Privacy Policy

Introduction

Zoulte ("Zoulte", "we", "our", or "us") operates the RouteX pharma field force management platform, accessible via our web application and mobile application (collectively, the "Service").

This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have in relation to your data. It applies to all users of the RouteX platform — including medical representatives (MRs), field managers, administrators, and company account holders.

By using RouteX, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the Service and contact us to close your account.

Data We Collect

We collect information in two ways: data you provide directly, and data generated automatically when you use the Service.

Data you provide

• Account information — company name, administrator name, email address, phone number, and billing details when you register a RouteX account.
• User profiles — name, designation, territory, reporting structure, and contact details for each MR, manager, or admin added to your account.
• Customer data — customer lists, visit frequency targets, doctor categorisation (Gold/Silver/Bronze), and contact details uploaded or entered by your team.
• Field activity data — visit logs, geo-tagged check-ins, DCR entries, order records, RCPA data, sample and gift records, and expense submissions entered by MRs.
• e-Detailing engagement data — slide views, time spent on each section, and feedback captured during doctor presentations.
• Tour programmes — planned and actual route data submitted by MRs and approved by managers.
• Support communications — messages, attachments, and metadata from any support tickets or email correspondence with Zoulte.

Data collected automatically

• Device information — device model, operating system version, app version, and unique device identifiers.
• Location data — GPS coordinates captured during field visits and active sessions for geo-verification and live team tracking by managers. Location is never collected in the background outside of an active session.
• Usage data — feature usage patterns, session duration, error logs, and performance data used to improve the platform.
• Log data — IP address, browser type, referring URL, and timestamps from web application sessions.

How We Use Your Data

We use the data we collect for the following purposes:

• Delivering the Service — processing visit logs, generating DCR reports, calculating DCA achievement, running tour programmes, and displaying manager dashboards.
• Account management — creating and managing user accounts, processing billing, and communicating with account administrators.
• Platform improvement — analysing usage patterns and error logs to fix bugs, improve performance, and develop new features.
• Customer support — responding to support requests and troubleshooting issues on your account.
• Security and compliance — detecting fraudulent activity, preventing unauthorised access, and meeting legal obligations.
• Communication — sending product updates, feature announcements, and policy changes to account administrators.

We do not use your field activity data, doctor master data, or RCPA records for any purpose outside of delivering the RouteX Service to your organisation. We do not use your data to train AI models or sell to data brokers.

Data Sharing

We do not sell your personal data or your company's field data to any third party.

We share data only in the following limited circumstances:

• Within your organisation — field activity data is visible to managers and administrators within your company account according to the access levels you configure.
• Service providers — we use trusted third-party providers for cloud hosting, email delivery, and payment processing. These providers process data only on our behalf and under strict data processing agreements.
• Legal requirements — we may disclose data if required to do so by a valid court order, government authority, or to protect the rights, property, or safety of Zoulte, our users, or the public.
• Business transfers — in the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify account administrators before any such transfer and before data becomes subject to a different privacy policy.

Data Storage & Security

All RouteX data is stored on encrypted servers hosted within USA. We implement the following security measures:

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for all data in transit
• Role-based access controls limiting data access to authorised personnel
• Regular security audits and vulnerability assessments
• Multi-factor authentication available for all account administrators
• Automated daily backups with point-in-time recovery

While we take industry-standard precautions to protect your data, no system is completely immune to security risks. If you suspect unauthorised access to your account, please contact us immediately at contact@zoulte.com.

Location Data

The RouteX mobile application collects location data from field representatives' devices. This section comprehensively describes what location data is collected, how it is collected, why it is used, and who can access it.

What location data we collect

• Precise GPS coordinates — latitude and longitude at the time of each field visit check-in, capturing the exact location where the visit was logged.
• Timestamp — the date and time the location was recorded, paired with each GPS coordinate.
• Live location during active sessions — real-time device location shared with the manager dashboard while the field representative has an active working session in the app.

How location data is collected

• Location is accessed through the device's GPS and network-based location services via the operating system's standard location permission (Android / iOS).
• The app requests foreground location permission — location is only read while the app is open and actively being used by the field representative.
• Location is never collected in the background when the app is closed or not in active use.
• The app will prompt the user for location permission before any location data is collected. Users can revoke this permission at any time through device settings.

Why we collect location data (purpose)

• Visit geo-verification — to confirm that field representatives are physically present at the reported customer location when logging a visit.
• Live team tracking — to allow managers to view the real-time location of their field team through the RouteX dashboard during active working hours.
• Route optimisation — to suggest and evaluate the most efficient daily routes for field representatives based on visit locations.
• Attendance and tour plan compliance — to verify that planned tour programmes are being executed as approved.
• Fraud prevention — to detect and flag ghost visits (visits logged from incorrect or stationary locations).

Who can access location data

• Field representatives — can see their own visit location history within the app.
• Managers and administrators — can view live location of their direct reportees during active sessions, and historical visit location data for their team.
• Zoulte support staff — access only when required to investigate a reported issue, under strict internal access controls.
• Location data is never shared with third parties for advertising, analytics resale, or any purpose outside of delivering the RouteX platform.

Data Retention

We retain your data for as long as your account is active and for a period after account closure as follows:

• Active accounts — all data is retained for the full duration of your subscription and made available for export at any time.
• After account closure — your data is retained for 90 days following account closure, during which it remains exportable. After 90 days, all data is permanently deleted from our systems.
• Billing records — invoices and payment records are retained for 7 years as required by Indian tax regulations.
• Support communications — retained for 24 months for quality and compliance purposes.

You may request early deletion of your data at any time by contacting us. Deletion requests are processed within 30 days, subject to any legal obligations to retain specific records.

Your Rights

As a RouteX user or account holder, you have the following rights in relation to your data:

• Access — you may request a copy of the personal data we hold about you at any time.
• Correction — you may request that we correct any inaccurate personal data we hold.
• Deletion — you may request deletion of your personal data, subject to legal retention obligations.
• Data portability — your company's field data — including doctor lists, visit records, DCR data, and RCPA records — is available for full export in standard formats (CSV, Excel) at any time from your account dashboard.
• Objection — you may object to specific uses of your data, including marketing communications.
• Withdrawal of consent — where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at contact@zoulte.com. We will respond to verified requests within 30 days.

Cookies & Tracking

The RouteX web application uses cookies and similar tracking technologies for the following purposes:

• Essential cookies — required to maintain your login session and keep the application functional. These cannot be disabled.
• Analytics cookies — used to understand how users navigate the web application so we can improve usability. You may opt out via your browser settings.
• Preference cookies — used to remember your settings, such as theme or table configurations.

We do not use cookies for advertising or cross-site tracking. We do not share cookie data with advertising networks.

The RouteX mobile application does not use browser cookies. It uses device storage (local and secure storage) to maintain sessions and cache field data for offline use.

Children's Privacy

RouteX is a professional B2B platform intended for use by adults employed by pharmaceutical companies. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided us with personal data, please contact us immediately and we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the platform, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all account administrators at least 14 days before the changes take effect
• Display an in-app notice for all active users

Your continued use of RouteX after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree to material changes, you may close your account before the changes take effect.

Contact Us

For any questions about this Privacy Policy, data requests, or privacy concerns, please reach out to us: