Privacy Policy

The short version

• Your health record belongs to you. We keep it safe for you, for as long as you keep your account, and show it only to people you allow.
• Your record is built from what you tell us and what your doctors, labs and pharmacies record. We gather it in one place; we do not invent or change medical facts.
• We ask before we share. You can see who has your information, and take that permission back at any time.
• We do not sell your information. We do not use your health information for advertising.
• Your health information is stored in India.
• Doctors, clinics, labs and pharmacies on MyMedicare are independent. They are responsible for the care they give you and the records they create.
• Computer suggestions on MyMedicare are labelled and are checked by a registered doctor or by you before anything happens.
• You can ask to see, correct, download or delete your information, name someone to act for you, and complain to us or to the Data Protection Board of India.

1. Who we are and what this covers

1.1 MyMedicare is operated by Ensure Health Technologies Private Limited, a company incorporated in India with its registered office at 2nd Floor, Plot No 31/B, Road No 4, Teachers Colony, B.N Reddy Nagar, Hyderabad, Telangana - 500079 ("MyMedicare", "we", "us").

1.2 This policy covers the website mymedicare.in, the MyMedicare apps for Android and iOS, and the related services we run at care360.clinic (for doctors and clinics), myrx.store (prescriptions and refills), 24x7.care and care360.co (provider and partner onboarding), together "the Services". One sign-in works across all of them.

1.3 It applies to patients and their family members, caretakers, doctors, clinic staff, other health professionals, laboratory and pharmacy staff, partners and visitors.

1.4 This policy explains our handling of personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the policies of the Ayushman Bharat Digital Mission ("ABDM").

2. Our role, and where your record comes from

The law treats the organisation that decides why and how personal data is used as the "data fiduciary". Who that is depends on the service.

Each provider on MyMedicare is a separate, isolated account. One provider cannot see another provider's records about you unless you consent.

Where your health record comes from. MyMedicare brings together health information from the people and organisations who create it. We do not author medical facts. Every item in your record shows its source:

We store, organise and analyse this information to present it to you and the people you allow. We never change a source record. If something is wrong, it is corrected by its source and the original is kept, marked as corrected.

3. What we collect

We collect only what each feature needs. Fields marked optional can be left blank.

We do not knowingly collect caste, religion, political opinion, sexual orientation or biometric data. If you type such information into a health record, we treat it as health information and protect it the same way.

4. Why we use it

We use personal data only for the purposes listed here. Each purpose relies either on your consent or on a use the law allows without consent (DPDP Act, section 7).

If we want to use your data for a new purpose, we will tell you and ask for your consent first.

5. What we never do

• We do not sell personal data.
• We do not use health information to show you advertising, and we do not let advertisers target you using it.
• We do not share health information with employers or insurers unless you ask us to, for a purpose you choose.
• We do not track, profile or show targeted advertising to children.
• We do not let any computer system make a diagnosis, issue a prescription or take a payment without a person's approval.
• We do not ask you to send medical records, passwords or one-time passwords by email or chat.

6. Consent

6.1 How we ask. We ask for consent with a clear, unticked choice for each purpose, at the time it matters. Agreeing to our Terms is separate from consenting to optional uses. You can use the core Services without agreeing to marketing, analytics or software improvement.

6.2 What each request tells you. Who will receive the data, what data, why, and until when.

6.3 Taking consent back. You can withdraw any consent in Settings › Privacy and sharing, as easily as you gave it, or by writing to us. Withdrawal stops future use. It does not undo use that already happened, and it does not require a provider to delete records the law requires the provider to keep. If a feature cannot work without the data, we will tell you before you confirm.

6.4 Consent records. We keep a record of every consent you give or withdraw, and you can see it in the app.

6.5 Consent Managers. Once Consent Managers are registered under the DPDP Act, you may also manage your consents to us through a registered Consent Manager.

7. Your ABHA and the Ayushman Bharat Digital Mission

7.1 Creating or linking an Ayushman Bharat Health Account (ABHA) is your choice. You do not need an ABHA to use MyMedicare.

7.2 If you choose to create an ABHA through us, ABDM verifies your identity using Aadhaar one-time password, driving licence or another method ABDM allows. Your Aadhaar number goes to ABDM's systems, not to ours, and we do not keep it.

7.3 Records move through ABDM only when you approve a consent request that names the requester, the purpose, the types of records, the date range and when access ends. You can see and revoke these consents in MyMedicare and in ABDM's own apps.

7.4 When a clinic using care360.clinic treats you, the clinic may link your records to your ABHA so they can be found later with your consent.

7.5 ABDM is run by the National Health Authority. Its handling of your data is covered by its own policies, not this one.

8. Who we share with

We share only what each recipient needs for the purpose you chose.

