Privacy Policy — Patients

Looking for the other version? Privacy Policy for healthcare providers

1. Introduction

This Privacy Policy explains how NeXora Health Systems Private Limited, CIN U86909TS2026PTC215305, registered office at 4-12-927/1, Plot No. E1, RD-1, Portion C, Auto Sai Nagar Colony, Vanasthalipuram, Hyderabad, Rangareddy District, Telangana – 500070 ("NeXora", "we", "us") processes the personal data of patients, caregivers, and other users of the patient-facing HoMedi application (the "Platform").

NeXora is the Data Fiduciary for the processing described in this Policy under the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). This Policy also serves as the notice required under Section 5 of the DPDPA. It is published in English; where we offer the Platform in a language specified in the Eighth Schedule to the Constitution of India, we will make this Policy available in that language too.

Because HoMedi deals with your health, we treat all data connected to your care with the highest degree of confidentiality, consistent with the DPDPA, the Information Technology Act, 2000, and the Ayushman Bharat Digital Mission (ABDM) Health Data Management Policy where you choose to create or link an ABHA (Section 5).

2. Personal Data We Collect

2.1 Data you provide

2.2 Data collected automatically

• Device and app data: device push-notification token (Firebase), app version, device type, and technical diagnostics/crash reports.

• Booking checks: to prevent fake or abusive bookings, we use a hashed identifier of your device and a hash of each visit address, together with booking counts and attempts linked to your account, device, and address, and any review status of your account (for example, "under review"). When you book, the app may also present a device-integrity token issued by Google Play Integrity (Android) or Apple App Attest (iOS), which we verify to confirm that the booking comes from a genuine HoMedi app on an untampered device; the token contains no personal or health data.

• Masked calls: when you or your provider place a masked call for a visit, our telephony provider MSG91 processes both parties' phone numbers to connect the call, and we and MSG91 keep call records (time, duration, status, and the numbers used to route the call). Masked calls are recorded; recordings are stored by MSG91 on our behalf.

• Location: your selected locality/complex and booking address are used for provider discovery within an approximately 2 km radius. Discovery uses the location you provide; continuous background tracking of patients is not performed.

• Security and audit logs: login attempts (with hashed technical identifiers), OTP request events, and an append-only audit trail of access to your records — kept to secure the Platform and to demonstrate compliance.

2.3 Payment data

HoMedi takes no payment from you, so we do not collect or process any card, UPI, or banking details. Visit fees are paid by you directly to the provider in cash or by UPI and are not processed as a payment by us. This includes the fixed price of an ECG booking, which you pay directly to the provider. We record the fees shown on the provider's rate card (or, for an ECG booking, the ECG price) and recorded against your booking, so that we can investigate any fee dispute you raise.

2.4 What we deliberately do not collect

• We do not collect data from your contacts, photo gallery, microphone, or camera for the core service. Masked calls (Section 2.2) are telephone calls connected and, where applicable, recorded by MSG91 on the telephone network, not through the app.

• We do not use your personal data for third-party advertising, and we do not sell personal data.

• Personal and health data never appear in our system logs; logs reference internal record identifiers only.

3. Purposes of Processing and Legal Basis

We process your personal data on the basis of your consent (DPDPA Section 6) and, where applicable, for legitimate uses under DPDPA Section 7 (for example, voluntary provision of data for a specified purpose, compliance with law, or medical emergencies). We collect only the data reasonably necessary for the purposes below (purpose limitation and data minimisation):

We will not process your personal data for purposes incompatible with those stated above without fresh notice and consent. We do not undertake behavioural advertising, and we do not process patient data for marketing without separate, optional consent.

4. Consent — and How to Withdraw It

• At onboarding we present a clear, itemised notice and request your consent. Consent is specific, informed, and given by clear affirmative action.

