Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Laborate Pharmaceuticals India Ltd. ("Laborate", "we", "our", or "us") collects, uses, shares, and protects personal information when you visit our corporate website at laborate.com, submit an enquiry, apply for a position with us, or otherwise interact with our digital presence and business communications.

We are committed to handling personal information responsibly and in accordance with applicable data protection legislation, including the Information Technology (Amendment) Act 2008, the Digital Personal Data Protection Act 2023 (DPDPA) of India, and, where applicable by virtue of the location of the data subject, the General Data Protection Regulation (GDPR) and other regional data protection frameworks.

Please read this Policy carefully before using our website or submitting information to us. Your use of our website indicates that you have read and understood this Policy.

Scope of This Policy

This Policy covers our corporate website only. We do not operate a patient portal, dispense medicines directly to consumers, or process patient health records through this website. All data interactions described here relate to corporate enquiries, business communications, career applications, and anonymised website analytics.

Data Controller

Laborate Pharmaceuticals India Ltd. is the data controller responsible for personal information collected through this website and business communications. As data controller, we determine the purposes and means by which your personal information is processed.

Laborate Pharmaceuticals India Ltd.

E-11, Industrial Area
Panipat – 132103
Haryana, India

CIN: U24230HR1985PLC020197

Email: legal@laborate.com
Phone: +91-180-3508200

Where Laborate engages third-party service providers to process personal information on our behalf, those parties act as data processors under written agreements that restrict their use of personal information to the purposes we specify.

Information We Collect

We collect personal information in the following circumstances. We collect only what is necessary for the purpose stated at the point of collection.

3.1 Contact and General Enquiry Forms

When you submit a contact request or general enquiry through our website, we collect:

Full name
Email address
Phone number (optional)
Company or organisation name (where provided)
Country of residence or operation
Enquiry subject, department routing selection, and message content

3.2 Career Applications

When you apply for a role through our Careers section, we collect:

Full name, email address, and phone number
CV or résumé and cover letter
Employment history and educational background
LinkedIn profile URL or portfolio links (where voluntarily provided)
Preferred location, notice period, and salary expectations (where voluntarily provided)

3.3 Business and Distributor Enquiries

When you submit a partnership, distribution, export, or OEM enquiry, we collect:

Company name, country, and region of operation
Business type (e.g. distributor, export trader, healthcare institution, OEM partner)
Product categories or therapeutic areas of interest
Estimated order volume (where voluntarily provided)
Contact person's name, email address, and phone number

3.4 Product Enquiries and Medical Information Requests

When you enquire about a specific product or request medical information about our portfolio, we collect:

Full name and professional designation (for healthcare professionals)
Country and region
Product name and therapeutic category
Nature of the clinical, regulatory, or commercial query

Medical information requests submitted through our website may be subject to pharmacovigilance obligations and will be handled by qualified medical affairs personnel.

3.5 Automatically Collected Information

When you visit our website, certain technical information is collected automatically by our hosting infrastructure and, where consent has been granted, by our analytics tools:

IP address (anonymised where technically practicable)
Browser type and version, operating system, and device type
Screen resolution and preferred browser language
Referring website URL and entry page
Pages visited, navigation path, time on page, and session duration
Interaction events such as clicks, scroll depth, and form engagement (analytics only, where consent is given)

Automatic collection does not include any form field content, personal identifiers, or information you have not explicitly provided.

3.6 Summary of Data Categories

Category	Typical Data Types	Source	Primary Purpose
Contact enquiries	Name, email, phone, company, country, message	Form submission	Responding to your enquiry
Career applications	CV, cover letter, work history, education, email, phone	Form upload	Recruitment assessment and communication
Business enquiries	Company, country, business type, product interests, contact details	Form submission	Commercial partnership evaluation
Medical / product enquiries	Name, profession, country, product, clinical query details	Form submission	Medical information provision; pharmacovigilance
Website analytics	Anonymised IP, browser, device, pages visited, events	Automatic collection	Website performance and improvement
Business correspondence	Email content, timestamps, attachments	Direct communication	Managing ongoing business communication

Legal Basis for Processing

We process personal information only when a lawful basis applies. The applicable basis depends on the nature and purpose of the processing activity. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms.

