15.

16.

in the rural areas in which we operate. As we grow our business, the inability of our systems to accommodate an increasing
volume of transactions could also constrain our ability to expand and remain competitive. We may experience difficulties
in upgrading, developing and expanding our systems quickly enough to accommodate our growing customer base and
range of products.

Our operations also rely on the secure processing, storage and transmission of confidential and other information in our
information technology systems and networks. Our information technology systems, software, including software licensed
from vendors, and networks may be vulnerable to unauthorized access, computer viruses or other malicious code and other
events that could compromise data integrity and security and result in identity theft, for which we could potentially be
liable. Any failure to effectively maintain or improve or upgrade our information technology and management information
systems in a timely manner could adversely affect our competitiveness, financial position and results of operations.

We are responsible for protecting the personal, sensitive information about our patients collected and stored by us from
privacy breaches. However, a privacy breach may occur through procedural or process failure, information technology
malfunction, or deliberate unauthorized intrusions. Theft of data for competitive purposes, particularly patient lists and
preferences, is an ongoing risk whether perpetrated via employee collusion or negligence or through deliberate cyber-
attack. In addition, the loss of our customers’ data, malicious or accidental, could disrupt the data analytics we rely on in
our operations. Any of such events would have a material adverse effect on our business, financial condition and results of
operations.

Cybersecurity breaches or unauthorized access to confidential information could lead to the loss of the information, time-
consuming and expensive litigation and negative publicity. We may not have the resources or technical sophistication to
anticipate, prevent or mitigate such cyberattacks because of their rapidly-evolving nature. Although we have not
experienced any material losses to date relating to cyber-attacks or other information security breaches, we cannot assure
you that we will not incur such losses in the future. As cyber threats continue to evolve, we may be required to expend
additional resources to continue to modify or enhance protective measures or to investigate and remediate any security
vulnerabilities. While there have been no instances of breach of information technology or cyber-attack which could
potentially have a material impact on our Company, its financials and operations during the last three financial years and
the six months ended September 30, 2021, we cannot assure you that such instances may not occur in the future.

We have commissioned, on June 10, 2021, and paid for an industry report from Technopak exclusively for
industry-related data in this Prospectus. Accordingly, prospective investors are advised not to place undue reliance
on such information.

We have commissioned, on June 10, 2021, and paid Technopak to prepare a report on the industry that we operate in, and
they have provided us with a report titled “Pharmacy Retail in India” dated November 19, 2021 (the “Technopak Report”),
which has been used for industry-related information that has been disclosed in this Prospectus. The Technopak Report
uses certain methodologies for market sizing and forecasting. While we believe such information to be true, we cannot
assure you that such information is complete or reliable. Accordingly, investors should read the industry-related disclosure
in this Prospectus in this context. Industry sources and publications are also prepared based on information as of specific
dates and may no longer be current or reflect current trends. Industry sources and publications may also base their
information on estimates, projections, forecasts and assumptions that may prove to be incorrect. While industry sources
take due care and caution while preparing their reports, they do not guarantee the accuracy, adequacy or completeness of
the data. Accordingly, investors should not place undue reliance on, or base their investment decision solely on the
information in the Technopak Report.

Our use and disclosure of personally identifiable information, including personal health information, is subject to
privacy and security regulations.

There are laws protecting the confidentiality of certain patient health information, including patient records, and restricting
the use and disclosure of that protected information. In particular, the privacy rules under the Information Technology Act,
2000 (the “IT Act”) protect medical records and other personal health information by limiting their use and disclosure of
health information to the minimum level reasonably necessary to accomplish the intended purpose. As part of our service,
we retain digital health records provided by our customers through a secure data management software developed by us.

With the proposed enactment of the Personal Data Protection Bill, 2019 (“PDP Bill”), and the ongoing regulatory
discussions along proposed Indian regulation to govern non-personal data, the privacy and data protection laws are set to
be closely administered in India, and we may become subject to additional potential compliance requirements. The PDP
Bill proposes a legal framework governing the processing of personal data, where such data has been collected, disclosed,
shared or otherwise processed within India, as well as any processing of personal data by the Government of India, Indian
companies, Indian citizens or any person or body of persons incorporated or created under Indian law. The PDP Bill defines
personal data and sensitive personal data, prescribes rules for collecting, storing and processing of such data and creates
rights and obligations of data-subjects and processors. The Indian Government has also been mooting a legislation
governing non-personal data. In September 2019, the Ministry of Electronics and Information Technology formed a
committee of experts (“NPD Committee”) to recommend a regulatory regime to govern non-personal data (“NPD”). The
NPD Committee has released two reports till date, which recommend, among other items, a framework to govern NPD

35,
