Legal

Privacy & Data Protection Policy

This Privacy & Data Protection Policy explains how MeraDoc Healthtech Private Limited collects, uses, stores, shares, secures, retains, and deletes your personal information across its website, mobile application, and related services, and describes the rights available to you.

Last Updated: 20 October 2026

MeraDoc Healthtech Private Limited

Introduction

This Policy describes how MeraDoc Healthtech Private Limited ("MeraDoc", "Company", "we", "us", "our") collects, uses, stores, shares, and protects your personal information when you access or use our website, mobile application, or any related services (collectively, the "Platform").

MeraDoc is a digital health and wellness platform that connects users with verified doctors and medical professionals for video and audio consultations, diagnosis support, prescriptions, follow-ups, and wellness services. You may use MeraDoc directly, or through an employer, insurer, or partner platform that offers MeraDoc to you. Because we handle health information, we treat privacy and security as core to our service, not as an afterthought.

This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and rules made thereunder, the Telemedicine Practice Guidelines, and other applicable laws. Under the DPDP Act, MeraDoc acts as a Data Fiduciary and you, as an individual whose data we process, are a Data Principal.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where we rely on your consent to process your data, we will obtain it separately and clearly, and you may withdraw it at any time (see Section 7 – Consent and Its Withdrawal).

1. Key Definitions

To help you understand this Policy, the following terms are used:

Personal Data — any data about an individual who is identifiable by or in relation to such data.
Health Data — information relating to your physical or mental health, medical history, symptoms, prescriptions, diagnostic reports, consultation records, and readings from connected devices.
Connected Device — a wearable, smart scale, blood pressure monitor, or other health device, or a health app account (such as Withings or Google Health), that you choose to link to MeraDoc.
Device Data — the health and fitness data we receive from a Connected Device after you link it.
Processing — any operation performed on personal data, including collection, storage, use, disclosure, sharing, or erasure.
Data Principal — the individual to whom the personal data relates (i.e., you). Where the individual is a child, this includes a parent or lawful guardian; where the individual is a person with a disability, it includes a lawful guardian.
Data Fiduciary — the entity that determines the purpose and means of processing personal data (i.e., MeraDoc).
Data Processor — any third party that processes personal data on our behalf and under our instructions.
Consent Manager — a registered entity, if used, through which you may give, manage, review, or withdraw consent.
Data Protection Board / DPB — the Data Protection Board of India, the authority established under the DPDP Act.

2. Information We Collect

We collect only the data necessary for the purposes described in this Policy (the principle of data minimisation).

a. Personal Information

Name, phone number, and email address.
Age, date of birth, gender, and profile details.
Postal address, where required to deliver a service.
Emergency contact or dependant details, where you choose to provide them.
Employer or partner reference, where you access MeraDoc through an employer, insurer, or partner platform.

b. Health Information

Symptoms, medical history, allergies, prescriptions, and reports.
Consultation notes and communications shared with doctors.
Wellness and activity data, and any health-related information you voluntarily provide.
Device Data from Connected Devices you choose to link (see Section 2(f)).

c. Transaction & Account Information

Booking, appointment, and consultation history.
Payment status and transaction references (payment card details are handled by our payment partners and are not stored on our servers — see Section 8).

d. Technical Information

Device information, IP address, operating system, and browser type.
App and website usage data, log data, cookies, and analytics information (see Section 15 – Cookies and Tracking Technologies).

e. Information from Third Parties

Data from doctors or healthcare providers you consult through the Platform.
Data from payment gateways, identity-verification services, or partners assisting our operations, subject to their lawful basis to share it with us.

f. Connected Devices and Wearables

You can choose to link a Connected Device to your MeraDoc account. Linking is optional, and MeraDoc's consultation services work fully without it. We receive Device Data only after you link a device and give your consent on the consent screen, and only for the data types listed below or on that consent screen.