Legitimate Interest

Processing necessary for our legitimate business operations, where your interests and rights have been considered and do not override ours. We rely on this basis for responding to general enquiries, maintaining business correspondence, securing our website, and improving our services.

Contractual Necessity

Processing necessary to take steps at your request prior to entering into a contract, or to perform obligations under an existing agreement. Applies to commercial partnership negotiations, vendor agreements, and employment-related processing.

Consent

You have given clear, specific, and freely-given consent for a defined processing purpose. We rely on consent for optional analytics tracking (where legally required) and for retaining unsuccessful career applications beyond the standard period for future consideration.

Legal Obligation

Processing required to comply with a binding legal obligation. Applies to pharmacovigilance reporting, safety data retention under pharmaceutical regulations (including Schedule Y, ICH E2), employment record-keeping, and responses to lawful authority requests.

How We Use Your Information

We use the personal information we collect for specific, limited purposes. We do not use personal information for purposes incompatible with those stated at collection without your prior consent.

Responding to enquiries — To answer contact, product, or business questions submitted through our website forms and to route them to the appropriate department.
Recruitment — To process and evaluate career applications, communicate the outcome of recruitment activities, and, with your consent, to retain your details for future suitable opportunities.
Business development — To conduct initial assessment and due diligence for partnership, distribution, export, and OEM enquiries.
Medical information — To provide accurate product information, safety data, and regulatory documentation to healthcare professionals and authorised requestors, in compliance with applicable pharmaceutical regulations.
Pharmacovigilance — To fulfil our legal obligations to collect, assess, and report adverse event information to the Central Drugs Standard Control Organisation (CDSCO), the Pharmacovigilance Programme of India (PvPI), and other competent regulatory authorities as required.
Website improvement — To analyse aggregated, anonymised analytics data to understand how visitors use our website, identify content gaps, and improve usability and performance.
Security and fraud prevention — To detect, investigate, and prevent fraudulent activity, unauthorised access, and other security incidents affecting our digital infrastructure.
Legal compliance — To fulfil our obligations under applicable law and to respond to lawful requests from regulatory, judicial, or governmental authorities.

Not a Source of Medical Advice

This website does not provide medical advice, diagnoses, prescriptions, or patient care. All product and medical enquiries submitted through our website are addressed by qualified Laborate personnel for informational and regulatory purposes only. For personal medical concerns, please consult a licensed healthcare professional.

We do not use personal information for automated individual decision-making (including profiling) with legal or similarly significant effects, for behavioural advertising, or for direct marketing without your explicit consent.

We do not sell, rent, or trade personal information to third parties for their own commercial purposes. We may share information with third parties only in the limited circumstances described below.

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers to support our website operations and business functions. These providers are authorised to process personal information solely on our behalf and in accordance with our instructions. Categories of service providers include:

Website hosting, content delivery, and infrastructure providers
Email delivery and business communication platforms
Web analytics services (see Section 7 for details)
Applicant tracking systems and recruitment platforms (for career applications)
Professional advisory services, including legal, regulatory, and audit firms

All service providers are engaged under written data processing agreements that impose appropriate confidentiality, security, and data protection obligations.

6.2 Regulatory and Governmental Authorities

We may disclose personal information to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where required by applicable law or a binding legal order. This includes mandatory pharmacovigilance reporting obligations under:

The Drugs and Cosmetics Act 1940 and Rules thereunder (India)
CDSCO pharmacovigilance guidelines and Schedule Y requirements
International ICH E2 guidelines for Individual Case Safety Reports (ICSRs)
Requirements of regulatory authorities in countries where Laborate products are registered or distributed

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business assets, personal information held by us may be transferred to the acquiring or successor entity. We will ensure that any such transfer is subject to equivalent privacy protections and that affected individuals are notified where required by applicable law.

6.4 With Your Consent

We may share personal information with third parties in other circumstances where you have given your explicit prior consent for us to do so.

Cookies and Analytics

We use cookies and similar browser technologies to operate our website, remember your preferences, and (where you have given consent) to understand how visitors interact with our content. For comprehensive information about the types of cookies used, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

Google Analytics 4

We use Google Analytics 4 (GA4) to collect anonymised, aggregated information about how visitors use our website. GA4 helps us understand which pages are most visited, how users navigate the site, and where improvements can be made. Data collected by GA4 includes page views, session duration, navigation paths, and anonymised interaction events.

