Ordering medicines through an app may resemble e-commerce, but the legal character of the transaction is different. Medicines are regulated products, and their online sale remains anchored to the licensing, dispensing and quality controls governing a pharmacy.[1] Section 18(c) of the Drugs and Cosmetics Act, 1940 prohibits the sale, stocking, exhibition, offer for sale or distribution of a drug except under, and in accordance with, the prescribed licence. The Drugs Rules, 1945 connect retail supply to licensed premises, prescription controls, record-keeping and, where applicable, supervision by a registered pharmacist.[2]
For this article, an “Online Pharmacy” means a business that offers, arranges or facilitates the sale and doorstep delivery of medicines through a digital interface. A “Platform” means the website, application or digital marketplace through which that transaction is initiated or managed. These terms may overlap, but they are not legally identical.
Accordingly, the regulatory analysis must look beyond the digital interface and examine how the business actually operates. A Platform that merely enables discovery may face a different compliance position from one that controls inventory, reviews prescriptions, determines pricing, coordinates dispensing or manages delivery. Its legal exposure will therefore depend not only on how it describes itself, but also on the degree of control it exercises over the medicine transaction.
Classifying the Digital Health Business
A digital health business cannot be classified merely by the appearance of its Platform. The relevant question is what role it performs in the transaction. An inventory-led Online Pharmacy procures or holds medicines and supplies them to consumers. A marketplace model enables independent pharmacies to list and supply products, while a technology facilitator may limit its role to discovery, order transmission or payment support. In practice, many businesses combine these functions by selecting sellers, reviewing prescriptions, determining discounts, coordinating fulfilment and handling complaints.
This distinction is significant. The Consumer Protection (E-Commerce) Rules, 2020 separately recognise marketplace and inventory e-commerce entities and impose role-specific obligations.[3] A Platform’s contractual description will therefore carry limited weight where its operations demonstrate greater control over the sale.
Classification must also occur at the product and service level. Medicines remain subject to the drug-control framework, while medical devices and in-vitro diagnostics are regulated under the Medical Devices Rules, 2017.[4] Health supplements and nutraceuticals fall within the food-safety regime,[5] and cosmetics, diagnostic bookings and healthcare-discovery services may engage separate requirements. A composite Platform may consequently operate across several regulatory categories within the same interface. Before assessing licensing or liability, the business must first identify what it sells, who supplies it and how deeply it participates in fulfilment.
The Current ‘Regulatory’ Baseline
1. Existing Law/ Digital Channel
India does not presently have a separate, final licensing code exclusively for Online Pharmacies. This does not leave the sector unregulated. The existing drug-control framework continues to govern the pharmacy that stocks, sells and dispenses the medicine, while State Licensing Authorities administer the applicable sale licences.[6] Accordingly, a Platform cannot regularise an otherwise unlicensed transaction merely by characterising itself as a marketplace or technology provider.
2. The Proposed E-Pharmacy Framework
In August 2018, the Central Government published draft amendments proposing a dedicated registration framework for e-pharmacies.[7] The proposal contemplated central registration, periodic inspections, pharmacist-led prescription verification, transaction records, customer support, restrictions on specified drug categories and regulatory monitoring. These requirements indicate the direction of future regulation, but they remain proposals rather than operative rules. An Online Pharmacy should therefore distinguish between obligations already imposed by existing law and controls that represent prudent preparation for a possible future regime.
3. Judicial Position
In M/s Practo Technologies Private Limited v. Tamil Nadu Chemists and Druggists Association, the Madras High Court declined to impose a general prohibition while the regulatory policy remained under consideration. It permitted the prevailing position to continue, subject to online sales being made only through or by licensed druggists and chemists, with action available against individual violations.[8]
The current baseline is thus functional rather than platform-specific: lawful online distribution depends on a licensed seller, compliant dispensing and enforceable oversight, even though a bespoke e-pharmacy framework remains pending.
Licensed Fulfilment and Prescription Discipline
1. The Licensed Pharmacy
An online order must ultimately be fulfilled by a pharmacy holding the licence appropriate to the medicine supplied and the premises from which it is stocked and dispatched. Ordinary retail licences are issued in Forms 20 and 21, while Schedule X drugs require the specialised retail licence in Form 20F.[9] The Platform should therefore map each order to an identified licensed pharmacy, verify the scope and continuing validity of its licence, and prevent fulfilment from warehouses or locations not covered by it. A contractual assurance from the seller is useful, but cannot replace documentary verification and periodic monitoring.
