data for documents and identity proof, and not to register false or frivolous grievances.
12. If a data breach occurs
If a personal data breach occurs, we will notify the Data Protection Board of India and each affected data principal in the manner and within the timelines the DPDP Rules prescribe, describing what happened, the likely consequences and the steps taken. We maintain an incident response plan and test it.
13. Grievance Officer and escalation
| Item | Detail |
|---|---|
| Grievance Officer | [● Name and designation] |
| [● grievance@whitebench.co] | |
| Address | [● Registered office address] |
| Acknowledgement | Within 24 hours of receipt |
| Resolution | Within 15 days of receipt, and in any event within the timelines prescribed under the DPDP Rules |
If you are not satisfied with the resolution of a grievance concerning your personal data, you may approach the Data Protection Board of India in the manner provided under the DPDP Act after first exhausting this grievance mechanism.
14. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified to registered users by email or through the Platform before they take effect, and the effective date at the top of this Policy will be revised. Earlier versions are available on request. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of it, without affecting your right to withdraw consent at any time.
15. Contact
Questions about this Policy or about how your personal data is handled can be sent to the Grievance Officer at the details in Section 13, or to privacy@whitebench.co.