Privacy Policy

1. Introduction

MedMitra AI ("we", "our", or "us") operates the MedMitra mobile application and web services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare platform.

By using MedMitra, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your personal health information in compliance with Indian data protection laws including the Digital Personal Data Protection Act, 2023 (DPDPA).

2. Information We Collect

We collect this information in three ways: directly from you when you register, complete your profile, or type or speak during a consultation; automatically from your device when you use the app; and from the clinics, laboratories and doctors you consult through MedMitra, who add clinical records to your account.

Personal Information

• Name, phone number, email address
• Date of birth, gender, blood group
• Profile photo
• Location data (for finding nearby facilities)

Health Information

• Medical history (allergies, past conditions, medications, family history)
• Consultation records and transcripts
• Prescriptions issued through the platform
• Lab reports and diagnostic results
• Vital signs data
• Voice recordings during voice consultations

Financial Information

• Payment transaction details (processed via Razorpay)
• Wallet balance and transaction history

Device & Usage Information

• Device type, OS version, app version
• Push notification tokens
• App usage patterns and session data

3. How We Use Your Information

• To provide AI-assisted healthcare consultations
• To enable licensed doctors to review and approve prescriptions
• To facilitate appointment bookings, lab tests, and medicine orders
• To process payments and maintain billing records
• To send appointment reminders and medicine reminders
• To improve service quality
• To comply with legal and regulatory obligations

4. Data Sharing

We share your information only in the following circumstances:

• Licensed Doctors: Consultation data is shared with assigned doctors for prescription approval
• Partner Facilities: Relevant booking information is shared with clinics, labs, and pharmacies you book with
• Payment Processors: Financial data is shared with Razorpay for payment processing
• OpenAI (OpenAI, L.L.C., USA): The symptoms, health information, chat messages, and any images or documents you share in a text or voice consultation, AI call, or AI support chat are sent to OpenAI to generate the AI assessment and responses
• Sarvam AI (Sarvam AI Technologies, sarvam.ai): Voice audio from voice consultations and AI calls is sent to Sarvam AI for speech-to-text and text-to-speech
• SMS Provider: Phone numbers are shared with Twilio for OTP delivery and notifications
• Legal Requirements: When required by law, court order, or government authority

We do not sell your personal or health data to third parties for marketing or advertising purposes.

Third-party AI services

MedMitra's AI features rely on two external providers, and the data described above leaves our servers to reach them: OpenAI (OpenAI, L.L.C., USA) receives the symptoms, health information, chat messages, and any images or documents you share in a text or voice consultation, AI call, or AI support chat, in order to generate the AI assessment and responses. Sarvam AI (Sarvam AI Technologies, sarvam.ai) receives voice audio from voice consultations and AI calls, in order to perform speech-to-text and text-to-speech.

Your data is not used to train any AI model. Neither OpenAI nor Sarvam AI uses the information we send them to train or improve their models, and we do not use your personal or health data to train models of our own.

Each third-party service we share data with — including OpenAI and Sarvam AI — is contractually required to safeguard your information to the same standard of protection described in this Privacy Policy, and to use it only for the purpose for which it was shared.

Before you use any AI feature, the app asks you to review this data processing and give your explicit consent. If you decline, AI features remain disabled and you can still use the rest of the app.

5. Data Storage & Security

• All data is stored on encrypted servers hosted on AWS (Mumbai region, ap-south-1)
• All data in transit is encrypted using TLS 1.2+
• Passwords are hashed using bcrypt with salt
• Access to patient data is role-restricted and audited
• Payment card details are never stored on our servers (handled by Razorpay PCI-DSS)

6. Data Retention

• Medical records: Retained for 7 years as required by Indian Medical Council regulations
• Financial records: Retained for 8 years as required by tax regulations
• Account data: Retained until account deletion is requested
• Voice recordings: Processed and deleted within 30 days after consultation completion
• OTP records: Automatically purged after 24 hours

7. Your Rights

Under the DPDPA 2023, you have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data (subject to legal retention periods)
• Portability: Export your health records
• Withdraw Consent: Opt out of non-essential data processing

To exercise these rights, use the in-app settings or contact us at support@medmitra-ai.com

8. Children's Privacy

MedMitra is not intended for use by individuals under 18 without parental consent. For minors, a parent or guardian must create and manage the account.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices:

• Email: support@medmitra-ai.com
• App: Profile → Support

Our Refund & Return Policy and Terms & Conditions are on the legal page. For anything else, reach us at info@medmitra-ai.com.