This Privacy Policy explains how we collect, use, store, and protect your personal data, including health data, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law. By registering, logging in, or using this platform, you consent to the practices described here.

• Identity & contact: full name, email, mobile number, date of birth, gender, address, city, state, pincode.
• Emergency contact: name and phone number of a nominated emergency contact.
• Health data: symptoms, medical history, current medications, allergies, blood group, uploaded lab/medical reports, consultation notes, prescriptions, vitals.
• Government ID (optional, where collected by your hospital): Aadhaar number, used only for patient identity verification where a hospital requires it.
• Technical data: IP address and timestamps for login, OTP, and consultation events (for security and audit purposes).

We process your data on the basis of your explicit consent, given at registration/login, for the purpose of: symptom triage, AI-assisted diagnostic support, appointment booking, doctor consultation, prescription and report management, and account security. You may withdraw consent at any time (see Section 6), though this may limit your ability to use the platform.

To generate AI-assisted diagnostic suggestions, this platform sends relevant clinical data (such as symptoms, medical history, medications, allergies, age/gender, and uploaded reports) to the following third-party AI processors:

• Google Gemini API (Google LLC, United States) — primary AI diagnostic and report-analysis engine.
• Anthropic Claude API (Anthropic PBC, United States) — used only as a fallback when the primary service is unavailable.

This means your health data is transferred outside India for processing. These providers process data solely to return a response to this platform and do not use it to train their models under their respective API terms. Final diagnosis and treatment decisions are always made by a licensed physician — AI output is indicative only (see the Medical Disclaimer shown throughout the app).

• OTP codes are deleted once used/expired, and in any case within 7 days.
• OTP delivery email logs are purged after 30 days.
• Clinical records (sessions, consultations, prescriptions) are retained for the duration of your relationship with the platform, so your treating doctors have continuity of care, unless you request erasure under Section 6.

We restrict access to personal data to authorised hospital staff and doctors treating you, log security-relevant events (login/logout, consultation access), and are working towards further safeguards including stronger password hashing and encryption at rest for identity documents. If we become aware of a personal data breach, we will notify affected users and the Data Protection Board of India as required by law.

• Access & correction: update your profile at any time from My Profile.
• Withdraw consent / erasure: email our Grievance Officer (Section 8) to request deletion of your account and data, subject to any legal retention requirement (e.g. medical record-keeping obligations).
• Grievance redressal: raise a complaint about how your data is handled — see Section 8.

If a patient profile indicates the individual is under 18, we require the name and verifiable consent of a parent or lawful guardian before processing that minor's data, in accordance with Section 9 of the DPDP Act.

For any privacy concern, data access/erasure request, or grievance, contact:

[TO BE DESIGNATED]
Email: grievance@meditriage.in
General support: support@meditriage.in

See the full Grievance Redressal page for our response process.

We may update this policy from time to time. Material changes will be reflected in the version and effective date above, and we may ask you to re-confirm consent.