Privacy Policy — meddyG AI health companion

This Privacy Policy explains how Curepreneurs (“Company”, “we”, “us”, “our”) collects, uses, stores, shares, protects, and deletes personal data when users interact with our AI-enabled health companion through WhatsApp, our website, mobile app, clinic, call centre, care team, or other service channels.

Important medical notice: Our service is a health information, care navigation, symptom intake, continuity, and doctor-connect companion. It is not an emergency medical service and does not replace a qualified doctor, hospital, or emergency care provider. For serious, worsening, or emergency symptoms, users should immediately contact local emergency services or visit the nearest hospital.

1. Scope of this Policy

This Policy applies to personal data processed in connection with meddyG AI health Companion, including WhatsApp conversations, chatbot interactions, uploaded medical records, forms, doctor consultations, follow-ups, reminders, care coordination, payments, support requests, and related services.

This Policy applies to users who use the service for themselves or share information about family members, dependents, caregivers, or patients where they have authority to do so.

2. Data We Collect

We collect data directly from users, from caregivers or authorized representatives, from doctors and care partners, and from technology systems used to provide the service.

Category	Examples
Identity and contact data	Name, phone number, WhatsApp number, email, address, language preference, emergency contact.
Demographic data	Age, date of birth, gender, city, household or caregiver relationship where relevant.
Health and medical data	Symptoms, medical history, diagnoses shared by user/doctor, prescriptions, medications, allergies, vitals, lab reports, imaging reports, discharge summaries, vaccination data, reproductive health data, mental health data, chronic disease information, lifestyle information, family history.
Conversation data	WhatsApp messages, chatbot responses, voice notes, images, files, care instructions, feedback, support requests.
Consultation and care data	Appointment details, doctor notes, care plans, referrals, follow-up status, tests advised, medication adherence information.
Transaction data	Booking details, invoices, payment status, plan/subscription information. We do not store full card or UPI credentials unless expressly stated by the payment provider.
Technical and usage data	Device/browser metadata, timestamps, interaction logs, error logs, consent records, opt-in/opt-out logs, security logs.

3. Sensitive Health Data

Health information can be highly sensitive. We process health and medical data only for disclosed health, care, safety, service delivery, legal, or product improvement purposes. We do not sell users’ health data to advertisers, insurers, employers, or unrelated third parties.

Users should share only information that is accurate and necessary for the service. If a user shares another person’s health data, the user confirms that they are authorized to do so.

4. Children, Dependents, and Family Member Data

The service may be used for adults, children, elderly family members, dependents, or other patients. Where data relates to a child or dependent, the person submitting the data confirms that they are the parent, legal guardian, caregiver, or otherwise authorized representative.

We may request additional consent or verification where required by law or internal safety standards. We do not knowingly use children’s data for behavioral advertising.

5. How We Use Personal Data

We use personal data for the following purposes:

To provide AI-assisted symptom intake, health education, risk flagging, triage support, and care navigation.
To create and maintain a longitudinal health profile so users do not have to repeatedly explain their medical history.
To summarize health records, prescriptions, lab reports, imaging reports, and discharge notes.
To prepare consultation summaries, doctor briefs, follow-up plans, and care-team handoffs.
To connect users with doctors, nurses, care coordinators, clinics, diagnostics, pharmacies, or other healthcare partners where requested or required.
To send service messages, appointment updates, health reminders, follow-ups, safety alerts, and opt-in WhatsApp notifications.
To process payments, subscriptions, invoices, refunds, and customer support requests.
To improve safety, accuracy, product quality, clinical workflows, model performance, and user experience using de-identified, aggregated, or appropriately protected data where feasible.
To comply with law, respond to legal requests, prevent misuse, investigate fraud, and protect users, doctors, and the Company.

6. AI Usage and Human Review

Our service may use artificial intelligence systems to understand user messages, generate educational responses, summarize records, identify risk signals, draft doctor notes, recommend next steps, and support care coordination.

AI-generated information may be incomplete, inaccurate, or unsuitable for a user’s specific clinical situation. Users should not rely on AI responses as a final diagnosis, prescription, or emergency decision. Clinical diagnosis and treatment decisions should be made by qualified healthcare professionals.

Where clinically appropriate, user information may be reviewed by doctors, nurses, care coordinators, or other authorized personnel. Human review may also occur for safety, quality, complaint handling, training, audit, or escalation purposes.

7. Consent and Lawful Processing

By starting or continuing a WhatsApp conversation with us, submitting forms, uploading records, booking services, or otherwise using the service, users consent to the collection and processing of personal data as described in this Policy.

We seek consent for specific purposes, including health data processing, WhatsApp communication, doctor/care-team sharing, reminders, and marketing communications where applicable. Users may withdraw consent at any time, subject to legal, safety, medical-record, or contractual retention requirements.

Certain processing may be carried out without separate consent where permitted by applicable law, such as for medical emergencies, legal compliance, security, fraud prevention, or responding to user-requested services.

