One customer. One prescription. Many systems and people.
Follow one customer's information through enquiry and order intake, prescription receipt and verification, pharmacist review, billing, insurance, dispensing and labelling, delivery, refill reminders, complaints and long-term archives - and count every place it ends up, and where you lose control of it.
- 1
Enquiry, order request & intake channel control breaks
+2 places · 2 so farThe request arrives: a customer at the counter naming a medicine, a phone call, a photograph in a WhatsApp thread, an app order, a hospital discharge instruction or a call-centre ticket. Within minutes the same person exists in a billing system, on a staff member's own handset and in an order queue.
Where control breaks: The shop's order line is somebody's personal phone
Moving hereCustomer & patient identity (new at this stage)Family, caregiver & children (new at this stage)Prescription & prescriber details (new at this stage)Order, dispensing & substitution record (new at this stage)Calls, chats & support records (new at this stage)DPDPAThe medicine being asked for is the health information - you do not need a diagnosis to have collected one. Say what you collect and why at the point of intake, use a number that belongs to the business rather than to a person, and decide how long an enquiry that never became a sale is kept.
- 2
Prescription receipt, upload & extraction control breaks
+5 places · 7 so farThe prescription arrives - as paper across the counter, a photograph in a chat, an email attachment, an app upload passed through text extraction, or an electronic order from the hospital system - and is immediately copied into a folder, a queue, a register and somebody's downloads.
Where control breaks: One prescription photo ends up in five places, including the rejected ones
Moving herePrescription images & scanned copies (new at this stage)Customer & patient identityFamily, caregiver & childrenPrescription & prescriber detailsCalls, chats & support recordsDPDPAThis document names a person, their prescriber and often their condition, and it is the most copied object in the sector. Take it through one controlled channel, decide which copy is the master, and delete the working copies - including the ones from prescriptions you rejected.
- 3
Pharmacist review, substitution & validation control breaks
+1 place · 8 so farA pharmacist checks the prescription, resolves what is unclear, substitutes a brand, records a counselling note and either releases or refuses the order - creating a new health-related record that did not exist on the prescription.
Where control breaks: The notes the pharmacy writes are health data too, and everyone can read them
Moving hereHealth conditions worked out from the data· inferred (new at this stage)Allergies, complaints & adverse events (new at this stage)Staff, device & access records (new at this stage)Customer & patient identityPrescription & prescriber detailsPrescription images & scanned copies+1 moreDPDPAWhat the pharmacy writes down is personal data it created, not data it received, and a person can ask to see and correct it. Keep notes factual, keep the review to the people whose job it is, and do not let a refusal reason turn into a permanent label.
- 4
Customer record & medicine-history creation control breaks
+5 places · 13 so farThe sale is written to the billing or pharmacy-management system and a customer record comes into being: name, number, address, every medicine ever bought, who it was for, what is owed on the khata, and a refill date - a health history nobody set out to build.
Where control breaks: The billing record becomes a health history nobody meant to build
Moving hereMedicine purchase history (new at this stage)Payment, invoice & credit ledger (new at this stage)Refill, loyalty & marketing profile· inferred (new at this stage)Customer & patient identityFamily, caregiver & childrenHealth conditions worked out from the data· inferred+1 moreDPDPAA list of what somebody buys is a record of what is wrong with them, held for a purpose - billing - that ended when they paid. Decide how long each part is kept, separate the purchaser from the patient, and restrict who can read a medicine history.
- 5
Billing, payment, invoice & credit ledger
+3 places · 16 so farInvoices, UPI and card payments, cash-on-delivery records, payment screenshots, the credit ledger naming who still owes for which medicine, and the flow of all of it into accounting and tax systems and a fraud-scoring service.
Moving hereCustomer & patient identityFamily, caregiver & childrenOrder, dispensing & substitution recordPayment, invoice & credit ledgerCalls, chats & support recordsDPDPAAn itemised invoice discloses the condition to everyone who receives it, including a family member who paid. Never store card credentials, keep the finance retention clock separate from the customer record, and check who an invoice is actually being sent to.
- 6
Stock, dispensing, labelling & packing
+3 places · 19 so farThe medicine is picked - off a shelf, off a warehouse rack, out of central stock - checked against the prescription, batch-recorded, labelled with the patient's name and the molecule, and packed. The label is where the record and the product become the same object.
Moving hereCustomer & patient identityPrescription & prescriber detailsPrescription images & scanned copiesOrder, dispensing & substitution recordHealth conditions worked out from the data· inferredPayment, invoice & credit ledger+1 moreDPDPAEveryone who handles the package can read what it is for. Keep patient identity out of stock systems that do not need it, separate the pharmacist's view from the picker's, and treat what is printed on the outside of a package as a disclosure decision.
- 7
Handover, delivery & last mile control breaks
+4 places · 23 so farThe package leaves: handed over the counter, given to a delivery boy with an address written on it, or assigned to an aggregator's rider whose app shows the customer's name, number, address, order value and often the medicine itself. Somebody may collect it who was never meant to know.
Where control breaks: The package itself tells everyone what the medicine is for
Moving hereDelivery address, route & proof of delivery (new at this stage)Customer & patient identityFamily, caregiver & childrenOrder, dispensing & substitution recordHealth conditions worked out from the data· inferredPayment, invoice & credit ledgerDPDPAThis is the point where the pharmacy's control ends and the disclosure is physical. Use packaging that does not announce the contents, send each partner the minimum they need to deliver, verify who is collecting, and set a retention rule for delivery history and proof-of-delivery photographs.
- 8
Controlled & schedule-medicine registers
+2 places · 25 so farCertain medicines are entered into a separate register - paper, digital or both - naming the patient, the prescriber, the quantity, the pharmacist who dispensed it and the running balance, and kept where it can be produced on inspection.
Moving hereControlled & schedule-medicine records (new at this stage)Customer & patient identityPrescription & prescriber detailsOrder, dispensing & substitution recordDPDPAThese are REQUIRED RECORDS: they exist because other law says they must, and they are therefore not freely deletable. That makes it more important, not less, that access is restricted, that duplicate working copies are not made alongside them, and that the register is physically protected.
- 9
Refill reminders, loyalty & marketing control breaks
+3 places · 28 so farPurchase history becomes a refill date, a chronic-user segment, an adherence estimate and a campaign audience - sent as an SMS, a push notification, a WhatsApp message from the owner's own number, or uploaded to an advertising platform as a lookalike audience.
Where control breaks: The refill reminder announces the condition to whoever holds the phone
Moving hereCustomer & patient identityFamily, caregiver & childrenMedicine purchase historyHealth conditions worked out from the data· inferredCalls, chats & support recordsRefill, loyalty & marketing profile· inferredDPDPAA reminder that names a medicine discloses a condition to whoever is holding the phone. Keep a service reminder separate from a promotion, get a clear choice for each, hold one suppression list every channel must check, and never build advertising audiences out of health inferences.
- 10
Returns, complaints & adverse events control breaks
+2 places · 30 so farA wrong medicine, a reaction, a damaged strip or a refund request opens a file - photographs, batch numbers, a description of what happened to somebody's body, a pharmacist's escalation, and a message to the distributor or manufacturer.
Where control breaks: An adverse-event report is forwarded further than any other file
Moving hereCustomer & patient identityFamily, caregiver & childrenPrescription & prescriber detailsOrder, dispensing & substitution recordAllergies, complaints & adverse eventsPayment, invoice & credit ledger+2 moreDPDPAAn adverse-event record is the most sensitive thing in the file and the most widely forwarded. Collect the minimum needed to investigate, keep the notes factual, share only what the manufacturer or distributor actually needs, and set a retention period for the photographs.
- 11
Archive, staff devices, vendors & deletion control breaks
+2 places · 32 so farEverything settles: the billing archive, the prescription folder, chat threads, staff phones, paper registers, the khata ledger, accounting records, delivery history, the loyalty list, warehouse and vendor systems, backups - and a medicine history kept because it makes the next sale easier.