How we use Device Data. We use Device Data only for two features:

Your Health Dashboard — showing your own readings and trends in the MeraDoc app.
Your doctor's view — making your readings available to the MeraDoc doctor treating you, before and during a consultation and for follow-up care, so they can see real trends rather than relying on memory.

We do not sell Device Data. We do not use it for advertising, retargeting, marketing, profiling, or credit, lending, insurance or employment decisions. We do not send it to analytics or marketing tools, and we do not share it with your employer or any partner platform.

For any other connected provider shown in the app, we receive only the data types displayed on the consent screen before you link it, and use them only for the two features described above.

Withings

If you link a Withings account, we receive the following data types:

Withings data we receive and how we use it
Data type	What we receive	What it is used for
Activity	Steps, distance, calories, workouts	Lifestyle and chronic-condition advice (e.g. diabetes, hypertension, weight management)
Sleep	Duration, sleep cycles, sleep score, snoring, breathing disturbance index (AHI)	Assessing fatigue, insomnia and daytime sleepiness, and deciding whether to refer you for a formal sleep study
Body	Weight, BMI, body composition	Tracking weight trends and response to treatment
Heart rate	Heart rate and heart rate variability (HRV)	Assessing palpitations, fatigue and stress, and response to medication
Blood pressure	Systolic, diastolic and pulse readings	Diagnosing and managing high blood pressure and adjusting medication between consultations
ECG	ECG recordings taken on your device	Letting your doctor review a recording made during symptoms and decide whether you need urgent in-person care
Blood oxygen	SpO2 readings	Assessing breathlessness and respiratory illness, and monitoring recovery
Body temperature	Temperature readings	Tracking fever over several days during an infection

We connect to Withings through integration software that runs on MeraDoc's own servers. Your Withings data does not pass through any outside integration company.

Google Health

If you link a Google Health account, we access the health and fitness data Google makes available to connected apps — activity (steps, distance, calories and workouts), health measurements (such as heart rate, heart-rate variability, blood oxygen, respiratory rate, weight, body fat, temperature and blood glucose), sleep sessions, and your Google Health account settings. We use this data for the two features described above and for no other purpose. No human reads your Google Health data except with your explicit consent, where necessary for security purposes (such as investigating abuse), or where required by law. MeraDoc's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

You can disconnect any Connected Device from the app at any time. Disconnecting stops new data from being collected immediately. How long we keep data already received, and how to have it deleted, is set out in Section 11.

Medical caution

Device readings are shared to support your doctor's judgement. They are not continuously monitored by MeraDoc or your doctor, and MeraDoc is not an emergency service. If a reading worries you or you feel unwell, contact a doctor or emergency services directly.

3. How We Use Your Information

We process your personal data for specific, lawful, and limited purposes, including to:

Connect you with verified doctors and medical professionals for video and audio consultations.
Provide diagnosis support, medical advice, prescriptions, and follow-up care.
Show your Device Data in your Health Dashboard and to your treating doctor, where you have linked a Connected Device (see Section 2(f)).
Manage your appointments, records, reminders, and account.
Process payments and issue invoices or receipts.
Improve user experience, Platform performance, and service quality through analytics. Analytics use technical and usage data only; we do not send Health Data or Device Data to analytics tools.
Communicate service-related information, updates, and (where you have not opted out) relevant notifications.
Ensure safety, prevent fraud and abuse, and maintain the security and integrity of the Platform.
Comply with applicable legal, regulatory, and medical record-keeping obligations.

We do not use your health data for advertising or profiling, and we do not sell your personal or health data.

4. Data Protection Principles

We are committed to processing your personal data in line with the following principles:

Lawfulness, Fairness & Transparency — we process data lawfully and tell you clearly why and how we do so.
Purpose Limitation — we use data only for the purposes stated at the time of collection.
Data Minimisation — we collect only what is necessary for those purposes, including requesting only the Device Data types listed in Section 2(f).
Accuracy — we take reasonable steps to keep data accurate and up to date.
Storage Limitation — we retain data only for as long as necessary (see Section 11).
Integrity & Confidentiality — we protect data with appropriate technical and organisational safeguards (see Section 9).
Accountability — we maintain records, conduct audits, and remain answerable for how we handle your data.