8. WhatsApp-Specific Disclosures

When users interact with us on WhatsApp, messages and metadata are transmitted through WhatsApp and Meta infrastructure. WhatsApp’s own terms, privacy policy, business terms, and business messaging policies may also apply to users’ use of WhatsApp.

Users should not use WhatsApp for emergencies. Users should also avoid sending unnecessary sensitive information unless needed for the service.

Users may opt out of non-essential WhatsApp messages by replying with “STOP”, “UNSUBSCRIBE”, or another opt-out instruction supported by our service. Essential care, safety, transactional, legal, and support messages may still be sent where permitted.

9. When We Share Personal Data

We may share personal data only where necessary for the purposes described in this Policy:

With doctors, nurses, care coordinators, clinics, hospitals, diagnostics, pharmacies, and other healthcare partners for care delivery.
With technology vendors, cloud providers, AI service providers, WhatsApp Business Solution providers, analytics providers, customer support tools, and security vendors who process data on our behalf.
With payment processors, billing partners, banks, and tax/accounting service providers for transactions and compliance.
With regulators, courts, law enforcement, government authorities, or legal advisors where required by law or to protect rights, safety, and security.
With a successor entity in case of merger, acquisition, restructuring, financing, or transfer of business, subject to appropriate confidentiality and data protection obligations.

We do not sell personal health data. We do not share health data with employers, insurers, advertisers, or unrelated third parties for their independent marketing unless the user has given explicit consent or the sharing is legally required.

10. Marketing and Service Communications

We may send service-related messages such as appointment confirmations, care reminders, doctor follow-up requests, payment updates, safety alerts, and support responses. These are part of the service.

Promotional or marketing communications will be sent only where permitted by law and platform rules. Users can opt out of marketing at any time. Opting out of marketing does not stop essential service, safety, or legal messages.

11. Data Retention

We retain personal data only for as long as necessary for care continuity, service delivery, legal compliance, safety, audit, dispute resolution, fraud prevention, and legitimate business purposes.

Health records may be retained for longer periods where needed for continuity of care, medical accountability, clinical safety, legal claims, regulatory obligations, or user-requested longitudinal records. When retention is no longer required, we will delete, anonymize, or securely archive data according to our internal retention policies.

12. Security Safeguards

We use reasonable technical, organizational, and contractual safeguards designed to protect personal data from unauthorized access, misuse, loss, alteration, or disclosure. These may include encryption in transit where applicable, access controls, role-based permissions, audit logs, vendor controls, secure cloud infrastructure, staff confidentiality obligations, and incident response processes.

No digital system is fully secure. Users should protect their own WhatsApp account, device lock, passwords, and OTPs, and should not share sensitive medical information in public or shared devices.

13. Data Breach Handling

If we become aware of a personal data breach, we will take steps to assess, contain, investigate, and remediate the incident. Where required by applicable law, we will notify affected users and/or the relevant authority in the prescribed manner.

14. User Rights

Subject to applicable law and verification, users may request to:

Access a summary of their personal data processed by us.
Correct or update inaccurate or incomplete personal data.
Delete personal data where continued retention is not legally, medically, or operationally required.
Withdraw consent for non-essential processing.
Opt out of marketing communications.
Raise a privacy grievance or complaint.

Requests can be sent to hello@meddyg.in or through our support channel. We may need to verify the user’s identity before acting on a request.

15. Cross-Border Processing

We may use cloud, AI, analytics, communication, security, support, or other service providers located in India or outside India. Where personal data is transferred or processed outside India, we will use appropriate contractual, technical, and organizational safeguards as required by applicable law.

16. Third-Party Services

Our service may link to or integrate with third-party services such as WhatsApp, payment gateways, labs, pharmacies, hospitals, clinics, doctor platforms, cloud providers, or analytics providers. These third parties may have their own privacy policies and terms. Users should review those policies separately.

17. Accuracy of Information

The quality of guidance depends on the accuracy and completeness of information shared by the user. Users are responsible for providing accurate symptoms, medication details, allergies, test results, and medical history. Incorrect or incomplete information can affect the quality of AI-assisted guidance and doctor review.

18. Emergency and High-Risk Situations

The service is not designed for emergencies. Users should immediately seek urgent medical care for symptoms such as severe chest pain, breathing difficulty, stroke symptoms, seizures, severe allergic reaction, unconsciousness, severe bleeding, suicidal thoughts, poisoning, severe dehydration, very high fever with danger signs, severe abdominal pain, pregnancy emergencies, or any rapidly worsening condition.

AI responses or WhatsApp replies may be delayed, unavailable, or unsuitable for urgent decision-making.

19. Changes to this Policy

We may update this Policy from time to time. Material changes may be notified through WhatsApp, website, app, email, or other reasonable channels. Continued use of the service after an update means the user accepts the updated Policy, unless separate consent is required by law.

20. Contact and Grievance Redressal

For privacy questions, consent withdrawal, data access, correction, deletion, or grievances, contact:

Company: Curepreneurs
Privacy email: hello@meddyg.in
Grievance Officer: Siddharth Mall
Address: 03-123, Wework Vashnavi Summit, Bangalore, India 560103
Response timeline: 10 business days