Key facts about our use of GA4:

IP addresses are anonymised before any data is transmitted to Google's servers
GA4 is activated only with your consent where required by applicable law; analytics cookies are not set until consent is granted through our cookie preferences
GA4 data is processed by Google LLC, which may involve international data transfers (see Section 9)
Default data retention in GA4 is set to 14 months

What Our Analytics Does Not Include

Collection of personally identifiable information (PII) via analytics events or custom dimensions
Cross-site tracking, advertising cookies, or remarketing pixels
Real-time identification of individual website visitors
Tracking of users across third-party websites
Sale or sharing of analytics data with Google for advertising purposes

Managing Your Cookie Preferences

You can review and update your cookie preferences at any time through our Cookie Preferences centre, accessible via the link in the website footer. Withdrawing analytics consent does not affect the lawfulness of processing carried out before your withdrawal.

Data Retention

We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulatory obligation. Our retention periods reflect the nature of the data and the processing purpose.

Data Category	Retention Period	Basis
Contact and general enquiries	3 years from date of last contact	Legitimate interest — potential follow-up and relationship management
Career applications — unsuccessful	12 months from close of recruitment cycle	Consent (where given for future consideration) / legitimate interest
Career applications — successful	Duration of employment + 7 years	Legal obligation — employment and labour law record-keeping
Business enquiries and partner records	5 years from date of last interaction	Legitimate interest — commercial continuity and due diligence
Medical information and product enquiries	15 years from date of submission	Legal obligation — pharmacovigilance and ICSR retention requirements (Schedule Y / ICH E2)
Website analytics data (GA4)	14 months (GA4 platform default)	Consent
Security and access logs	12 months	Legitimate interest — fraud and abuse prevention
General business correspondence	7 years from date of last correspondence	Legal obligation — general business record-keeping requirements

On expiry of the applicable retention period, personal information is securely deleted or permanently anonymised. Anonymised data, from which no individual can reasonably be identified, may be retained for longer periods for statistical and research purposes.

International Data Transfers

Laborate Pharmaceuticals operates across global markets and works with service providers located in multiple countries. As a result, personal information we collect may be transferred to, stored in, or processed in countries other than India, including countries in the European Economic Area (EEA), the United States, and other jurisdictions where our service providers are established.

These countries may have data protection laws that differ from those in India or in your country of residence. When we transfer personal information internationally, we take steps to ensure that appropriate safeguards are in place to protect your information. These safeguards may include:

Adequacy decisions recognised under applicable data protection law, where the destination country provides a comparable level of protection
Standard Contractual Clauses (SCCs) or equivalent contractual protections approved by relevant data protection authorities
Binding corporate rules or other approved transfer mechanisms where applicable

We do not transfer personal information to countries or recipients that cannot provide an adequate or equivalent level of protection without first putting in place appropriate contractual or technical safeguards.

For specific information about the international transfers carried out by our analytics provider, Google LLC, please refer to Google's Privacy Policy and the Google Ads Data Processing Terms.

Data Security

We implement appropriate technical and organisational security measures to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security practices include:

HTTPS encryption (TLS 1.2 or higher) for all data in transit between your browser and our servers
Encryption of personal data at rest on our hosting infrastructure
Role-based access controls that restrict access to personal information to authorised personnel on a strict need-to-know basis
Regular security assessments, vulnerability scanning, and penetration testing of our web infrastructure
Documented incident response procedures for managing potential data breaches, including regulatory notification obligations where required
Contractual security requirements imposed on all third-party processors engaged by us

No System Is Completely Secure

While we apply industry-standard safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of information transmitted over the internet. If you believe your personal information may have been compromised, please contact us immediately at legal@laborate.com.

Your Rights

Depending on your country of residence and the data protection legislation applicable to you, you may have the following rights in relation to personal information we hold about you. We will honour these rights in accordance with applicable law and within the timeframes required.

Exercising Your Rights

To submit a data rights request, please email legal@laborate.com with the subject line "Data Rights Request". We will acknowledge your request within 72 hours and provide a substantive response within 30 calendar days. We may ask you to verify your identity before processing your request.