5. Legal Basis for Processing

We process your personal data on one or more of the following bases:

Your consent, obtained clearly and separately, for processing that is not covered below. Collection of Device Data is always based on your consent, given when you link a Connected Device.
Performance of the service you have requested (e.g., booking and delivering a consultation).
Legal obligation, where processing is required by applicable law or a competent authority.
Certain legitimate uses permitted under the DPDP Act, such as responding to a medical emergency, ensuring safety during an epidemic or threat to public health, or complying with a legal order.

You may withdraw your consent at any time, and doing so will be as easy as it was to give it. You can withdraw consent through your account settings, by disconnecting a Connected Device in the app, or by contacting our Grievance Officer (see Section 13). Where you withdraw consent, we will stop the relevant processing unless we are permitted or required by law to continue, and we will erase the associated data unless retention is legally required (see Section 11). Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide certain services to you.

8. Data Processors and Third-Party Agreements

We engage carefully selected third parties ("Data Processors") to process data on our behalf. The categories we use are:

Categories of Data Processors we use
Category	Purpose	Health or Device Data?
Cloud hosting (Amazon Web Services, India region)	Storing and running the Platform	Yes, encrypted, as infrastructure only
Payment gateways	Processing payments	No
Communications providers (SMS, email, notifications)	Sending OTPs, reminders and service messages	No health details in message content
Analytics providers	Understanding app performance and usage	No

Video consultations run on MeraDoc's own calling technology. Audio consultations are connected through a MeraDoc-branded line operated by a telephony provider using number-masking; that provider does not receive your health data. Connected Device integrations run on software hosted on MeraDoc's own servers, so they do not involve an outside processor.

Every Data Processor engagement is governed by a written contract that requires the processor to:

process data only on our documented instructions and only for the agreed purpose;
implement appropriate security safeguards;
assist us with breach notification and with responding to Data Principal requests;
comply with applicable data-protection laws; and
delete or return data at the end of the engagement.

Payment card and banking details are collected and processed directly by PCI-DSS-compliant payment partners; MeraDoc does not store full card numbers on its systems.

9. Data Security and Protection Measures

Protecting your data is central to our operations. We maintain an information security framework aligned with ISO/IEC 27001 and apply the following technical and organisational safeguards:

Encryption — personal and health data, including Device Data and the access tokens used to connect your devices, is encrypted in transit and at rest using strong, industry-standard encryption (AES-256).
Access Controls — role-based access ensures that only authorised personnel can access sensitive data, on a strict need-to-know basis, protected by authentication controls.
Audit Trails & Logging — access to and processing of personal data is logged, and logs are retained for at least one year, or longer where required by law.
Network & Application Security — secure servers, firewalls, and secure development practices protect against unauthorised access.
Regular Audits & Testing — we conduct internal and independent third-party security assessments and reviews periodically.
Vendor Due Diligence — third parties are assessed and contractually bound to maintain equivalent safeguards.
Backups — data is backed up so it can be restored if lost or damaged, and backups are protected with the same safeguards.
Incident Response — a defined process exists to identify, contain, mitigate, and report data breaches (see Section 10).
Staff Training & Confidentiality — employees and contractors are trained on data protection and bound by confidentiality obligations.

10. Data Breach Notification

In the event of a personal data breach, we will act in accordance with the DPDP Act and DPDP Rules:

The incident will be escalated to our internal incident-response team and our Grievance Officer / designated data-protection contact.
We will intimate the Data Protection Board of India and notify each affected Data Principal of the breach, without undue delay.
Affected individuals will be given a clear, plain-language account of the breach, the data involved, the likely consequences, the measures we are taking, the steps they can take to protect themselves, and a point of contact.
We will submit a detailed report to the Data Protection Board within 72 hours of becoming aware of the breach (or such longer period as the Board may permit), including the facts, mitigation measures, and steps taken to prevent recurrence.
Where the Information Technology Act / CERT-In directions apply, we will also meet any separate reporting obligations within their required timelines.
Where a breach involves data received from a Connected Device provider, we will also notify that provider where our agreement with them requires it.
Corrective and preventive actions will be implemented to reduce the risk of recurrence.

