Privacy Policy

MediBridge ("we", "us", "our") operates a health awareness and care-access portal that connects patients with verified doctors and paramedical professionals. This Privacy Policy explains how we collect, use, store and protect your personal data, and describes your rights under applicable law including the Digital Personal Data Protection Act 2023 (DPDPA).

We collect the following categories of personal data when you use MediBridge:

• Identity data: full name, email address, phone number, city of residence.
• Health-related data: appointment records, the reason for a visit, notes shared during booking, and prescriptions issued or received on the platform.
• Professional data (providers only): specialty, qualifications, council registration number, years of experience, consultation fee, and credential documents uploaded for verification.
• Usage data: pages visited, search queries, and technical log data collected automatically to improve the platform.

We collect and process your data for the following purposes, relying on the legal bases indicated:

• To provide the service — booking appointments, displaying provider profiles, issuing prescriptions. Basis: contract performance.
• To verify provider credentials — reviewing submitted degrees and registrations before a profile goes live. Basis: legitimate interest / compliance.
• To comply with applicable law — retaining health records for the period required by applicable Indian law. Basis: legal obligation.
• With your consent — processing health data at registration, as required by the DPDPA 2023. You may withdraw consent at any time by contacting us, subject to retention obligations imposed by law.

Your data is stored on secure servers hosted in India and/or on cloud infrastructure with data-residency controls. We use industry-standard encryption for data in transit (TLS 1.2+) and at rest. Access to personal data is restricted to authorised personnel on a need-to-know basis.

Health records are retained for a minimum period consistent with applicable law (typically seven years for medical records under Indian regulations). Account data is deleted within 30 days of a verified erasure request, subject to retention obligations.

We do not sell your personal data. We share data only:

• With the provider you book an appointment with (name, contact, reason for visit).
• With platform administrators reviewing credential documents for verification.
• With cloud infrastructure and hosting providers acting as data processors under appropriate data processing agreements.
• When required by law or a valid court order.

Under the DPDPA 2023 and applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — ask us to rectify inaccurate or incomplete data.
• Erase — request deletion of your data, subject to legal retention obligations.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Nominate — nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, contact us at support@medibridge.in. We will respond within the timeframe prescribed by the DPDPA.

As required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, we have appointed a Grievance Officer. You may contact our Grievance Officer for any privacy-related complaints or concerns at:

Grievances will be acknowledged within 24 hours and resolved within 15 days of receipt.

MediBridge uses only strictly necessary session data (a JWT token stored inlocalStorage) to keep you signed in. We do not currently use third-party tracking cookies or advertising pixels. If this changes, this policy will be updated and you will be notified.

We may update this policy from time to time. Significant changes will be communicated via a notice on the platform or by email. Continued use of MediBridge after the effective date constitutes acceptance of the revised policy.