2. Pharmacist Oversight
Prescription review is a professional function, not a routine platform approval. The registered pharmacist must verify the prescription, assess its legal and pharmaceutical appropriateness, confirm the patient and medicine particulars, and ensure that the product dispensed matches the prescription. Unauthorised substitution is treated as professional misconduct. [10] Automated checks may support triage, detect incomplete uploads or flag restricted medicines, but the workflow should preserve meaningful pharmacist review before dispensing.
3. Scheduled and Controlled Medicines
Schedules H, H1 and X impose progressively stricter prescription and record controls. Their labels expressly warn that retail sale requires a prescription from a Registered Medical Practitioner.[11] Repeat dispensing should not be enabled unless permitted by the prescriber. Schedule H1 transactions require a separate record of the prescriber, patient, medicine and quantity supplied, retained for three years; Schedule X prescriptions must be issued in duplicate, with one copy retained for two years.[12] Where a medicine also falls within the narcotic-drug or psychotropic-substance framework, additional controls concerning possession, supply and medical use may apply.[13]
These distinctions should be embedded into the product catalogue. A Platform should not rely solely on seller judgment after checkout; it should classify medicines in advance, block impermissible listings and route sensitive orders through enhanced review.
4. Records That Follow the Transaction
The compliance record should connect the prescription, patient, dispensing pharmacy, pharmacist, medicine, quantity, manufacturer, batch, invoice and date of supply. Digital storage may improve traceability, but records must remain accurate, retrievable and available for inspection. The invoice should identify the licensed seller rather than allowing the Platform’s brand to obscure who made the regulated sale. In online medicine distribution, a seamless consumer experience must still leave a complete regulatory trail.
When the Platform Becomes Responsible
1. Consumer Law Duties
A Platform’s responsibility begins with the role it presents to consumers. It must disclose its legal identity, grievance mechanism and material transaction terms, and must not adopt unfair trade practices. A marketplace must also require sellers to provide accurate information and display seller details in a manner that enables informed choice.[14] These duties operate independently of the pharmacy’s compliance and cannot be displaced entirely through seller agreements.
Consumer exposure may extend beyond deficient service. The Consumer Protection Act, 2019 permits product-liability claims against a product service provider and, in specified circumstances, a product seller. Relevant factors include deficient performance, withholding material information, independent warranties, substantial control over packaging or labelling, and failure to exercise reasonable care.[15] A Platform that promises authenticity, undertakes prescription review or assumes responsibility for fulfilment may therefore create obligations through its own conduct.
2. Intermediary Protection Is Conditional
Section 79 of the Information Technology Act, 2000 provides limited protection for third-party information hosted by an intermediary, subject to prescribed conditions. Among other requirements, its role must ordinarily remain confined to providing access, without initiating the transmission, selecting its recipient or modifying the information.[16] The protection also depends on observing applicable due diligence. It does not excuse non-compliance with drug-control or consumer law, or protect the Platform from liability for its own representations and operational failures.
3. Responsibility Follows Control
The practical enquiry is whether the Platform merely transmits an order or materially shapes the medicine transaction. Exposure increases where it selects pharmacies, approves listings, determines discounts, reviews prescriptions, controls packaging, coordinates dispatch, facilitates substitutions or resolves complaints under its own brand.
Contractual labels remain relevant, but are not conclusive. Where the Platform exercises meaningful control, its systems, procedures and public claims must remain consistent with the legal responsibility attached to that role.
Product Integrity from Licensed Shelf to Doorstep
1. Lawful Sourcing and Chain of Custody
Product integrity begins before a medicine appears on the Platform. The dispensing pharmacy should procure only from authorised sources and verify the manufacturer, batch, expiry, packaging and invoice. Indian drug law prohibits the sale or distribution of medicines that are not of standard quality, misbranded, adulterated or spurious, and requires disclosure of the source from which stock was obtained.[17] Seller onboarding should therefore be supported by transaction-level traceability, not merely a general warranty of authenticity.
2. Storage and Delivery Conditions
A genuine medicine may become unsafe if stored or transported incorrectly. The CDSCO’s Good Distribution Practices Guidelines provide a useful operational benchmark across procurement, storage, transportation and delivery.[18] The pharmacy and Platform should identify temperature-sensitive or light-sensitive products; apply suitable packaging; monitor cold-chain conditions where required; and ensure that the logistics provider understands the applicable handling standards. Outsourcing delivery should not create a break in quality oversight.
3. Returns, Recalls and Incident Response
Returns require particular caution because the pharmacy may no longer be able to verify how the medicine was stored after dispatch. Returned, damaged, expired, recalled or suspected spurious stock should be segregated and prevented from re-entering saleable inventory unless its quality can lawfully be assured.[19]
The Platform should also be capable of tracing an affected batch to the relevant seller and consumers, suspending listings, communicating recall instructions and preserving related records. A robust chain of custody allows the business to respond before a product-quality concern becomes a wider patient-safety incident.
Consumer Protection Beyond the Complaint Desk
1. Consumer-Facing Transparency
Consumer protection begins before an order is placed. The Platform should identify the dispensing pharmacy, distinguish paid or preferential listings, and disclose the price, delivery conditions, cancellation terms and refund process. Claims that a medicine is “genuine”, “safe”, “recommended” or suitable for a condition should be capable of substantiation. Drug advertisements are additionally restricted where they make false claims, misrepresent a product’s character or promote its use for specified diseases and conditions.[20]
2. Health Claims and Digital Promotion
Product pages, search rankings, notifications and influencer content may all function as advertising. The CCPA’s advertising framework requires claims to be truthful, substantiated and consistent with the product’s actual characteristics.[21] A disclaimer should not be used to cure a misleading representation. Platforms should also separate product information from language that appears to diagnose a condition or recommend treatment.
3. Dark Patterns and Pricing
Interface design should not pressure a consumer into purchasing or continuing medication. False urgency, basket sneaking, disguised advertisements, drip pricing, subscription traps and interface interference are recognised dark patterns.[22] In health commerce, prompts that minimise prescription requirements or automatically add medicines deserve particular scrutiny.
Discounts must also be presented against a reference price. Scheduled formulations remain subject to ceiling or retail prices, and no medicine may be sold above the price applicable under the Drugs (Prices Control) Order, 2013.[23]
Prescriptions, Patient Information and Data Governance
A prescription may reveal more than the medicine ordered. Together with a consumer’s identity, contact details, address and purchase history, it may disclose a health condition. Medical records and history are presently treated as sensitive personal data or information, requiring a privacy policy, purpose-linked collection, controlled disclosure, limited retention and reasonable security practices.[24]
The Platform should collect only the information necessary to validate and fulfil the order. Access to prescriptions should be restricted to authorised personnel and the dispensing pharmacy. Logistics providers ordinarily require delivery particulars, not the prescription or medicine history. Arrangements with pharmacies, technology vendors and delivery partners should govern permitted use, confidentiality, security, retention, deletion and incident reporting.
The data lifecycle must accommodate competing legal requirements. A deletion request may not justify erasure where prescription or dispensing records must be retained under drug law. Conversely, statutory retention should not support indefinite commercial use. Purchase histories should not be repurposed for profiling, targeted promotions or inferred-health advertising merely because the Platform holds them.
The Digital Personal Data Protection Act, 2023 introduces a framework for lawful processing, notice, consent, security safeguards, erasure and individual rights.[25] Its principal processing obligations are scheduled to commence on May 13, 2027. Platforms should use the transition period to align consent journeys, access controls, processor contracts and breach-response systems before the framework becomes operative.
Enforcement and Building a Defensible Compliance System
1. Enforcement Is Multi-Layered
Enforcement is distributed across several authorities. State Licensing Authorities and Drug Inspectors may inspect premises, examine records, take samples, search or seize stock and initiate action where medicines are sold or distributed in contravention of drug law.[26] Serious violations—including the sale of adulterated or spurious drugs—may attract substantial criminal penalties.[27] The online structure does not prevent such action: the regulator may examine the licensed pharmacy, movement of stock and the Platform’s role in enabling the transaction.
Regulatory scrutiny has moved beyond theory. CDSCO issued show-cause notices in February 2023 to firms engaged in online or internet sale of drugs. Several firms responded that they merely facilitated transactions between consumers and licensed pharmacies, illustrating why enforcement will examine operational conduct rather than intermediary labels.[28] Consumer authorities may separately investigate unfair practices, order discontinuance, require reimbursement or recall unsafe goods, and proceed against misleading advertisements.