11. Data Retention and Erasure

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, to provide our services, or to comply with legal, regulatory, tax, or medical record-keeping obligations.

When the purpose is no longer served — for example, where you withdraw consent, close your account, or remain inactive beyond the applicable retention period — we will erase your personal data, unless retention is required or permitted by law.
Certain medical and transaction records may be retained for longer where mandated by applicable healthcare or financial regulations.
Where required, we will give you advance notice before erasing data at the end of a retention period, so that you have an opportunity to preserve it if you wish.
On erasure, data is deleted or irreversibly anonymised across our active systems and, in due course, from backups.

Device Data

We keep Device Data only while your Connected Device is linked to your MeraDoc account.
When you disconnect a device, we stop collecting data immediately and delete the Device Data we received from it, and the access tokens used to connect it, within 30 days.
When you delete your MeraDoc account, all Device Data is deleted within the same 30-day period.
You can also ask us to delete your Device Data at any time without disconnecting, by contacting us (see Section 13).
One exception applies: if your doctor reviewed specific readings during a consultation and recorded them in your consultation notes or prescription, that record forms part of your medical record. It is kept for the period required by medical record-keeping rules, even after the original Device Data is deleted.

12. Your Rights as a Data Principal

Subject to applicable law, you have the following rights in respect of your personal data:

Right to Access — obtain a summary of the personal data we process about you and the processing activities involved, and the identities of those we have shared it with.
Right to Correction & Updating — request correction of inaccurate or misleading data and completion or updating of incomplete data.
Right to Erasure — request deletion of your personal data, including Device Data, unless retention is required for legal purposes.
Right to Withdraw Consent — withdraw previously given consent at any time, including by disconnecting a Connected Device (see Section 7).
Right to Grievance Redressal — have your complaints addressed through our grievance mechanism (see Section 13).
Right to Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
Right to Data Portability — where applicable, receive certain data in a structured, commonly used, machine-readable format.
Right to Restrict / Object — request limitation of processing for specific purposes, and opt out of non-essential communications.

To exercise any of these rights, please use the mechanisms in Section 13. We may need to verify your identity before acting on a request. We will respond within the timelines prescribed by applicable law.

13. Grievance Redressal and How to Contact Us

If you have questions, requests, or complaints about how your data is handled, please contact our Grievance Officer / designated data-protection contact:

Grievance Officer: Prashant Tiwari
Email: privacy@meradoc.com
Address: MeraDoc Healthtech Private Limited, 3rd Floor, E-19, Defence Colony, New Delhi, Delhi - 110024

We will acknowledge your request promptly and resolve it within 90 days, or sooner where applicable law requires. If you are not satisfied with our response, you may approach the Data Protection Board of India.

14. Children's Data and Persons with Disabilities

MeraDoc's services are intended for adults. Where we knowingly process the personal data of a child (a person under 18 years of age) or a person with a disability who has a lawful guardian, we will:

obtain verifiable consent from a parent or lawful guardian before processing;
not undertake tracking, behavioural monitoring, or targeted advertising directed at children; and
not process children's data in a way likely to cause detriment to the child.

Connected Devices may only be linked to an adult's account, or by a parent or lawful guardian who has given verifiable consent on a child's behalf.

If you believe a child's data has been provided to us without appropriate consent, please contact our Grievance Officer so we can take corrective action.

15. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, maintain security, and understand usage so we can improve our services. You can manage cookie preferences through your browser or device settings, and through any consent banner we provide. Disabling certain cookies may affect Platform functionality. We do not use cookies to build advertising profiles from your health data.