• Withdrawal: You may withdraw consent at any time from Settings → Privacy & Data, or by writing to the contacts in Section 12. Withdrawal is as easy as giving consent. On withdrawal we will stop the related processing; the lawfulness of processing before withdrawal is unaffected. Some processing required by law (for example retention of medical or tax records) continues on that legal basis.

• Withdrawing consent needed to operate your account (for example, phone-number processing) will mean we can no longer provide the service, and will be treated as a request to close the account.

• Communication preferences: transactional messages (booking confirmations, OTPs, reminders, safety notices) are part of the service and continue while your account is active. Promotional messages are sent only with your separate, optional consent, which you can withdraw at any time in Settings; we honour TRAI DND preferences for promotional content.

• Voice calls: masked calls (Section 2.2) are placed only if you have consented to receive voice calls in Settings.

• ECG: an ECG is recorded only if you book one and give your consent at the visit. By doing so you consent to the processing of your ECG data, including its sharing with Sunfox as described in Section 6.3. You may decline the ECG at the visit.

• ABDM: consent to share your health records through ABDM is given, reviewed, and revoked in your ABHA/PHR app, as described in Section 5.

• Once Consent Managers registered under the DPDP Rules are operational, we will support giving, managing, reviewing, and withdrawing consent through an interoperable Consent Manager platform.

5. ABHA and ABDM — Optional

The Ayushman Bharat Digital Mission (ABDM) is the Government of India's health data exchange, run by the National Health Authority (NHA). An ABHA (Ayushman Bharat Health Account) is your health ID on ABDM; an ABHA/PHR app (for example the ABHA app) is where you see your linked records and manage consent. HoMedi takes part in ABDM as a Health Information Provider (it can share the records of your HoMedi visits) and a Health Information User (it can receive your records from other providers). Everything in this Section is governed by the ABDM Health Data Management Policy as well as this Policy.

5.1 Creating or linking an ABHA

• Creating or linking an ABHA is entirely optional. Discovery, booking, visits, and prescriptions work identically without it. We never require an ABHA at sign-up, discovery, or booking.

• Linking an existing ABHA: verification happens through an OTP sent by ABDM to your ABDM-registered or Aadhaar-linked mobile number.

• Creating a new ABHA through HoMedi: you enter your Aadhaar number and the OTP sent to your Aadhaar-linked mobile. We pass these, encrypted, to ABDM, which creates the ABHA. We do not store, log, or otherwise keep your Aadhaar number or the OTP. Your mobile number is also sent to ABDM so it can be registered against the ABHA.

• Once your ABHA is created or linked, we store your ABHA number and ABHA address (both encrypted) and the verification status. We may display your ABHA card and QR code to you in the app.

5.2 Sharing your HoMedi records through ABDM

• When a HoMedi visit is completed and you have a verified ABHA address, we register that visit with ABDM as a "care context" linked to your ABHA. The visit then appears under HoMedi in your ABHA/PHR app. Only a visit reference and the types of record it holds are sent to ABDM at this stage — not the records themselves.

• The record types we can share are: visit notes (consultation), digital prescriptions, lab and imaging reports, vaccination records, documents uploaded to your HoMedi record, and vital signs.

• Another healthcare provider registered with ABDM (for example a hospital, clinic, lab, or doctor's app) can see these records only if you consent. The request reaches you in your ABHA/PHR app, where you can approve it, narrow it (which record types and which period), or deny it. If you approve, ABDM sends us your consent artefact, and we share only the record types and period it covers, encrypted end to end, directly with that provider. We check that your consent is still valid immediately before anything is sent. We never share your records through ABDM without a consent artefact from you.

5.3 Receiving your records from other providers

• A HoMedi doctor who is treating you (one with a completed, ongoing, or upcoming confirmed visit with you) can ask, through ABDM, for records that other providers hold about you. The request appears in your ABHA/PHR app with the doctor's name and registration number. You decide whether to approve it, narrow it, or deny it. A request can cover at most 180 days of records and must state a date by which the records are to be erased.