We do not share with group companies, insurers, employers, data brokers or advertisers for their own use.

9. Family, caretakers, children and persons with disability

9.1 Adding a family member. You may manage an adult family member's profile only with their permission. They confirm it on their own phone, or at a clinic in the presence of staff. An adult family member can take control of their own profile at any time and remove your access.

9.2 Children. Under the DPDP Act, anyone under 18 is a child. A child's profile can be created only by a parent or lawful guardian. The adult who adds the child manages the profile automatically: they decide what is recorded, who it is shared with and what goes into the emergency information. Before the first child is added, we confirm once that the parent or guardian is an identifiable adult, using their verified MyMedicare details or a DigiLocker or similar government-issued token, as the DPDP Rules require. A second parent or guardian can be added with the first one's agreement. We do not track, profile or show targeted advertising to children.

9.3 When a child turns 18. We will invite them to take over their own profile. The parent's access then continues only if the young adult agrees.

9.4 Persons with disability. Where a person with disability has a lawful guardian, the guardian's verified consent is required, and we will ask for proof of guardianship.

9.5 Caretakers. A caretaker, including family living abroad, can help manage care only for the person, and only to the level, that person or their guardian allows.

9.6 Doctors treating a child. Clinics and doctors treating a child may process the child's data as needed to provide care, under the law that applies to them.

10. Emergencies

10.1 When you register, you choose what goes into your emergency information: for example blood group, allergies, current medicines, major conditions, implants, organ donor status and emergency contacts. For a child, the parent or guardian chooses. You can change it at any time.

10.2 Your MyMedicare QR card does not contain your health information. It holds a short-lived code. What a scan shows depends on who scans it:

10.3 When you add an emergency contact, we tell them and ask them to agree to their name and contact being used this way.

10.4 Showing your chosen emergency information to a verified doctor relies on the consent you gave at registration and, where your life or health is at risk, on the DPDP Act's allowance for medical emergencies. Every scan is logged with who scanned, when and what was shown, and we notify you and your emergency contact immediately. Repeated scans by unverified users are limited to prevent misuse, and you can block a lost card and issue a new one in the app.

10.5 MyMedicare is not an emergency service. In an emergency, call 112 or go to the nearest hospital.

11. Doctors, clinics and other professionals

11.1 Your profile. We publish your name, photo, qualifications, registration number and council, specialty, clinic, fees and timings so patients can find you. We verify your registration against the National Medical Commission, state council or ABDM Health Professional Registry before listing. You can correct your profile at any time.

11.2 Your patients' records. When you use care360.clinic, you are the data fiduciary for the records you create. We process them only on your instructions under our Provider Agreement and Data Processing Terms, and we do not use them for our own purposes except as those terms allow. You are responsible for having a lawful basis for your records, for meeting your professional record-keeping duties, and for answering your patients' requests about records you hold.

11.3 Staff accounts. Clinic administrators decide what each staff member may see. We log every access to clinical records, and administrators can review the log.

12. Computer-assisted (AI) features

12.1 Some features use software, including AI, to help: drafting visit notes, summarising history, suggesting disease codes, flagging possible medicine conflicts, and explaining reports in plain language.

12.2 Our software analyses the information from your sources (section 2) together with recognised medical references, such as guidance from the Ministry of Health and Family Welfare, ICMR, WHO and peer-reviewed literature, to produce summaries, trends and reminders. These outputs are created by MyMedicare, labelled as computer-generated, show the references used where practical, and never overwrite your source records. Readings from connected devices will be shown as device-captured, not as a doctor's finding.

12.3 These features assist; they do not decide. A registered practitioner approves every diagnosis and prescription. You approve every booking and payment.

12.4 AI outputs are labelled, logged and can be reversed.

12.5 We do not send information that identifies you to an outside AI provider unless (a) the provider has signed a data agreement that bars it from keeping or training on your data, (b) the processing is for a feature you are using, and (c) the data stays in India or its transfer is lawful under section 14. The list of our AI providers and their locations is available on request from info@mymedicare.in.

12.6 We will not use your identifiable health records to train AI models without your separate consent.

12.7 Where we offer tools that generate content, we label that content as computer-generated, as Indian law requires.

13. Records with extra protection

Some records have their own confidentiality laws. We apply extra locks to them: they are hidden by default when you share your record, they are shared only when you select them by name, and every view is logged.

• Mental health records (Mental Healthcare Act, 2017).
• HIV status and related tests (HIV and AIDS (Prevention and Control) Act, 2017).
• Records of termination of pregnancy (Medical Termination of Pregnancy Act, 1971).
• Prenatal diagnostic records. MyMedicare does not record or display the sex of a foetus (Pre-Conception and Pre-Natal Diagnostic Techniques Act, 1994).