16. Cross-Border Data Transfers

Your data is primarily stored and processed in India. Health Data and Device Data are stored on cloud infrastructure located in India. Where we transfer or store any other data outside India, we do so only in accordance with applicable law, and we do not transfer data to any country or territory restricted by the Government of India. Such transfers remain subject to appropriate contractual safeguards.

17. Third-Party Services and Links

Our Platform may contain links to, or integrations with, third-party websites or services. This Policy does not cover those third parties, and we are not responsible for their privacy practices. When you link a Connected Device, the device maker (such as Withings or Google) handles your data under its own privacy policy, and this Policy covers only the data MeraDoc receives. We encourage you to review their privacy policies before providing them with your data.

18. Updates to This Policy

We may update this Policy from time to time to reflect changes in law, technology, or our services. When we make material changes, we will update the "Last Updated" date and notify you through the Platform. If a change means we would use your data for a new purpose, or collect a new type of data on the basis of consent, we will ask for your consent again before doing so.

19. Contact

MeraDoc Healthtech Private Limited

Address: 3rd Floor, E-19, Defence Colony, New Delhi, Delhi - 110024

Email: privacy@meradoc.com (data protection) · contact@meradoc.com (general)

Website: https://meradoc.com

Legal

Privacy & Data Protection Policy

Last Updated: 20 October 2026

MeraDoc Healthtech Private Limited

Introduction

1. Key Definitions

To help you understand this Policy, the following terms are used:

Personal Data — any data about an individual who is identifiable by or in relation to such data.
Health Data — information relating to your physical or mental health, medical history, symptoms, prescriptions, diagnostic reports, consultation records, and readings from connected devices.
Connected Device — a wearable, smart scale, blood pressure monitor, or other health device, or a health app account (such as Withings or Google Health), that you choose to link to MeraDoc.
Device Data — the health and fitness data we receive from a Connected Device after you link it.
Processing — any operation performed on personal data, including collection, storage, use, disclosure, sharing, or erasure.
Data Principal — the individual to whom the personal data relates (i.e., you). Where the individual is a child, this includes a parent or lawful guardian; where the individual is a person with a disability, it includes a lawful guardian.
Data Fiduciary — the entity that determines the purpose and means of processing personal data (i.e., MeraDoc).
Data Processor — any third party that processes personal data on our behalf and under our instructions.
Consent Manager — a registered entity, if used, through which you may give, manage, review, or withdraw consent.
Data Protection Board / DPB — the Data Protection Board of India, the authority established under the DPDP Act.

2. Information We Collect

We collect only the data necessary for the purposes described in this Policy (the principle of data minimisation).

a. Personal Information

Name, phone number, and email address.
Age, date of birth, gender, and profile details.
Postal address, where required to deliver a service.
Emergency contact or dependant details, where you choose to provide them.
Employer or partner reference, where you access MeraDoc through an employer, insurer, or partner platform.

b. Health Information

Symptoms, medical history, allergies, prescriptions, and reports.
Consultation notes and communications shared with doctors.
Wellness and activity data, and any health-related information you voluntarily provide.
Device Data from Connected Devices you choose to link (see Section 2(f)).

c. Transaction & Account Information

Booking, appointment, and consultation history.
Payment status and transaction references (payment card details are handled by our payment partners and are not stored on our servers — see Section 8).

d. Technical Information

Device information, IP address, operating system, and browser type.
App and website usage data, log data, cookies, and analytics information (see Section 15 – Cookies and Tracking Technologies).

e. Information from Third Parties

Data from doctors or healthcare providers you consult through the Platform.
Data from payment gateways, identity-verification services, or partners assisting our operations, subject to their lawful basis to share it with us.

f. Connected Devices and Wearables

How we use Device Data. We use Device Data only for two features:

Your Health Dashboard — showing your own readings and trends in the MeraDoc app.
Your doctor's view — making your readings available to the MeraDoc doctor treating you, before and during a consultation and for follow-up care, so they can see real trends rather than relying on memory.

For any other connected provider shown in the app, we receive only the data types displayed on the consent screen before you link it, and use them only for the two features described above.

Withings

If you link a Withings account, we receive the following data types:

Withings data we receive and how we use it
Data type	What we receive	What it is used for
Activity	Steps, distance, calories, workouts	Lifestyle and chronic-condition advice (e.g. diabetes, hypertension, weight management)
Sleep	Duration, sleep cycles, sleep score, snoring, breathing disturbance index (AHI)	Assessing fatigue, insomnia and daytime sleepiness, and deciding whether to refer you for a formal sleep study
Body	Weight, BMI, body composition	Tracking weight trends and response to treatment
Heart rate	Heart rate and heart rate variability (HRV)	Assessing palpitations, fatigue and stress, and response to medication
Blood pressure	Systolic, diastolic and pulse readings	Diagnosing and managing high blood pressure and adjusting medication between consultations
ECG	ECG recordings taken on your device	Letting your doctor review a recording made during symptoms and decide whether you need urgent in-person care
Blood oxygen	SpO2 readings	Assessing breathlessness and respiratory illness, and monitoring recovery
Body temperature	Temperature readings	Tracking fever over several days during an infection

We connect to Withings through integration software that runs on MeraDoc's own servers. Your Withings data does not pass through any outside integration company.

Google Health

Your control

Medical caution

3. How We Use Your Information

We process your personal data for specific, lawful, and limited purposes, including to:

Connect you with verified doctors and medical professionals for video and audio consultations.
Provide diagnosis support, medical advice, prescriptions, and follow-up care.
Show your Device Data in your Health Dashboard and to your treating doctor, where you have linked a Connected Device (see Section 2(f)).
Manage your appointments, records, reminders, and account.
Process payments and issue invoices or receipts.
Improve user experience, Platform performance, and service quality through analytics. Analytics use technical and usage data only; we do not send Health Data or Device Data to analytics tools.
Communicate service-related information, updates, and (where you have not opted out) relevant notifications.
Ensure safety, prevent fraud and abuse, and maintain the security and integrity of the Platform.
Comply with applicable legal, regulatory, and medical record-keeping obligations.

We do not use your health data for advertising or profiling, and we do not sell your personal or health data.

4. Data Protection Principles

We are committed to processing your personal data in line with the following principles:

Lawfulness, Fairness & Transparency — we process data lawfully and tell you clearly why and how we do so.
Purpose Limitation — we use data only for the purposes stated at the time of collection.
Data Minimisation — we collect only what is necessary for those purposes, including requesting only the Device Data types listed in Section 2(f).
Accuracy — we take reasonable steps to keep data accurate and up to date.
Storage Limitation — we retain data only for as long as necessary (see Section 11).
Integrity & Confidentiality — we protect data with appropriate technical and organisational safeguards (see Section 9).
Accountability — we maintain records, conduct audits, and remain answerable for how we handle your data.

5. Legal Basis for Processing

We process your personal data on one or more of the following bases:

Your consent, obtained clearly and separately, for processing that is not covered below. Collection of Device Data is always based on your consent, given when you link a Connected Device.
Performance of the service you have requested (e.g., booking and delivering a consultation).
Legal obligation, where processing is required by applicable law or a competent authority.
Certain legitimate uses permitted under the DPDP Act, such as responding to a medical emergency, ensuring safety during an epidemic or threat to public health, or complying with a legal order.

8. Data Processors and Third-Party Agreements

We engage carefully selected third parties ("Data Processors") to process data on our behalf. The categories we use are:

Categories of Data Processors we use
Category	Purpose	Health or Device Data?
Cloud hosting (Amazon Web Services, India region)	Storing and running the Platform	Yes, encrypted, as infrastructure only
Payment gateways	Processing payments	No
Communications providers (SMS, email, notifications)	Sending OTPs, reminders and service messages	No health details in message content
Analytics providers	Understanding app performance and usage	No

Every Data Processor engagement is governed by a written contract that requires the processor to:

process data only on our documented instructions and only for the agreed purpose;
implement appropriate security safeguards;
assist us with breach notification and with responding to Data Principal requests;
comply with applicable data-protection laws; and
delete or return data at the end of the engagement.

Payment card and banking details are collected and processed directly by PCI-DSS-compliant payment partners; MeraDoc does not store full card numbers on its systems.

9. Data Security and Protection Measures

Protecting your data is central to our operations. We maintain an information security framework aligned with ISO/IEC 27001 and apply the following technical and organisational safeguards:

Encryption — personal and health data, including Device Data and the access tokens used to connect your devices, is encrypted in transit and at rest using strong, industry-standard encryption (AES-256).
Access Controls — role-based access ensures that only authorised personnel can access sensitive data, on a strict need-to-know basis, protected by authentication controls.
Audit Trails & Logging — access to and processing of personal data is logged, and logs are retained for at least one year, or longer where required by law.
Network & Application Security — secure servers, firewalls, and secure development practices protect against unauthorised access.
Regular Audits & Testing — we conduct internal and independent third-party security assessments and reviews periodically.
Vendor Due Diligence — third parties are assessed and contractually bound to maintain equivalent safeguards.
Backups — data is backed up so it can be restored if lost or damaged, and backups are protected with the same safeguards.
Incident Response — a defined process exists to identify, contain, mitigate, and report data breaches (see Section 10).
Staff Training & Confidentiality — employees and contractors are trained on data protection and bound by confidentiality obligations.

10. Data Breach Notification

In the event of a personal data breach, we will act in accordance with the DPDP Act and DPDP Rules:

The incident will be escalated to our internal incident-response team and our Grievance Officer / designated data-protection contact.
We will intimate the Data Protection Board of India and notify each affected Data Principal of the breach, without undue delay.
Affected individuals will be given a clear, plain-language account of the breach, the data involved, the likely consequences, the measures we are taking, the steps they can take to protect themselves, and a point of contact.
We will submit a detailed report to the Data Protection Board within 72 hours of becoming aware of the breach (or such longer period as the Board may permit), including the facts, mitigation measures, and steps taken to prevent recurrence.
Where the Information Technology Act / CERT-In directions apply, we will also meet any separate reporting obligations within their required timelines.
Where a breach involves data received from a Connected Device provider, we will also notify that provider where our agreement with them requires it.
Corrective and preventive actions will be implemented to reduce the risk of recurrence.

11. Data Retention and Erasure

When the purpose is no longer served — for example, where you withdraw consent, close your account, or remain inactive beyond the applicable retention period — we will erase your personal data, unless retention is required or permitted by law.
Certain medical and transaction records may be retained for longer where mandated by applicable healthcare or financial regulations.
Where required, we will give you advance notice before erasing data at the end of a retention period, so that you have an opportunity to preserve it if you wish.
On erasure, data is deleted or irreversibly anonymised across our active systems and, in due course, from backups.

Device Data

We keep Device Data only while your Connected Device is linked to your MeraDoc account.
When you disconnect a device, we stop collecting data immediately and delete the Device Data we received from it, and the access tokens used to connect it, within 30 days.
When you delete your MeraDoc account, all Device Data is deleted within the same 30-day period.
You can also ask us to delete your Device Data at any time without disconnecting, by contacting us (see Section 13).
One exception applies: if your doctor reviewed specific readings during a consultation and recorded them in your consultation notes or prescription, that record forms part of your medical record. It is kept for the period required by medical record-keeping rules, even after the original Device Data is deleted.

