Why an Online Pharmacy Is Its Own Risk Class, Not a Healthtech Clone
Brokers often file e-pharmacy submissions under the same template used for teleconsultation or healthtech platforms. That mislabels the exposure. A teleconsultation platform sells advice; an online pharmacy takes physical custody of a temperature-sensitive, potentially falsified, prescription-controlled product and hands it to a delivery rider. The failure modes are distinct: a wrong-drug dispense, a broken cold chain, a counterfeit blister pack, a leaked prescription database. Each maps to a different policy trigger, and no single wording answers all four.
The October 2025 draft Drugs, Medical Devices and Cosmetics Act 2025, unveiled by the Drugs Controller General of India on 15 October 2025 to replace the Drugs and Cosmetics Act, 1940, is the first Central statute to name e-pharmacies directly. It proposes a registration requirement for any person running an online pharmacy and layers grievance-handling and traceability duties on top. For the broker, statutory registration matters because it converts an informal operating model into a licensed activity whose breach becomes an insurable (and sometimes uninsurable) regulatory event.
A workable programme for an Indian online pharmacy sits on four legs. First, professional indemnity for the registered pharmacist and the dispensing workflow. Second, product liability for the medicine itself, including substitution and counterfeit ingress. Third, a cold-chain and transit layer for storage and last-mile spoilage. Fourth, a cyber and DPDP layer for the health-data estate. D&O sits above all four for the founders. Treating these as one bundled 'startup package' is where placements fail, because the package usually caps the very heads (product recall, spoilage, regulatory defence) that an online pharmacy claim runs into first.
Dispensing Errors and the Registered Pharmacist's Professional Indemnity
The core clinical exposure of an online pharmacy is the dispense itself: wrong drug, wrong strength, wrong patient, a missed drug-interaction flag, or dispensing a Schedule H1 or Schedule X medicine against an invalid or forged prescription. Under the Pharmacy Act, 1948 and the Pharmacy Practice Regulations, dispensing must occur under a registered pharmacist. When a customer is harmed by a dispensing error, the claim names the pharmacist, the platform that employed or contracted them, and the founders.
A standard professional indemnity wording written for consultants or IT firms will not cleanly respond, because it often excludes bodily injury. The e-pharmacy needs a PI form that expressly covers pharmacist dispensing acts and errors, with bodily-injury arising from professional negligence written back in rather than carved out. Brokers should read the insuring clause against the exclusions line by line: a policy that grants 'errors in professional services' but excludes 'the supply of goods' can be defeated the moment the insurer characterises a dispense as a supply.
Sub-limits deserve scrutiny. A platform dispensing thousands of orders a day faces an aggregation risk if one batch or one systemic software rule causes repeated identical errors. The PI sum insured should be tested against a realistic multi-claimant scenario, not a single-patient one. Retroactive cover matters too: startups that operated for two or three years before buying structured PI need the retroactive date pushed back, or every legacy dispense sits uninsured. Confirm whether defence costs sit inside or outside the limit, because Consumer Protection Act complaints against pharmacies are numerous and cheap to file.
Product Liability for Substituted, Spurious, and Falsified Medicines
Where professional indemnity covers the act of dispensing, product liability covers the medicine as a product. For an online pharmacy this is not theoretical. India's supply chain carries a persistent spurious-and-substandard-drug problem, and the platform that sold the strip is the consumer-facing defendant even when the fault lies upstream at a manufacturer or a fulfilment partner. The Consumer Protection Act, 2019 product-liability provisions let an injured consumer sue the 'product seller', and an e-pharmacy is squarely a product seller.
The distinguishing exposures are substitution and falsification. A warehouse picker swaps a branded molecule for a cheaper generic without authority; a counterfeit batch enters through a rogue distributor; a mislabelled temperature-degraded biological is shipped as potent. Each can cause bodily injury and each triggers product-liability defence. Brokers must check that the wording covers 'products sold or supplied' by the insured rather than only 'products manufactured', because an online pharmacy manufactures nothing and a manufacturer-only grant leaves it bare.
Vendor and supply-chain flow-through is the second issue. The platform should be named as an additional insured on the product-liability policies of its larger suppliers and 3PL partners, and its own policy should include subrogation waivers only where commercially forced. A well-built programme uses back-to-back indemnities so that a counterfeit-ingress claim can be pushed to the party that introduced the counterfeit.
Product recall is the head most often missing. If a regulator or the platform itself pulls a batch, the costs of notification, retrieval, refund, and reverse logistics are recall costs, not liability costs, and a plain product-liability policy excludes them. An e-pharmacy needs an explicit product-recall extension or standalone recall cover, sized to a realistic multi-city retrieval, with first-party recall expense and third-party financial loss both scheduled.
