Privacy Policy

Version: v1.1

Last Updated: June 1, 2026

1. Information We Collect

We collect the following types of personal data:

1.1 For All Users

• Name, mobile number, email address
• Date of birth and gender
• Account credentials (password - encrypted)
• Device information and IP address
• Location data (used to discover nearby clinics and verify service availability in your area)
• Photos and documents uploaded by you (e.g. medical records, profile pictures, qualification certificates)

1.2 For Patients

• Medical history and records
• Appointment details and preferences
• Vital signs and health metrics
• Prescriptions and test results
• Uploaded medical documents and reports

1.3 For Healthcare Professionals

• Professional qualifications and registration numbers
• Specialization and experience
• Consultation fees and availability

1.4 For Healthcare Facilities

• Facility details and licensing information
• Operational data and schedules
• Billing and subscription information

2. How We Use Your Information

We use your personal data for:

• Providing and improving our healthcare services
• Processing appointments and maintaining medical records
• Communication regarding appointments and updates
• Billing and subscription management
• Compliance with legal and regulatory requirements
• Analytics to improve service quality

3. Legal Basis for Processing (DPDP Act)

We process your data based on:

• Consent: You have explicitly consented to data processing
• Contract Performance: Processing necessary for providing our services
• Legal Obligations: Compliance with healthcare regulations
• Legitimate Interests: Improving service quality and security

4. Data Sharing and Disclosure

We may share your data with the following categories of third parties:

• Healthcare providers involved in your care
• Razorpay – payment processing (RBI-compliant payment gateway)
• MSG91 / ZeptoMail – SMS OTP delivery and transactional email communications
• Firebase (Google) – push notification delivery (FCM) and app analytics
• DigitalOcean – cloud infrastructure and data hosting (servers located in Bangalore, India)
• Legal authorities when required by applicable law

We NEVER sell your personal data to third parties.

5. Your Rights Under DPDP Act

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention)
• Portability: Receive your data in a structured format
• Withdraw Consent: Revoke consent at any time (may affect service availability)
• Complaint: Lodge complaints with the Data Protection Board of India

6. Data Security

We implement robust security measures:

• AES-256 encryption for sensitive data
• TLS 1.3 for data transmission
• Role-based access control (RBAC)
• Regular security audits and monitoring
• Secure password storage using bcrypt

7. Data Retention

We retain your data:

• Medical records: 7 years (as per Indian Medical Council regulations)
• Account data: Until account deletion + 90 days
• Billing records: 7 years (as per Income Tax Act)
• Consent records: Permanently (for compliance)

8. Children's Privacy

Our Service is not directed to children under 18. We do not knowingly collect data from minors without parental consent. Patient records for minors are managed through guardian accounts.

9. International Data Transfers

Your data is stored and processed in India. If international transfers are necessary, we ensure adequate safeguards as per DPDP Act requirements.

10. Cookies, Device Identifiers and Tracking

On the web platform, we use cookies for:

• Session management and authentication
• Preferences and settings
• Analytics and performance monitoring

You can control cookie preferences in your browser settings.

On the mobile app, we use:

• Firebase Cloud Messaging (FCM) tokens to deliver push notifications to your device
• Device identifiers for session security and fraud prevention
• Firebase Analytics for anonymised usage analytics to improve the app

11. Changes to Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or in-app notification.

12. Data Protection Officer

For privacy-related queries, contact our Data Protection Officer:

Moventra Tech Solutions Private Limited
Email: [email protected]
Rajib Pally, Singi Bagan, Behind Bus Stand
Rampurhat-I, Birbhum – 731224, West Bengal, India

13. Grievance Redressal

As per the DPDP Act, 2023, you can raise grievances to our Grievance Officer:

Email: [email protected]
We will acknowledge your complaint within 48 hours and respond within 15 working days.

14. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts at Rampurhat, West Bengal, India.

15. Consent

By accepting these terms during registration, you provide explicit, informed consent for data processing as described in this Privacy Policy, in accordance with the Digital Personal Data Protection Act, 2023.