2. A Defensible Compliance System
A defensible system should convert overlapping duties into verifiable controls. The Platform should maintain a regulatory map covering each business model, product category, State and fulfilment location. Seller onboarding should verify licences, pharmacists, premises and authorised product categories, followed by renewal checks and risk-based audits.
Transaction controls should connect product classification, prescription review, restricted-medicine filters, invoices, batch details and delivery records. The Platform should also maintain procedures for complaints, data incidents, failed deliveries, returns, recalls and regulatory enquiries, with clear escalation ownership.
Contracts should allocate responsibilities among pharmacies, logistics providers and technology vendors, but should not substitute operational supervision. In a sector where a single failure may affect patient safety, compliance must be demonstrable from listing through post-delivery response.
[1] Section 18(c), Drugs and Cosmetics Act, 1940
[2] Rules 61, 62, 64 and 65, Drugs Rules, 1945; see also Section 42, Pharmacy Act, 1948
[3] Rules 3(1)(f), 3(1)(g), 6 and 7, Consumer Protection (E-Commerce) Rules, 2020
[4] Rules 4, 87A and 87B, Medical Devices Rules, 2017, as amended by the Medical Devices (Fifth Amendment) Rules, 2022
[5] Section 22, Food Safety and Standards Act, 2006; Food Safety and Standards (Health Supplements, Nutraceuticals, Food for Special Dietary Use, Food for Special Medical Purpose, Functional Food and Novel Food) Regulations, 2016
[6] Rule 59, Drugs Rules, 1945
[7] Draft Drugs and Cosmetics (Amendment) Rules, 2018, G.S.R. 817(E), dated August 28, 2018, proposed Rules 67J, 67M, 67O, 67P, 67S, 67U and 67V. The Government continued to describe this framework as draft rules in its Lok Sabha response dated December 12, 2025
[8] M/s Practo Technologies Pvt. Ltd. v. Tamil Nadu Chemists and Druggists Association, W.A. Nos. 2807–2810, 2814 and 2818 of 2018, Madras High Court, judgment dated June 25, 2024, 2024:MHC:2491
[9] Forms 20, 21 and 20F and Schedule N, Drugs Rules, 1945
[10] Regulations 4.3, 8.1, 9.1 and 13, Pharmacy Practice Regulations, 2015
[11] Rule 97(1)(b)–(f), read with Schedules H, H1 and X, Drugs Rules, 1945
[12] Drugs Rules, 1945, requirements governing the retail supply and retention of records for Schedule H1 and Schedule X drugs
[13] Section 8(c), Narcotic Drugs and Psychotropic Substances Act, 1985, read with the applicable Central and State rules governing medical possession and supply
[14] Rules 4 and 5, Consumer Protection (E-Commerce) Rules, 2020
[15] Sections 85 and 86, Consumer Protection Act, 2019
[16] Section 79(2) and (3), Information Technology Act, 2000, read with Rules 3 and 7, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended
[17] Sections 18(a)(i), 18A and 18B, Drugs and Cosmetics Act, 1940
[18] Paragraphs 2.0, 4.2, 13.1, 15.2, 15.6 and 16.0, CDSCO, Guidelines on Good Distribution Practices for Pharmaceutical Products
[19] Paragraphs 11.5, 17.1–17.7 and 18.1–18.23, CDSCO, Guidelines on Good Distribution Practices for Pharmaceutical Products
[20] Sections 3 and 4, Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954
[21] Paragraph 4, Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022
[22] Paragraph 4, read with the Annexure, Guidelines for Prevention and Regulation of Dark Patterns, 2023
[23] Paragraphs 4, 5, 15 and 26, Drugs (Prices Control) Order, 2013, as amended.
[24] Section 43A, Information Technology Act, 2000; Rules 3(iii), 4, 5, 6 and 8, Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
[25] Sections 4–8 and 11–13, Digital Personal Data Protection Act, 2023; G.S.R. 846(E), dated November 13, 2025; Rules 3 and 5–16, Digital Personal Data Protection Rules, 2025.
[26] Sections 21–24, Drugs and Cosmetics Act, 1940. State Licensing Authorities continue to regulate the sale and distribution of drugs and may act against non-compliance
[27] Section 27, Drugs and Cosmetics Act, 1940
[28] Ministry of Health and Family Welfare, “Update on E-Pharmacy Platforms”, Rajya Sabha written reply dated August 8, 2023