Privacy Policy & Data Protection Notice

1. Information We Collect

To provide you with an accurate clinical second opinion, we collect:

• Personal Details: Name, age, gender, and contact information (phone number / email).
• Health Data (Sensitive Personal Data): Medical history, symptoms notes, laboratory reports, prescriptions, and diagnostic files (PDF, JPG, PNG) uploaded by you.

2. Purpose of Processing & AI-Assisted Analysis

Your data is processed strictly for the following purposes:

• Clinical Review: To connect you with qualified, registered medical professionals for evaluation.
• AI-Assisted Summaries: Uploaded reports (with direct identifiers like name and age masked/stripped) may be processed through secure automated analytical tools to generate preliminary text summaries to assist the reviewing doctor. No automated AI system provides a final medical diagnosis or independent consultation. All final medical opinions are issued exclusively by human doctors.
• Statutory Compliance: Maintaining clinical consultation records as mandated by law.

3. Data Security & Storage Safeguards

We implement strict technical and organizational security measures to protect your information:

• All files and communications are transmitted securely using encrypted channels (HTTPS/SSL).
• Data at rest is stored in secure, encrypted cloud environments.
• Access Control: Access to your medical files is strictly limited to authorized medical professionals via a password-protected dashboard, with local device downloads restricted.
• Automation Safety: Automated data pipelines (such as n8n ingestion tools) are configured to prune execution logs and prevent the permanent storage of raw clinical files outside of secure database storage.

4. Data Retention Period

In compliance with National Medical Commission (NMC) Telemedicine Practice Guidelines and statutory health record-keeping requirements, your medical records, chat logs, and consultation reports will be securely stored for a minimum period of 3 years, after which they will be permanently and securely deleted or anonymized.

5. Your Rights as a Data Principal

Under the DPDP Act, 2023, you hold the right to:

• Access & Review: Request a summary of the personal data we hold about you.
• Correction: Request the correction of inaccurate or incomplete personal or medical details.
• Withdrawal of Consent: Withdraw your consent at any time. Upon withdrawal, we will cease processing your data and delete your active records, subject to any legal or clinical retention obligations we must maintain.

6. Grievance Redressal Officer

If you have any questions, wish to exercise your data rights, or want to raise a privacy concern, please contact our designated Grievance Officer: