Privacy Policy

The short version. We collect the information we need to help you find care, plan treatment and keep your health records in one place — and no more than that. Health information is the most sensitive category we hold: it is encrypted, access-controlled, and shared only with the doctors and hospitals you choose, or where the law requires it. We never sell your personal data, and we never use your health information for advertising. You can access, correct, erase and export your data, withdraw consent, and complain to a regulator — Section 11 explains how.

1. Who is responsible for your data

MedCare360 ("we", "us" or "our") is operated by Vibudha Wellness Private Limited, a company incorporated in India. We are the Data Fiduciary, under the Digital Personal Data Protection Act, 2023, for the personal data described in this Policy.

Doctors and hospitals listed on the Platform are separate and independent Data Fiduciaries in respect of the clinical records they create about you as your treating provider. Their own privacy notices govern that processing. This Policy covers only what MedCare360 itself does.

2. Who this Policy covers

This Policy applies to Patient Users, Practitioner Users, Facility Users, and visitors who browse the Platform, use the symptom checker or cost calculator, or submit an enquiry form, without registering an account.

3. What we collect

Visitors using the cost calculator: the calculator asks for your email address, an age range and a general description of any existing condition so it can shape an estimate for you, even if you never create an account. This is still personal, and in some cases health-related, data, and we treat it with the same care as data in a registered account.

4. Why we use it, and our lawful basis

We process your personal data only where we have a lawful basis to do so under the Digital Personal Data Protection Act, 2023 — generally your consent, or because the processing is necessary to provide a service you have asked for.

We do not do these things. We do not sell your personal data to anyone. We do not use your health data, symptom checker entries, or AI assistant conversations for advertising, profiling for marketing, or lead generation. We do not share your health data with an employer or insurer unless you have asked us to. We do not make a decision that produces a legal or similarly significant effect on you using automation alone, without a person reviewing it.

5. Consent and withdrawal

Before we collect personal data on the basis of consent, we tell you what we want, why, and how to withdraw. Your consent must be freely given and specific — we do not use pre-ticked boxes or bundle unrelated purposes together. You may withdraw consent at any time through your account privacy settings or by writing to support@medcare360.ai. Withdrawal does not undo processing already carried out, and does not require us to delete data we must keep by law; if withdrawal makes it impossible to keep providing a Service, we will tell you.

6. Children and guardianship

The Platform is not intended for independent use by anyone under 18. A parent or lawful guardian may use it on behalf of a child or a person in their care, and we obtain verifiable consent from that guardian before processing a child's personal data. We do not carry out targeted advertising directed at children.

7. AI and automated processing

• The symptom checker applies AI models to the symptoms you enter to suggest possible conditions and urgency levels. It is informational only and does not diagnose or decide anything about your care.
• The insurance policy analyser reads a document you upload and generates a plain-language summary; the document and summary are stored in your account under the same protections as any other health record.
• The AI health assistant in your patient account answers your questions using the records already in your account. It only ever draws on your own data, never another patient's.
• Provider search ranking uses rules that weigh specialty, location, language, availability and rating. A promoted listing is always labelled as such.
• We do not use your personal data to train third-party general-purpose AI models. Where we improve our own tools, we use de-identified or synthetic data; if that were ever to require identifiable health data, we would ask for your separate, specific consent first.
• We do not make solely automated decisions that produce a legal or similarly significant effect on you. Where an automated output would materially affect you, you may ask for a member of our team to review it.

8. Where your data is stored, and cross-border care

We store and process the personal data of users in India, in line with applicable Indian law. Health data is shared only with the doctors and hospitals you choose — you control which providers can see your records, and can withdraw that sharing at any time. If you choose to travel abroad for treatment, we share the details necessary to arrange that care — such as your identity, itinerary and the clinical summary the receiving hospital needs — with the treating hospital or doctor, on your instruction. We will tell you what will be shared and with whom before that happens, and you may decline, although declining may mean the arrangement cannot be made.

9. How we protect your data

• Data is encrypted in transit and at rest.
• Access to personal data is role-based and limited to what a person's job genuinely requires.
• We keep access and security logs to help detect and investigate unusual activity.
• Production, staging and development environments are kept separate, and test data is never real patient data.
• Every technology provider who touches personal data on our behalf is contractually bound to protect it and to tell us promptly if something goes wrong.
• We review our security practices on an ongoing basis and remediate issues we find.

10. If something goes wrong

If a personal data breach occurs, we will tell affected individuals without delay, describing what happened, its likely consequences, what we are doing about it, and what you can do to protect yourself. We will also report it to the Data Protection Board of India within the timelines the law requires. Every incident is recorded internally, including ones that do not reach the threshold for notifying you or a regulator.

11. Your rights

You have the right to:

• be informed about how we use your data, in plain language, before or when we collect it;
• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase your data, unless we are required to keep it by law;
• withdraw consent at any time, as easily as you gave it;
• nominate someone to exercise these rights on your behalf if you die or become incapacitated; and
• complain to us, and if you remain unsatisfied, to the Data Protection Board of India.

How to exercise your rights

Use the privacy controls in your account, or write to us at support@medcare360.ai. Include the email or mobile number you use to log in so we can locate your record — we may ask for extra verification for a request involving health data, and we will not use that verification information for anything else. There is no charge. We respond within 30 days, with acknowledgement of a grievance within 24 hours.

12. Cookies and analytics

We use cookies that are strictly necessary to run the Platform (for example, to keep you signed in) and analytics cookies that help us understand how the Platform is used, through Google Analytics. We do not use health data, symptom checker entries or AI assistant conversations for advertising or to build advertising profiles, and we do not sell or share analytics data with third parties for their own marketing. You can control or disable analytics cookies through your browser's privacy settings.

13. Marketing

We send marketing messages only with your consent. Every marketing message includes a way to unsubscribe, and you can change your preferences at any time in your account. Opting out of marketing does not stop service messages about your account, appointments or these policies.

14. How to contact us

For any question about this Policy, to exercise your rights, or to raise a concern about how we handle your data, write to support@medcare360.ai. We would always prefer the chance to put things right ourselves first, so please come to us before going to a regulator — although you remain free to complain to the Data Protection Board of India at any time.

15. Changes to this Policy

We review this Policy at least annually and whenever the law or our processing changes. When we update it we revise the effective date at the top. For a material change, we give at least thirty days' notice by email or in-Platform notice, and where the change requires it, we will ask for fresh consent.