Right	What It Means
Right to Access	Request a copy of the personal information we hold about you, along with information about how and why it is processed.
Right to Rectification	Request correction of inaccurate or incomplete personal information we hold about you.
Right to Erasure	Request deletion of your personal information where we have no legal basis or overriding legitimate reason to continue retaining it.
Right to Restrict Processing	Request that we limit how we use your information while a dispute, inaccuracy, or objection is being resolved.
Right to Data Portability	Receive personal information you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
Right to Object	Object to processing of your personal information based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent	Withdraw consent for any processing activity based on consent at any time, without affecting the lawfulness of prior processing carried out on that basis.
Right to Lodge a Complaint	Lodge a complaint with the relevant data protection supervisory authority in your country of residence if you believe your rights have been infringed. In India, the relevant authority is the Data Protection Board of India (DPBI).

Children's Privacy

Our corporate website is designed for and directed at business professionals, healthcare professionals, pharmaceutical industry stakeholders, and adult job seekers. We do not knowingly collect, use, or retain personal information from individuals under the age of 18.

If we become aware that personal information has been submitted by or on behalf of a minor under 18 years of age, we will take prompt steps to delete that information from our systems without undue delay.

If you believe we have inadvertently collected information from or about a child, please contact us immediately at legal@laborate.com so that we can investigate and take appropriate action.

External Websites

Our website may contain hyperlinks to third-party websites and digital resources, including regulatory agencies, industry associations, academic institutions, professional networks, and the official websites of our brand partners. These links are provided for informational convenience only.

We do not control, operate, or endorse external websites and are not responsible for their content, privacy practices, or data collection activities. This Privacy Policy applies solely to personal information collected through our own website (laborate.com) and our direct business communications.

We strongly encourage you to read the privacy policy and terms of use of any third-party website before submitting personal information or otherwise engaging with it.

Policy Updates

We review this Privacy Policy at least annually and may update it from time to time to reflect changes in our practices, technologies, services, or applicable legal requirements. When we make changes, we update the "Last Updated" date shown in the document metadata panel at the top of this page.

For material changes — those that significantly affect how we process your personal information or your rights — we will take additional steps to notify you, which may include:

Displaying a prominent notice on the homepage or relevant pages of our website for a reasonable period following the update
Sending an email notification where we hold your contact details and the change is likely to affect you directly
Requesting fresh consent where a change involves a new processing purpose that previously required or now requires consent

Check Back Periodically

We recommend reviewing this Privacy Policy periodically to stay informed about how we handle your personal information. The most current version is always published at laborate.com/legal/privacy-policy/.

Your continued use of our website following notification of a material change constitutes your acknowledgment of the updated Policy. If you do not agree with a material change, you should discontinue use of the website and contact us to request deletion of any personal information we hold about you.

Contact Our Privacy Team

If you have questions about this Privacy Policy, wish to exercise any of your data rights, have a concern about how your personal information has been handled, or would like to request access to the personal information we hold about you, please contact our Legal & Compliance team:

Legal & Compliance Team
Laborate Pharmaceuticals India Ltd.

E-11, Industrial Area
Panipat – 132103
Haryana, India

Email: legal@laborate.com
Phone: +91-180-3508200

Response time: We acknowledge all enquiries within 72 hours and aim to resolve them within 30 calendar days.

If you are located in the European Economic Area and believe your rights under the GDPR have been infringed, you also have the right to lodge a complaint with the data protection supervisory authority in your EU Member State of residence, without prejudice to your right to seek a judicial remedy.

If you are located in India and are not satisfied with our response, you may refer your complaint to the Data Protection Board of India (DPBI) once established under the Digital Personal Data Protection Act 2023.

Revision History

A record of material changes to this Privacy Policy is maintained below for transparency. The most recent version is always the current operative version.

Version 1.0 1 January 2026

Initial publication of the Laborate Pharmaceuticals Privacy Policy. Covers: website contact forms, career applications, business and distributor enquiries, product and medical information requests, website analytics (GA4), data retention schedule, international transfers, user rights, and pharmacovigilance obligations. Published concurrent with the launch of the new laborate.com corporate website.