Where control breaks: Deleting a customer from the billing system does not delete them
Moving hereCustomer & patient identityFamily, caregiver & childrenPrescription & prescriber detailsPrescription images & scanned copiesOrder, dispensing & substitution recordMedicine purchase history+7 moreDPDPARetention has to be decided per category, not for the customer as a whole. A tax record and a required register have grounds to be kept; a prescription photograph from an order two years ago does not. Separate what you must keep from what you have merely never deleted.
Top risk hotspots - where control usually breaks
The 8 places customer data most often slips out of your control. Each links to the matching check in the readiness assessment.
- Hotspot 1 Critical risk
The medicine goes out with the molecule printed on the strip, the patient's name and the drug on the dispensing label, an itemised invoice taped to the outside, and the same detail visible in the delivery partner's app. It is handed over a counter to whoever came, left with a neighbour, taken by a relative, or signed for at an office reception.
Why this matters
This is the only business in this series where the product discloses the condition. Every other risk on this map is a record escaping; this one is the record and the product being the same object. A parcel left with the wrong person tells them what someone is being treated for - and nobody involved had to read a file, breach a system or leak a database to find out.
Fix: Use outer packaging that does not name or reveal the contents, keep the itemised invoice sealed inside rather than on the outside, give the delivery partner an order reference and a masked number instead of a medicine list, and check who is collecting before handing anything over.
Check this in the assessment - Hotspot 2 Critical risk
Every sale is written against a phone number, and over a few years that number accumulates a complete list of what a person has bought and how often. Nobody records a diagnosis. The purchase list states one anyway, and any member of staff can open it by searching the number to take the next payment.
Why this matters
It was collected to raise an invoice, and that purpose ended when the customer paid - but it is now the shop's most valuable asset, so it is never cleared. A refill every ninety days on one molecule is a chronic-illness inference the pharmacy never knowingly collected and cannot easily justify holding. In a neighbourhood shop, the person reading it usually knows the customer and their family.
Fix: Decide a retention period for purchase history separately from the tax record and run it on a clock, put full medicine history behind a pharmacist-level permission rather than the billing search everyone uses, and record the purchaser and the patient as different people instead of merging them onto one number.
Check this in the assessment - Hotspot 3 Critical risk
The prescription arrives as an image, and is immediately copied: into the upload store, into a folder on the shop computer, through a text-extraction service, onto the order, into a download so it can be attached to an email, and onto a printout for the file. The scanner keeps its own copy in a default folder nobody has opened.
Why this matters
It is the most copied object in the sector and it names the patient, the prescriber and often the condition in a single image. It exists in five places because it was never collected through one - and the copies of prescriptions that were REFUSED sit alongside the ones that were filled, kept for no purpose at all.
Fix: Take prescriptions through one upload route, keep one folder per order with named access, strip image metadata on the way in, and delete rejected uploads, scanner copies and downloads on a clock rather than leaving them beside the order.
Check this in the assessment - Hotspot 4 Critical risk
The number on the board, the listing and the delivery slip is a staff member's own handset. Orders, prescription photographs, payment screenshots, addresses and 'do you have this' questions arrive there, are answered there and stay there - backed up to a personal cloud account and visible to whoever picks the phone up.
Why this matters
It is the sector's default intake channel and the one place nobody manages. A single thread holds years of prescriptions and medicine requests for named neighbours, on a device the business does not own and an account it cannot see. When the staff member leaves, all of it walks out with them and there is no way to reach it.
Fix: Move order intake to a number and an account that belong to the business, direct prescription images to one upload route instead of chat, turn off automatic media backup on shop devices, and clear historic threads on a schedule.
Check this in the assessment - Hotspot 5 Critical risk
Purchase history becomes a refill date and a chronic-user segment, and out goes a message naming the medicine - as an SMS, a push notification, or a WhatsApp from the owner's own number. The same segments get uploaded to an advertising platform as audiences, and the campaign keeps running for people who stopped buying years ago.
