Privacy Policy

1. Who we are and what this policy covers

Total Pharma Tech ("TPT", "we", "us") is a trading name used by a business based in Pakistan, and we operate the website at totalpharmatech.com and the platform application at app.totalpharmatech.com. We provide an AI-powered field force management platform to pharmaceutical, biotech, medical-device and life-science companies.

We have not yet incorporated a legal entity, so we are identified here by our trading name, the country we operate from, and the contact details in section 16. Where we sign an Order Form or other written agreement, the party named in that document is the contracting party, and is the controller for the purposes of that agreement.

This policy explains how we handle personal data when you:

• visit our website or read our pages;
• send us an enquiry, request a demo, or ask us to contact you;
• work for one of our customers, or for a company evaluating us, and we hold your business contact details or platform account details; or
• are an individual whose data appears in field data that a customer uploads to the platform — for example a healthcare professional, a clinic contact or a pharmacy contact.

It does not describe how our customers use personal data in their own systems, and it does not apply to third-party websites we link to. Marketing communications we send are covered here; the contractual terms on which we supply the platform are in our Terms of Service.

4. Lawful bases for processing

Where the EU or UK General Data Protection Regulation applies, and we are the controller, we rely on the following lawful bases.

1. Performance of a contract — providing the platform, creating and administering accounts, delivering support, onboarding and billing a customer organisation, and taking steps at your request before a contract is signed.
2. Legitimate interests — running and securing our website, responding to business enquiries, understanding which content is useful, preventing abuse and fraud, and protecting our legal rights. We weigh these interests against your rights and expectations, and you can object to processing on this basis at any time.
3. Consent — non-essential cookies, and marketing email to individuals where local law requires consent. Where we rely on consent, you can withdraw it at any time and we will stop that processing. Withdrawal does not affect processing carried out before it.
4. Legal obligation — keeping accounting, tax and contract records, and responding to lawful requests from courts, regulators or other authorities.

Where we process customer field data as a processor, we do not rely on a lawful basis of our own. The customer identifies the lawful basis for that processing and gives us documented instructions.

6. Cookies and analytics

A cookie is a small file a website stores in your browser. We use a small number of them and we keep the categories separate.

• Strictly necessary. Cookies that protect forms against cross-site request forgery, balance traffic and remember your cookie choice. These cannot be switched off without breaking the site.
• Analytics. Cookies that tell us which pages are visited and how visitors move through the site, in aggregate. These are set only if you accept them.

The cookies we set on this website

The table below lists every cookie this public website can set. It is kept accurate rather than approximate.

8. International transfers and safeguards

We are a global business and some of our suppliers operate data centres outside your country. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we put safeguards in place before the transfer happens:

• we rely on an adequacy decision of the relevant authority where one exists;
• otherwise we put in place the Standard Contractual Clauses, together with supplementary measures such as encryption in transit and at rest, access controls and data minimisation; and
• we assess the laws of the destination country and the practical risk to the data before relying on those clauses.

For customer field data, regional data residency options are available — European Union, United States and Asia-Pacific hosting are offered, and the region that applies to your tenant is recorded in your Order Form. Where residency is specified, the primary storage and processing of that tenant's data takes place in that region. You can ask us for the current hosting regions and transfer impact assessment for your configuration at hello@totalpharmatech.com.

10. How we protect personal data

The platform holds commercially sensitive data and personal data about healthcare professionals, so security controls are part of the product rather than an add-on.

• Encryption of data in transit using TLS, and encryption of data at rest.
• Role-based access control and least-privilege permissions, so staff and users see only what their role requires.
• Unique named accounts, support for single sign-on through SAML and OIDC, and configurable session and password policies.
• Audit logging of changes and access to customer data.
• Logical separation between customer tenants.
• Backups with tested restore procedures.
• Dependency and vulnerability review, and a documented process for applying security fixes.
• Confidentiality obligations for all personnel, and background checks where local law permits them.
• A documented incident response process. Where we act as a processor, we notify affected customers without undue delay after becoming aware of a personal data breach, with the information they need to meet their own notification duties.

We choose these measures to be reasonable and proportionate to the nature of the data and the risks involved. That is the standard data protection law asks of us, and it is the standard we hold ourselves to. We are an early-stage business and we describe our controls accurately rather than generously: we do not claim certifications we do not hold — ISO 27001 and SOC 2 are on our roadmap, and we will tell you the current status if you ask.

No system is perfectly secure, and we cannot promise that a security incident will never happen. What we commit to is applying the measures listed above, following the incident response process described in them, and giving affected customers what they need in order to meet their own obligations. Our security questionnaire responses and current control documentation are available to customers and to organisations in evaluation — write to hello@totalpharmatech.com.

12. Automated decision-making and AI features

Where AI features are enabled, they produce recommendations, prioritisation scores, suggested call plans and summaries that support decisions taken by people. They do not make decisions that produce legal or similarly significant effects on individuals on their own. A manager or representative can review, accept, override or reject each recommendation, and that action is logged.

AI features are modular. A customer can disable them per affiliate, per role or per country, and can choose which model provider is used. Customer commercial data is not used to train models that are shared with other customers. If you are an individual affected by a customer's use of AI features and want to understand how a recommendation about you was produced, contact that customer in the first instance.

14. Customer field data and our Data Processing Agreement

Data that a customer loads into the platform is handled separately from our own marketing and website data, and this section explains how.

• We process customer field data only on the documented instructions of that customer, including for transfers to another country, unless the law requires otherwise.
• We do not use customer field data for our own purposes, sell it, share it with other customers, or use it to contact healthcare professionals on our own behalf.
• Our personnel who can access customer data are bound by confidentiality obligations and are subject to access controls.
• We assist customers in responding to data subject requests, in meeting their security and breach notification duties, and in carrying out data protection impact assessments where required.
• At the end of the agreement we delete or return the data as the customer instructs, subject to any legal retention obligation.

These commitments are set out formally in our Data Processing Agreement, which forms part of the subscription agreement and covers the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, technical and organisational security measures, sub-processor rules and notice of changes, breach notification, audit rights, and deletion or return of data on termination.

A Data Processing Agreement is available for review and signature before any customer data is uploaded. Request it from hello@totalpharmatech.com or through your account manager.