• Records you approve are sent to us encrypted, decrypted on our servers, and stored separately from your HoMedi visit records, together with the name of the provider they came from and the consent they were received under. They are visible only to the HoMedi doctor who asked for them, and only while your consent is valid.

• We delete these records as soon as you revoke the consent or it expires, and in any case by the erase date in the consent; an automatic check runs every hour to enforce this.

5.4 Scan and Share

• If you scan a HoMedi QR code with your ABHA/PHR app, ABDM sends us the name, gender, date of birth, mobile number, and ABHA address from your ABHA profile so we can register you and issue you a token for that visit. We store these details encrypted, and match them to your HoMedi account where one exists.

5.5 Who receives data under ABDM

• The National Health Authority, which operates the ABDM gateway and consent manager: it receives your ABHA address, the visit references and record types we register, your consent artefacts, and the encrypted data you ask us to pass to ABDM when creating or linking an ABHA. The NHA acts as an independent authority under the ABDM policies, not as our processor.

• Other healthcare providers registered with ABDM that you name in a consent artefact: they receive only the records, record types, and period that your consent covers, directly from us, encrypted.

5.6 Withdrawing consent and unlinking

• In your ABHA/PHR app: you can revoke any consent you have given at any time. ABDM notifies us; we then stop sharing under that consent and delete any records we received under it (Section 5.3).

• In HoMedi: you can unlink your ABHA at any time in Settings. We then delete the ABHA number and ABHA address we hold, end your ABDM session on our systems, and stop linking new visits or sharing records through ABDM. Unlinking in HoMedi does not change your ABHA record with ABDM, and records already linked to your ABHA remain visible in your ABHA/PHR app under ABDM's rules.

• If you deactivate your ABHA address with ABDM, we mark all visits linked under it as unlinked and stop sharing.

• You may also write to the contacts in Section 12 for help with any of the above.

5.7 Retention and account deletion

• Your ABHA number and ABHA address are kept until you unlink your ABHA or delete your account. When your account is deleted, they are removed along with your other personal data (Section 8), and no further records are linked or shared through ABDM.

• Records received from other providers are kept only as described in Section 5.3.

• The visit records, prescriptions, and reports created on HoMedi remain subject to the medical-record retention period in Section 8, whether or not they were shared through ABDM.

6. Sharing of Personal Data

6.1 With your provider

When a booking is confirmed, the attending doctor, dentist, or nurse receives the information needed to deliver the visit: patient name, age-relevant details, visit address, appointment details, and information you choose to share. Providers are independent professionals bound by professional secrecy, by the DPDPA, and by platform terms restricting use of your data to your care. For an ECG booking, the provider records the ECG on their own device using the Spandan software described in Section 6.3.

Records storage as a technology service: we store the visit records and prescriptions generated on the Platform on the basis of your consent, and make them available to your provider — including providers who do not maintain clinic premises of their own — solely for your care and their legal record-keeping obligations. Providers remain independent professionals: this storage does not make them our employees, and their access to your records is limited to your visits and recorded in our audit trail.

6.2 With your caregiver / for your dependent

A caregiver you (or your dependent, via OTP) have authorised can book visits and, only where the permission level allows, view the dependent's visit records and prescriptions. Caregiver links can be revoked at any time.

6.3 With service providers (Data Processors)

Processors act under contract, on our instructions, with confidentiality and security obligations, and may not use your data for their own purposes.

ECG data and Sunfox (Spandan): when you book an ECG, the provider records it with a Spandan Pro device and the Spandan software on the provider's phone. To record and interpret the ECG, the following is processed by the Spandan software and sent to Sunfox's servers:

• the ECG signal (waveform) and measurements derived from it;

• your first and last name, age, gender, height, and weight; and

• a visit reference that identifies the booking. We do not share your HoMedi account ID or your phone number with Sunfox.

