Section 5 · Rule 3
Privacy notice
The current notice, and the itemised list of data and purposes under legal review.
Last updated: 28 October 2026
The notice in force today
This is the notice every account is shown and asked to acknowledge. It is shown in English, Hindi or Marathi according to the language you choose above, where that translation is published.
Loading the current privacy notice…
What we collect and why (version under legal review)
| Personal data | Purpose | Basis |
|---|---|---|
| Name, email, mobile number, password (stored only as a hash), date of birth, account type | Create and secure your account; confirm you are 18 or older | Consent at sign-up |
| Profile details you enter: gender, address, blood group, emergency contact, photo | Show your profile to you and to doctors you choose | Consent at sign-up |
| ABHA number and ABHA address (if you link ABHA) | Link and share records through the Ayushman Bharat Digital Mission when you ask | Consent for each link or share |
| Health records: appointments, consultations, prescriptions, lab reports, uploaded documents, hospital admissions and notes | Provide care through doctors, labs, pharmacies and hospitals you deal with | Consent; a doctor sees them only while you have an active care relationship or a sharing permission you granted |
| Record-sharing permissions and their history | Show who can see what, and stop access when you withdraw | Consent |
| Consultation audio, only when your doctor tells you on screen and you agree | Prepare a draft note for the doctor to check | Separate consent for AI-assisted care |
| AI summaries and health insights | Draft support for your doctor, or a health score for you | Separate opt-in (AI-assisted care; AI health insights), off by default |
| Step counts from your phone or wearable | Show activity in your health view | Opt-in (wearable sync), off by default |
| Approximate location (website only) | Show your area in the website header | Opt-in (location), off by default; rounded to about 100 m; the apps do not collect location |
| Device and notification token | Send appointment, prescription, record-sharing and security alerts through Google Firebase Cloud Messaging | Push notifications: on by default, switch off at any time in Privacy Centre |
| Payment reference (card details stay with the payment provider) | Take payment for paid services | Contract |
| Sign-in, security and audit records: time, IP address, device, 2FA events | Protect accounts, investigate misuse, meet security obligations | Legal obligation (Rule 6) |
| Nominee name and contact | Let someone act for you on death or incapacity | Your request |
| Product usage statistics | None collected today | Opt-in (product analytics), off by default |
We do not use your data for advertising, and we do not sell it.
Doctors, labs, pharmacies and hospital staff: we process your name, contact details, registration or licence numbers, identity and business proofs, PAN for pharmacies, and sign-in records, to verify you, let you serve patients and keep an audit trail. Aadhaar numbers are not collected; uploaded proofs must have the number masked.
When the notice changes
When a new version is published, you are shown it and asked to acknowledge it before you continue using your account. Until you do, you can still read the notice, use the Privacy Centre and sign out. If a hospital registered you at its desk, it gave you the notice there, and you are asked to acknowledge it when you first sign in.
Related: consent and withdrawal · your rights · who receives your data