14. Where your data is stored

14.1 We store and process personal data, including all health information, on servers in India (Google Cloud, India regions).

14.2 Some service providers, such as email or error-monitoring tools, may process limited non-health data, such as your email address or a device error, outside India. We do this only where Indian law allows, under written contracts with safeguards at least as strong as this policy, and never to a country the Government of India restricts. The list of these providers and their locations is available on request from info@mymedicare.in.

14.3 If you use MyMedicare from abroad, for example to look after a parent in India, your data is still stored in India.

15. How long we keep it

We keep personal data as long as the purpose needs it, or as long as the law requires, whichever is longer. Then we delete it or make it permanently anonymous.

When you delete something, it stops being visible straight away and is removed from backups when they are overwritten. If MyMedicare ever stops providing the Services, we will give you at least 90 days' notice, let you download your full record free in a standard format, help you move it to ABDM or another service you choose, and then delete what we hold, apart from what the law requires us to keep.

16. How we protect it

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Access by role, with the least access each person needs; every read and change of clinical data is logged.
• Each provider's data is kept apart from every other provider's.
• QR codes carry a short-lived signed code, never health information.
• Multi-factor sign-in for staff and providers; for patients, one-time passwords and alerts when a new device signs in.
• Security testing before each release, and regular independent testing.
• Staff and service providers bound by confidentiality, trained, and given access only when needed.
• HIPAA-aligned privacy practices, and quality management certified to ISO 9001:2015.

No system is perfectly secure. If you think your account has been misused, tell us immediately at info@mymedicare.in or +91 836 758 0107.

17. If something goes wrong

If a personal data breach affects you, we will tell you without delay, in plain language: what happened, what data was involved, what it may mean for you, what we are doing, and what you can do. We will report it to the Data Protection Board of India and, where required, to CERT-In within the periods the law sets.

18. Your rights

We will confirm who you are before acting, without asking for more than we need. We do not charge for these requests. If we refuse a request, we will tell you why and how to complain. Under the DPDP Act, you must also give accurate information and not file false complaints.

19. Cookies and app permissions

19.1 Necessary cookies keep you signed in, protect against attacks and remember your language. They are always on.

19.2 Analytics cookies help us see which pages work. They are off until you turn them on in the cookie banner or in Settings › Privacy and sharing. They never receive health information.

19.3 We do not use advertising cookies or third-party advertising trackers.

19.4 App permissions. Camera (to scan prescriptions and QR codes), photos and files (to upload records), notifications (reminders), location (to find nearby providers, only while in use) and microphone (for consultations, when available). We ask the first time a feature needs a permission. You can turn any of them off in your phone settings.

20. Messages we send

We send service messages you need: one-time passwords, booking confirmations, reminders, results ready, emergency scan alerts, security alerts and changes to this policy. We send offers and news only if you opt in, and you can stop them at any time with one tap. SMS and calls follow TRAI rules. We remind you of our Terms and this policy at least once every three months, as the law requires.

21. Requests from authorities

We disclose personal data to a government agency, court or police only under a valid written order or a law that requires it, or to protect someone's life. We check that each request is lawful and narrow, disclose the minimum, record it, and tell you unless the law or the order forbids it.

22. Changes to this policy

We will post any change here with a new date. If a change affects how we use your data in a way you have not agreed to, we will tell you in the app and by SMS or email at least 15 days before it takes effect, and ask for your consent again where the law requires. We never treat continued use as consent to a new purpose. Earlier versions are available on request from info@mymedicare.in.

23. Contact and complaints

Grievance Officer (resident in India, under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020)

Privacy questions and rights requests: info@mymedicare.in, or Settings › Privacy and sharing › Make a request.

Timelines. We acknowledge every grievance within 24 hours and resolve it within 7 days. If a complaint needs more time, for example because a provider must act, we tell you why and the date you can expect an answer, which will be no later than 30 days.

If you are not satisfied after using our grievance process, you can complain to the Data Protection Board of India. For consumer complaints, you can also contact the National Consumer Helpline on 1915 or a Consumer Commission.

24. Meanings of a few words

• Personal data: information about a person who can be identified from it.
• Health information: information about your physical or mental health, care or treatment, including records created by providers.
• Provider: a doctor, clinic, hospital, laboratory, pharmacy or other health professional or facility using MyMedicare.
• Source record: information as recorded by you, a provider, a laboratory, a pharmacy, a device or ABDM.
• Derived information: summaries, trends and explanations produced by MyMedicare's software from source records.
• Consent: your clear, specific, informed and freely given agreement, which you can withdraw.
• De-identified data: data from which names, numbers and other details that could reasonably identify you have been removed.