Sunfox uses this data to generate the preliminary ECG report and, where an interpretation by a Spandan cardiologist is requested, to have the ECG interpreted by a qualified cardiologist engaged by Sunfox. The reports are returned to HoMedi and stored in your HoMedi records. Sunfox acts as our service provider (Data Processor) for the technology; its cardiologists act as healthcare professionals in interpreting your ECG. As informed to us by Sunfox, this data is processed in India.

6.4 With government and others

• ABDM / National Health Authority, and other healthcare providers registered with ABDM: only if you create or link an ABHA, use Scan and Share, or give consent in your ABHA/PHR app, and only as described in Section 5.

• Legal: we may disclose personal data where required by law, court order, or to state instrumentalities as permitted under the DPDPA, and to protect the safety of users and providers.

• Corporate events: in a merger, acquisition, or reorganisation, data may be transferred to a successor bound by this Policy and the DPDPA, with notice to you.

We do not sell personal data and we do not share it with advertisers.

7. Data Residency and Security

• All personal data is stored in India (AWS Mumbai region, ap-south-1). ECG data sent to Sunfox is, as informed to us by Sunfox, processed in India (Section 6.3). We will comply with any restrictions notified by the Central Government on cross-border transfer of personal data, including any applicable to Significant Data Fiduciaries.

• Sensitive fields — including your phone number, name, date of birth, email, ABHA number, and ABHA address — are encrypted at the field level in our database; data in transit is protected by TLS. Records exchanged through ABDM are additionally encrypted end to end using the ABDM key-exchange standard.

• Access to production data is role-restricted and logged in an append-only audit trail; audit archives are written to tamper-evident (write-once) storage.

• Health records and prescriptions are stored in access-controlled storage; prescription documents are delivered through authenticated, time-limited links.

• Access to masked-call recordings is restricted to staff who need them to handle a complaint, grievance, safety incident, or legal requirement.

• Application logs never contain names, phone numbers, health data, or OTPs — only internal identifiers.

• OTP-based login is rate-limited; sessions use short-lived signed tokens that can be revoked on logout.

8. Data Retention and Erasure

• We retain personal data only as long as necessary for the purposes stated, and then delete or anonymise it.

• Medical records: visit records, prescriptions, and ECG reports (both the preliminary report and the interpreted report) are retained for the period required of medical records under applicable law and professional regulations, and in any case for at least three years from the date of the visit, notwithstanding account deletion.

• ABHA data: your ABHA number and ABHA address are deleted when you unlink your ABHA in Settings or when your account is deleted (Section 5.7).

• Records received through ABDM: records fetched from other providers with your consent are deleted when you revoke that consent or it expires, and in any case by the erase date stated in the consent (Section 5.3).

• Call recordings and call records: recordings of masked calls, and the related call records, are kept for 90 days from the date of the call and are then deleted. If, within that period, a recording is needed to resolve a complaint or grievance, to address a safety incident, or to meet a legal requirement relating to the visit, it is kept until that matter is closed, and then deleted.

• Booking-check data: hashed device identifiers, visit-address hashes, and related booking-check records are kept only for as long as needed to prevent fake or abusive bookings and to review accounts, and then deleted or anonymised.

• Account inactivity: in line with the DPDP Rules, if you neither use your account nor exercise your rights for the period prescribed under the DPDP Rules, we will erase your personal data, giving you at least 48 hours' prior notice to enable you to retain your account.

• Erasure requests: when you request erasure (Section 9), we erase or anonymise your personal data and cause our processors to do the same, except where retention is required by law (for example medical-record, tax, or audit obligations) — in which case data is retained only for that purpose and then erased. Deletion is implemented so that erased records cannot be restored to active use.

• Audit logs are retained for the period required to demonstrate compliance and investigate security incidents, and at least the periods prescribed under the DPDP Rules, then deleted.

9. Your Rights as a Data Principal

Under the DPDPA you have the following rights, exercisable free of charge through Settings → Privacy & Data or the contacts in Section 12:

• Right to access: obtain a summary of your personal data being processed, the processing activities, and the identities of persons with whom it has been shared.