Why this matters
A message naming a medicine discloses a condition to anyone reading that phone, which in a shared household is the whole point of the complaint that eventually gets made. Marketing permission is usually bundled into the sale, and a withdrawal recorded in the CRM does not reach the uploaded audience, the agency's spreadsheet or the broadcast list on somebody's own handset.
Fix: Ask separately for service reminders and for promotion, word reminders so they do not name the medicine, keep one suppression list that every channel and agency must check before sending, remove uploaded audiences when someone withdraws, and set an inactivity rule that closes dormant profiles.
Check this in the assessment - Hotspot 6 High risk
The review creates records that were never on the prescription: the clarification asked of the doctor, the brand substituted and why, the counselling note, and the reason an order was refused. They are written as free text in a hurry, and they sit on the order where the whole console can see them.
Why this matters
This is personal data the pharmacy created about somebody's health, not data it received - and a person can ask to see and correct it. A refusal reason entered once becomes a permanent label attached to that customer, read by everyone who opens the order afterwards, including staff whose job has nothing to do with dispensing.
Fix: Restrict review notes to the dispensing role rather than the shared console, keep them factual and separate observation from opinion, give each note an author and a date, and let a customer see and challenge what was recorded about them.
Check this in the assessment - Hotspot 7 Critical risk
Closed orders, old and rejected prescriptions, past customers, refill lists, complaint files and the people who stopped coming years ago all settle into the archive, the folders, the paper file, the backup and the ledger - and stay, because purchase history is what makes the next sale easier.
Why this matters
Most of the people in it have had no relationship with the pharmacy for years. This is where a deletion request quietly fails: removing the customer from the billing screen leaves the prescription folder, the chat thread, the delivery register, the export on the laptop and the backup entirely untouched. It is also where the honest answer is hardest, because some of what is here genuinely must be kept.
Fix: Set a retention period per category - enquiry, prescription image, order, medicine history, financial record, required register - and run it on a clock. Separate what you must keep from what you have merely never deleted, and write down the exceptions so you can explain them.
Check this in the assessment - Hotspot 8 High risk
A reaction or a wrong medicine opens a file: a description of what happened to somebody's body, photographs of the strip and sometimes of the person, the batch number, a pharmacist's escalation and a message to the distributor - which is usually the whole thread forwarded on, identity included.
Why this matters
It is the most detailed health information the pharmacy ever holds, and the one most likely to leave it. A distributor and a manufacturer end up with a named person's reaction on file, under their own rules, when a batch number and a factual account would have done. The photographs, meanwhile, stay on whichever phone took them.
Fix: Collect the minimum needed to investigate, keep the notes factual, send the supply chain the batch and the account rather than the customer's identity, remove photographs from personal devices once the file is closed, and set a retention period for the file itself.
Check this in the assessment
What happens when someone asks
The map above shows where customer data ends up. This is what that means the day someone asks you to find it, fix it or remove it - including the places a request realistically cannot reach.
Who asks: A customer who has started getting refill messages they never asked for, and wants to know how much you know
Where you have to look
- Customer master & medicine historyYour pharmacy
- Prescription images & upload storeYour pharmacy
- Billing, POS & pharmacy-management softwareYour pharmacy
- Staff phone & WhatsApp order threadsYour pharmacy
- Refill reminders, CRM & campaignsYour pharmacy
- Complaint, return & adverse-event fileYour pharmacy
- Accounting, invoicing & tax recordsYour pharmacy
- Archive, old records & closed ordersYour pharmacy
Where this usually cannot reach
- Former staff member's phone & exportsDoctors, distributors, delivery partners & insurers
- Cloud backup & database snapshotsSoftware, payment & platform vendors
- Distributor & manufacturerDoctors, distributors, delivery partners & insurers
- Doctor, clinic & hospitalDoctors, distributors, delivery partners & insurers
What has to happen
- Confirm who is asking, using the number the orders were placed on - and check whether that number belongs to the patient or to a relative who buys for them.