12. Your Rights as a Data Principal

Subject to applicable law, you have the following rights in respect of your personal data:

Right to Access — obtain a summary of the personal data we process about you and the processing activities involved, and the identities of those we have shared it with.
Right to Correction & Updating — request correction of inaccurate or misleading data and completion or updating of incomplete data.
Right to Erasure — request deletion of your personal data, including Device Data, unless retention is required for legal purposes.
Right to Withdraw Consent — withdraw previously given consent at any time, including by disconnecting a Connected Device (see Section 7).
Right to Grievance Redressal — have your complaints addressed through our grievance mechanism (see Section 13).
Right to Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
Right to Data Portability — where applicable, receive certain data in a structured, commonly used, machine-readable format.
Right to Restrict / Object — request limitation of processing for specific purposes, and opt out of non-essential communications.

13. Grievance Redressal and How to Contact Us

If you have questions, requests, or complaints about how your data is handled, please contact our Grievance Officer / designated data-protection contact:

Grievance Officer: Prashant Tiwari
Email: privacy@meradoc.com
Address: MeraDoc Healthtech Private Limited, 3rd Floor, E-19, Defence Colony, New Delhi, Delhi - 110024

14. Children's Data and Persons with Disabilities

MeraDoc's services are intended for adults. Where we knowingly process the personal data of a child (a person under 18 years of age) or a person with a disability who has a lawful guardian, we will:

obtain verifiable consent from a parent or lawful guardian before processing;
not undertake tracking, behavioural monitoring, or targeted advertising directed at children; and
not process children's data in a way likely to cause detriment to the child.

Connected Devices may only be linked to an adult's account, or by a parent or lawful guardian who has given verifiable consent on a child's behalf.

If you believe a child's data has been provided to us without appropriate consent, please contact our Grievance Officer so we can take corrective action.

15. Cookies and Tracking Technologies

16. Cross-Border Data Transfers

17. Third-Party Services and Links

18. Updates to This Policy

19. Contact

MeraDoc Healthtech Private Limited

Address: 3rd Floor, E-19, Defence Colony, New Delhi, Delhi - 110024

Email: privacy@meradoc.com (data protection) · contact@meradoc.com (general)

Website: https://meradoc.com

Privacy & Data Protection Policy

Introduction

1. Key Definitions

2. Information We Collect

a. Personal Information

b. Health Information

c. Transaction & Account Information

d. Technical Information

e. Information from Third Parties

f. Connected Devices and Wearables

Withings

Google Health

Your control

Medical caution

3. How We Use Your Information

4. Data Protection Principles

5. Legal Basis for Processing

6. Sharing and Disclosure of Information

Employers, insurers, and partner platforms

7. Consent and Its Withdrawal

8. Data Processors and Third-Party Agreements

9. Data Security and Protection Measures

10. Data Breach Notification

11. Data Retention and Erasure

Device Data

12. Your Rights as a Data Principal

13. Grievance Redressal and How to Contact Us

14. Children's Data and Persons with Disabilities

15. Cookies and Tracking Technologies

16. Cross-Border Data Transfers

17. Third-Party Services and Links

18. Updates to This Policy

19. Contact

Privacy & Data Protection Policy

Introduction

1. Key Definitions

2. Information We Collect

a. Personal Information

b. Health Information

c. Transaction & Account Information

d. Technical Information

e. Information from Third Parties

f. Connected Devices and Wearables

Withings

Google Health

Your control

Medical caution

3. How We Use Your Information

4. Data Protection Principles

5. Legal Basis for Processing

6. Sharing and Disclosure of Information

Employers, insurers, and partner platforms

7. Consent and Its Withdrawal

8. Data Processors and Third-Party Agreements

9. Data Security and Protection Measures

10. Data Breach Notification

11. Data Retention and Erasure

Device Data

12. Your Rights as a Data Principal

13. Grievance Redressal and How to Contact Us

14. Children's Data and Persons with Disabilities

15. Cookies and Tracking Technologies

16. Cross-Border Data Transfers

17. Third-Party Services and Links

18. Updates to This Policy

19. Contact