• Right to correction and completion: have inaccurate or incomplete data corrected or updated.

• Right to erasure: have your personal data erased, subject to legally required retention (Section 8).

• Right of grievance redressal: raise a grievance with our Grievance Officer / Data Protection Officer and receive a response within the prescribed time.

• Right to nominate: nominate a person who may exercise your rights in the event of your death or incapacity — particularly important for health records.

• Right to withdraw consent at any time (Section 4).

We will verify your identity (via your registered phone number) before acting on a request. If you are not satisfied with our response, you may approach the Data Protection Board of India in the manner prescribed under the DPDPA.

10. Children and Persons Under Guardianship

• The Platform is intended for use by adults (18+). A person under 18 cannot hold their own account; their care is arranged through a parent or lawful guardian using the caregiver facility.

• Before processing a minor's personal data we obtain verifiable consent of the parent or lawful guardian in accordance with the DPDPA and DPDP Rules. The same applies to persons with disability who have a lawful guardian.

• We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Processing of children's data is limited to the delivery of the booked healthcare service and related record-keeping, consistent with exemptions available for health services under the DPDP Rules.

11. Personal Data Breach

In the event of a personal data breach affecting you, we will notify you without delay through your registered communication channel, describing the nature of the breach, its likely consequences, the mitigation measures taken, and the steps you should take to protect yourself. We will also notify the Data Protection Board of India in the form and within the timelines prescribed by the DPDP Rules (initial intimation without delay, followed by a detailed report within 72 hours).

12. Grievance Officer / Data Protection Officer

• Grievance Officer / DPO: Mr.Manoj Kumar, Director

• Email: dpo@homedi.in | Address: 4-12-927/1, Plot No. E1, RD-1, Portion C, Auto Sai Nagar Colony, Vanasthalipuram, Hyderabad, Rangareddy District, Telangana – 500070 | In-app: Settings → Help & Grievances

We acknowledge data-protection grievances within 48 hours and respond within the timelines prescribed under the DPDPA and DPDP Rules, and in any case within 30 days. If we are notified as a Significant Data Fiduciary, we will appoint a Data Protection Officer based in India who will be the point of contact for you and the Data Protection Board.

If your grievance concerns the handling of your health data under ABDM and you are not satisfied with our response, you may also escalate it through the ABDM grievance redressal mechanism operated by the National Health Authority.

13. Cookies, SDKs, and Analytics

The HoMedi app uses only the third-party SDKs listed in Section 6.3 (push notifications, optional Google sign-in, and device-integrity checks). The Spandan ECG software runs on the provider's device, in the HoMedi provider app; it is not part of the patient app. We do not embed advertising or cross-app tracking SDKs. Any future analytics will be configured without personal identifiers or will be subject to fresh notice and consent.

Any HoMedi website we operate may use strictly necessary cookies for session management and security. We do not use advertising cookies. You can control cookies through your browser settings; blocking strictly necessary cookies may limit site functionality.

The public tools on our website, Know Your Doctor and Know Your Blood Bank, can be used without an account or sign-in. Know Your Doctor checks a doctor's or nurse's registration against public registers, and Know Your Blood Bank shows blood stock as published by licensed blood centres on the Government's e-RaktKosh portal. These tools are informational only.

13.1 Keeping your information up to date

You can review and update your profile information at any time in the app (Profile and Settings). If you notice any discrepancy you cannot correct in-app, contact support@homedi.in or the Grievance Officer and we will update our records.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified in the app or by SMS/notification before they take effect, with the "Last Updated" date revised. Where a change involves new purposes of processing, we will seek your consent as required by the DPDPA.

15. Contact

NeXora Health Systems Private Limited, 4-12-927/1, Plot No. E1, RD-1, Portion C, Auto Sai Nagar Colony, Vanasthalipuram, Hyderabad, Rangareddy District, Telangana – 500070 (registered office). For privacy matters: dpo@homedi.in For general support: support@homedi.in