- Search on more than the name: the same person is usually in the billing system, the chat thread, the archive and the reminder list under slightly different spellings.
- Include the purchase history in full. It is the largest thing you hold about them, and it is the part they are usually asking about.
- Include what you created rather than collected - the review and substitution notes, the refill segment, the value band, any score.
- Include the prescription images, and say where each copy is: the order, the folder, the chat, the printout, the download.
- Name who it was shared with - the delivery partner, the platform the order came through, the insurer, the distributor a complaint went to.
- Say plainly which places you could not search, and why.
The part that usually fails: The chat thread. A year of orders, prescription photographs and 'do you have this' messages sits on a staff member's own phone, and there is no way to search it, export it or be sure you have found all of it. The honest answer either admits that or quietly pretends the channel does not exist.
Check whether you could answer this todayWhen it has already gone wrong
An operational response reference for the incidents this sector actually has - what to do in the first hour, what to put right afterwards, and the control that stops a repeat. Whether an incident needs to be reported is a decision to take with your own advisers.
How you find out: Someone calls to say the package they received has another person's name and medicines on the label - or the right customer calls to say theirs never arrived.
Systems involved
- The dispensed package, label & manifestYour pharmacy
- Billing, POS & pharmacy-management softwareYour pharmacy
- Proof of delivery & handover recordYour pharmacy
- Pharmacist review notes & decisionsYour pharmacy
- Complaint, return & adverse-event fileYour pharmacy
First - stop it spreading
- Find out where the package physically is now and get it back before anything else.
- Identify both customers - the one who received it and the one who should have - from the order and the delivery record.
- Establish what the person who opened it could see: the label, the invoice, the medicine itself.
- Check whether the same mix-up affected any other order in that batch or on that round.
- Have the pharmacist confirm what was actually dispensed to whom before anyone is told anything.
Then - correct it and record it
- Tell the customer whose medicine it was what happened, what was on the package and who saw it - promptly and without minimising it.
- Re-dispense correctly, and let the pharmacist decide anything clinical about the returned stock.
- Record it as an incident with the sequence of events, not just the outcome.
- Work out which step failed - a label, a name search, a handover - rather than treating it as one person's mistake.
- Take the decision on whether this needs to be reported anywhere with your own advisers; the map does not make that call for you.
The control that prevents a repeat: Check the name and the order reference at handover as a separate step from taking payment, and pack in outer packaging that does not disclose the contents - so that when this does happen, what the wrong person learns is much less.
How to read this journey
Pick your model
Switch between Independent retail pharmacy, Online / e-pharmacy and Pharmacy chain / hospital-linked to see the journey each kind of business actually runs. This is not a filter over one journey - a chemist has the customer in front of them and a prescription on paper or in a chat; an e-pharmacy never sees the customer and has already inferred something about their health from what they searched, before any order exists; a chain or hospital pharmacy joins a clinical encounter, a retail purchase, a loyalty card and an insurance claim into one central record. The stage count and the place-counter recalculate for the model you choose.
When it leaves you
A violet left edge and a tag mark everything outside your pharmacy - the marketplace or platform that took the order before you did, the text-extraction service that reads the prescription, the payment gateway, the delivery aggregator and the rider on it, the doctor and hospital whose details are on every prescription, the distributor a complaint is escalated to, the insurer or administrator settling a claim, an employer paying for an employee's medicines, and anything that becomes a public review. Once data is there your control is indirect at best. Risk is shown separately, as an amber or red fill - so an outside system can be low risk, and the phone in your own pocket can be one of the worst things on the page.
Where control breaks
Red flags mark the hotspots - the eight places pharmacies most often lose control of customer and prescription data, starting with the one that is unique to this trade: the package itself, which announces the medicine to whoever takes it. Tap any system to see what it holds and how to fix it.
Now check whether your controls hold up
The map shows where prescription and medicine data travels in a typical pharmacy. The 3-minute readiness scan checks whether your business has the controls that matter at each hotspot - and the Discovery tool builds your own data inventory.
Educational reference model - not legal advice, and not a scan of your actual systems.