Cold Chain, Storage, and Last-Mile Spoilage: The Transit Exposure
The physical distribution of medicine is where an online pharmacy diverges most sharply from any pure-software peer. Insulin, vaccines, biologics, and many injectables must stay inside a validated 2 to 8 degree Celsius band; oncology and certain fertility drugs are even tighter. A break anywhere from the fulfilment centre chiller to the rider's insulated box renders the product unsafe, and the loss is both a stock write-off and a downstream liability if a degraded dose reaches a patient.
Three cover heads interlock here. First, material damage and stock cover for the warehoused inventory, ideally on a reinstatement-value basis so a spoiled batch is replaced at cost, not depreciated. Second, transit and cargo cover extended to include temperature deviation and refrigeration breakdown, which a bare marine or transit wording usually excludes. Third, machinery breakdown for the chillers and cold rooms themselves, because a compressor failure that spoils stock is a machinery event first and a stock loss second.
Expect a data-logger condition: insurers increasingly require continuous temperature telemetry and will decline a spoilage claim where the logger record is missing or shows the rider left the box open. The business interruption angle is real too. If the cold room fails, the platform cannot fulfil temperature-sensitive orders and loses revenue; a consequential-loss extension tied to the machinery-breakdown or property section captures that gap. Brokers should map each SKU class to its cover and confirm the deductible structure does not swallow high-frequency, low-value spoilage on individual last-mile parcels.
Health-Data Breach, the DPDP Act, and the Prescription Estate
An online pharmacy holds one of the most sensitive datasets in Indian retail: names mapped to prescriptions, diagnoses inferred from medication, chronic-illness patterns, and payment data. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in 2025, this makes the platform a Data Fiduciary with breach-notification duties to the Data Protection Board and to affected principals, and with penalties that can reach Rs 250 crore per instance for a significant breach.
The draft Drugs, Medical Devices and Cosmetics Act 2025 adds a parallel duty by proposing grievance-handling and record obligations for registered e-pharmacies, which means a breach can trigger two regulators at once. A cyber insurance policy for this risk must go beyond generic data-breach cover. It should fund forensic investigation, breach notification at scale, credit and identity monitoring, regulatory defence before the Data Protection Board, and the business interruption from a ransomware event that freezes the dispensing platform.
Two wording tests matter for brokers. First, the insurability of DPDP penalties: many cyber forms exclude fines that are uninsurable by law, so the policy should at least fund the defence and investigation costs even where the penalty itself is excluded. Second, the interaction of the cyber policy with the tech PI and product-liability layers, so that a single incident (a hacked dispensing rule that also injures a patient) does not fall into a gap between 'cyber event' and 'bodily injury'. For the founders, directors and officers cover responds to personal DPDP and drug-regulatory proceedings. Brokers should confirm the D&O grants investigation-cost cover from the first regulatory notice, not only on formal charge, because Data Protection Board and drug-inspector actions often open with an inquiry rather than a prosecution.
Building and Comparing the Programme: What Brokers Should Test Before Binding
An e-pharmacy programme is only as strong as the seams between its layers. The recurring failure is not an absent policy but four policies whose triggers, definitions, and exclusions do not line up, so a live claim slips into a gap none of the four owns. The broker's job is to set the wordings side by side and read them against the specific way an online pharmacy fails.
A practical pre-bind checklist for the Indian market:
- Confirm the PI form treats pharmacist dispensing as a covered professional service and writes bodily injury back in, with a retroactive date covering the startup's full trading history.
- Confirm product liability responds to 'products sold or supplied', includes substituted and counterfeit goods, and carries an explicit product-recall extension sized for a multi-city retrieval.
- Confirm transit and stock cover adds back refrigeration breakdown and temperature deviation, with a workable data-logger warranty, and that machinery breakdown and its business-interruption knock-on are scheduled.
- Confirm the cyber and DPDP layer funds regulatory defence and breach response even where penalties are excluded, and dovetails with PI and product liability so a hybrid incident is not orphaned.
- Confirm D&O grants investigation-cost cover from the first regulatory notice and does not exclude drug-regulatory or DPDP proceedings.
Each line reduces to a wording question, and wording questions are answered by comparison rather than by a single quote. Sarvada lets commercial insurance brokers search and compare Indian insurer policy wordings, placing dispensing PI, product liability, cold-chain, cyber and D&O grants, sub-limits and exclusions side by side so a coverage gap is found on paper before a claim finds it in practice. Brokers structuring an online pharmacy placement can Request Access to run this wording comparison on a live e-pharmacy submission.