Privacy Policy
Bangladesh Drug Directory — drugs.pharmacyos.work
Effective date: 1 June 2026 · Operated by Roktobindu Foundation
Our privacy principles
- No account required to browse. We never sell or share your data for advertising.
- We collect the minimum information needed to operate the service securely.
- Standard server logs are retained for up to 30 days, then purged automatically.
- We do not use behavioral tracking cookies or third-party analytics scripts.
1. Data controller
The Bangladesh Drug Directory is operated by Roktobindu Foundation, a registered non-governmental organisation in Bangladesh (registration pending). Roktobindu Foundation is the data controller under the Bangladesh Personal Data Protection Act 2023 (PDP Act 2023) for all personal data collected through this website.
For data protection enquiries, contact us at privacy@roktobindufoundation.com.
2. What data we collect and why
Standard HTTP server logs
Every web request generates a log entry containing your IP address, user-agent string, the URL requested, HTTP status code, and timestamp. This is a universal property of the HTTP protocol and cannot be disabled. These logs are used solely for security monitoring, abuse detection, rate-limiting, and debugging. They are retained for a maximum of 30 days, then deleted automatically. IP addresses in logs are not linked to user accounts because this site has no accounts.
Cloudflare Turnstile (bot challenge)
Certain interactive features (the drug search API, where-to-buy lookups) require solving a Cloudflare Turnstile challenge to prove you are human. Turnstile processes your IP address and browser signals on Cloudflare's servers. It does not use tracking cookies or fingerprint you across sites. Cloudflare's own Privacy Policy governs that processing. We receive only a pass/fail signal; no raw challenge data is forwarded to or stored by our servers.
Search queries (anonymised)
When you search the drug directory, your query text is transmitted to our servers to return results. Search terms may be logged as part of standard server logs (see above) and are used only to improve search quality. Search queries are not linked to you personally and are purged with the 30-day log rotation.
Cookies and local storage
We set one functional cookie: a Turnstile session token, valid for the browsing session only. We set one localStorage entry to remember your preferred language (English / Bengali) and colour scheme (light / dark). Neither is used for tracking, advertising, or cross-site identification. No third-party tracking or analytics scripts are loaded.
3. Legal basis and purpose
Under the PDP Act 2023, we process personal data on the basis of legitimate interests: providing a secure, abuse-free public health information service. The processing is limited to what is strictly necessary for that purpose. We do not process personal data for advertising, profiling, or sale to third parties — ever.
- Security and abuse prevention — rate-limiting, blocking automated scrapers, detecting and blocking denial-of-service attacks.
- Service operation — routing requests, returning search results, serving cached pages.
- Debugging — diagnosing errors and outages using server logs.
4. Data sharing
We share data with the following sub-processors only:
| Processor | Purpose | Location |
|---|---|---|
| Cloudflare | CDN, DDoS protection, Turnstile, Workers (server-side logic) | Global (GDPR-compliant) |
| Cloudflare D1 / R2 | Drug catalog database storage, image storage | Global (encrypted at rest) |
We do not share data with advertisers, data brokers, analytics platforms, or government authorities, except where legally compelled and after exhausting legal challenges.
5. Your rights under PDP Act 2023
Under the Bangladesh Personal Data Protection Act 2023, you have the right to:
- Access — request a copy of any personal data we hold about you.
- Correction — request correction of inaccurate data.
- Erasure — request deletion of your data (subject to legal retention obligations). Note: because we do not store accounts, erasure of server logs is impractical to target per-user but logs are purged automatically within 30 days.
- Objection — object to processing based on legitimate interests.
- Portability — receive your data in a structured, machine-readable format where technically feasible.
To exercise any of these rights, email privacy@roktobindufoundation.com. We will respond within 30 days. There is no fee for a reasonable request.
6. Security
All traffic to this site is encrypted in transit (TLS 1.2 / 1.3). The drug catalog database is encrypted at rest. Access to production systems is restricted by cryptographic credentials. This site is protected under Cloudflare Project Galileo, which provides enterprise-grade DDoS protection at no cost to the Foundation.
In the event of a personal data breach, we will notify affected individuals and the relevant authority within 72 hours of becoming aware, in accordance with PDP Act 2023 requirements.
7. Minors
This site is a general public health reference and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has submitted personal data to us, contact privacy@roktobindufoundation.com and we will delete it promptly.
8. Changes to this policy
We will update this page and change the effective date when this policy is revised. Material changes will be announced in the About page for at least 30 days before taking effect. Continued use of the site after a change becomes effective constitutes acceptance.
Data protection contact
Roktobindu Foundation · privacy@roktobindufoundation.com
We respond to all data requests within 30 days.
This Privacy Policy is provided in English. In the event of any conflict with a translation, the English version prevails. Governing law: Bangladesh.
This page constitutes a legal document. If you have questions, please contact us before using the site.