Privacy Policy

1. Information We Collect

MediBookHome collects information you provide directly — such as your name, email, phone number, address, and appointment, nursing, and lab-test booking data — as well as technical data like IP addresses, browser type, and usage analytics to improve our services.

Some of the information you provide — including medical history, prescriptions, consent records, lab test results, and reports — qualifies as sensitive personal data under India's Sensitive Personal Data or Information (SPDI) Rules, 2011, and as health data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). We apply additional care to this category of data, as described throughout this policy.

2. How We Use Your Information

We use your information to:

• Process and manage doctor appointments, nursing visits, and lab test bookings
• Send booking confirmations, OTPs, and reminders via SMS and email
• Facilitate payments and payouts
• Verify doctor, nurse, and lab technician credentials and qualifications
• Deliver lab reports to your account dashboard
• Improve platform features and safety
• Comply with legal obligations

3. Consent

By creating an account and booking a service, you consent to the collection and use of your information as described in this policy. For nursing procedures that carry medical risk, we seek your separate, explicit digital consent at the time of booking, in addition to this policy.

You may withdraw consent to non-essential processing (such as marketing communications) at any time by contacting privacy@medibookhome.com. Withdrawing consent required for core services (such as sharing your address with an assigned nurse) may mean we are unable to complete that booking.

4. Who Can See Your Health Data

Your medical, prescription, and lab report data is visible only to: the doctor, nurse, or lab technician directly assigned to your booking; a limited set of authorised MediBookHome staff who need it to resolve a support issue, verify a booking, or investigate a complaint; and you. It is not shared with any other patient, staff member, or third party without your consent, except where required by law.

5. Data Sharing

We do not sell your personal data. We share information only with:

• The doctor, nurse, or lab technician relevant to your booking
• Diagnostic laboratory partners, solely to process samples you have booked for collection
• Payment processors (HDFC SmartGateway) for transaction processing
• Cloud infrastructure providers (AWS, Vercel, Supabase) for hosting
• Communication providers (Fast2SMS, Twilio, Resend) for SMS and email notifications

6. Where Your Data Is Stored

Uploaded documents and lab reports are stored on AWS infrastructure in the Mumbai (ap-south-1) region. Application data is stored with our database provider in the Singapore (ap-southeast-1) region. All data in transit is encrypted (TLS); data at rest is encrypted (AES-256).

7. Data Retention

We retain your data for as long as your account is active or as required by law (including medical record retention requirements applicable to healthcare-adjacent services). You may request deletion of your account and associated data by contacting us at support@medibookhome.com. Some records may be retained longer where required for legal, tax, or dispute-resolution purposes.

8. Cookies & Analytics

We use essential cookies required for login and booking sessions, and analytics cookies to understand how the site is used so we can improve it. You can control non-essential cookies via the cookie banner shown on your first visit, or through your browser settings.

9. Security & Breach Notification

We use industry-standard encryption (TLS in transit, AES-256 at rest) and access controls to protect your data. No system is completely secure — please use a strong, unique password for your MediBookHome account. In the event of a data breach that affects your personal data, we will notify affected users and the relevant authorities as required under applicable law, without undue delay.

10. Your Rights (DPDP Act, 2023)

As a data principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request erasure of your personal data, subject to legal retention requirements
• Withdraw consent as described in Section 3
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
• Register a complaint regarding how your data is handled

To exercise any of these rights, contact us at privacy@medibookhome.com.

11. Grievance Officer

In accordance with the Information Technology Rules, 2021 and the DPDP Act, 2023, the following Grievance Officer is designated to address your concerns about this policy or our handling of your personal data:

Grievance Officer, MediBookHome
Email: support@medibookhome.com
Address: Jodhpur, Rajasthan, India

We will acknowledge your grievance within 24 hours of receipt and aim to resolve it within 15 days, in accordance with applicable timelines.

12. Liability for Adverse Events

This Privacy Policy governs how we handle your personal data. It does not create any liability on the part of MediBookHome for the outcome of, or any adverse event arising from, a booked doctor, nursing, physiotherapy, or lab service. Please see Section 10 of our Terms of Service and our Medical Disclaimer for the applicable liability and assumption-of-risk terms. In summary: any mishap occurring during a booked visit — including loss of consciousness, an incorrectly administered injection, or any other adverse event — is the sole liability of the patient, and MediBookHome bears no responsibility and makes no payment in connection with such events.

13. Contact

For privacy-related questions, email privacy@medibookhome.com.