HealthFora Pvt Ltd operates the HealthFora website and mobile applications (the "Platform"), connecting patients with doctors, diagnostic labs, and pharmacies. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
By using HealthFora, you agree to the collection and use of information as described here. If you do not agree, please do not use the Platform.
1. Definitions and Scope
- For this Policy, "personal data" means any data about an individual who is identifiable by or in relation to such data. "Processing" includes collection, recording, storage, use, sharing, analysis, disclosure, retention and deletion of personal data. "Data Principal" means the individual to whom the personal data relates. "Data Fiduciary" has the meaning assigned under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), as applicable.
- This Policy applies to personal data processed through the Platform, including information provided directly by patients, doctors, diagnostic laboratories and pharmacies, information generated through use of the Platform, and information received from service providers or other lawful sources.
2. Information We Collect
- Account and Identification Information. Your mobile number (patients) or email address (doctors, labs, pharmacies) for OTP-based sign-in, your name, and profile details you provide.
- Health-related Information. Symptoms you describe, consultation notes, prescriptions issued to you, lab reports and test results, medical history you choose to share, and any documents you upload for AI-assisted report analysis. This is sensitive personal data and is handled with additional safeguards described in Section 4.
- Consultation Information. Video/audio consultation metadata (timing, duration, participants) and, where applicable, call-quality diagnostics. We do not, by default, permanently record consultation video/audio; if this ever changes, we will disclose it separately and seek consent.
- Transaction Information. Consultation fees, lab/pharmacy order details, and payment metadata. Full card/bank details are processed by our payment partner (Razorpay) and are not stored on HealthFora's own servers except where expressly stated and lawfully required.
- Device, Technical and Usage Information. IP address, device type, browser, app version, identifiers, approximate location where enabled, log information and usage patterns (such as pages visited, features used) collected via standard analytics.
- Professional and Verification Information. Doctors, laboratories, and pharmacies. Onboarding documents (licenses, registration certificates, identity proof) submitted for verification before they may offer services on the Platform.
- Communication and Support Information. Information you provide when contacting customer support, submitting feedback, complaints, requests or exercising your data-protection rights.
3. How We Use Your Information
We process personal data only for specified and lawful purposes, including:
- To create and manage accounts and connect patients with doctors, laboratories and pharmacies.
- To facilitate consultations, diagnostic bookings, medicine orders, payments, invoices and related services.
- To maintain consultation history, prescriptions and laboratory reports so that users and authorized treating professionals can refer to them.
- To provide AI health-assistant and report-analysis functionality. Such features are intended to assist users in understanding submitted information and are not a substitute for professional medical diagnosis, treatment or emergency care.
- To send appointment reminders, order updates, service communications and, where lawfully permitted, optional marketing communications.
- To verify doctors, laboratories and pharmacies and maintain platform safety and integrity.
- To detect, prevent and investigate fraud, abuse, security incidents and misuse, and to enforce our Terms of Service.
- To comply with applicable legal, regulatory, judicial and law-enforcement requirements.
- To establish, exercise or defend legal claims and protect the rights, safety, property and legitimate interests of HealthFora, users and the public.
- Where required, to process personal data on the basis of consent, contractual necessity, compliance with a legal obligation, or another lawful ground recognized under applicable law.
We do not sell personal data or health-related data to third parties. We do not use health-related data for targeted advertising.
4. Consent
- Where consent is required, HealthFora will seek consent through a clear and distinguishable notice identifying the personal data concerned and the purpose(s) of processing. Consent may be withdrawn through the mechanism made available by HealthFora, subject to applicable law and to the consequences of withdrawal. Withdrawal will not affect processing lawfully undertaken before withdrawal.
- Where processing is necessary to provide a requested service or to comply with a legal obligation, withdrawal of optional consent may not require us to stop such necessary processing.
5. AI, Automated Tools and Health Information
- HealthFora may use AI-assisted tools to analyze documents or health information submitted by users and generate summaries, explanations or insights.
- AI-generated information may be incomplete, inaccurate or unsuitable for a particular person. Users should not rely on AI output as a diagnosis, prescription or emergency medical advice and should consult a qualified healthcare professional where appropriate.
- Health information submitted for AI functionality will be processed only for the disclosed purposes and by authorized service providers where necessary to provide the feature.
- We will implement appropriate contractual, technical and organizational safeguards for health-related information and will seek additional consent where required for any materially different use.
6. Who We Share Information With
- Doctors, laboratories or pharmacies interact with, only information reasonably necessary to provide the requested service.
- Payment processors, currently Razorpay, for payment processing and related transaction support.
- Cloud and infrastructure providers, currently Microsoft Azure, for hosting, storage and infrastructure services under contractual confidentiality and security obligations.
- Communication and technology providers, for OTPs, notifications, customer support and video-consultation functionality.
- AI or analytics service providers, where necessary to provide disclosed Platform features, subject to appropriate contractual, confidentiality and security safeguards.
- Professional advisers, auditors and insurers, where reasonably necessary for legitimate business, compliance or legal purposes and subject to appropriate confidentiality obligations.
- Government, judicial, regulatory or law-enforcement authorities, where disclosure is required or authorized by applicable law, court order or lawful process, or is necessary to protect rights, safety or property.
We do not share your identifiable health data with any third party for marketing purposes, under any circumstances.
7. Service Providers and Data Processors
We may appoint third-party service providers to process personal data on our behalf. Such providers will be permitted to process data only for authorized purposes and, where applicable, underwritten contractual obligations concerning confidentiality, security, permitted use, retention and deletion. We remain responsible for exercising appropriate oversight over processing carried out on our behalf.
8. International Data Transfers
Certain service providers or infrastructure may process or store information outside India. Where personal data is transferred outside India, HealthFora will comply with applicable requirements, government notifications, contractual safeguards and other lawful transfer mechanisms as may be applicable from time to time.
9. How We Protect Your Information
- Health records, prescriptions, and lab reports are encrypted at rest and in transit.
- Access to patient health data is restricted to the treating doctor/lab/pharmacy for that specific interaction, and to HealthFora personnel only where necessary for support, safety, or legal compliance.
- Reviews left about a doctor are published anonymously, no reviewer's name, patient ID, or appointment reference is ever exposed publicly.
- We retain data only as long as necessary to provide the service, meet legal/medical record-keeping obligations, or resolve disputes, after which it is deleted or anonymized.
No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable and industry-standard measures to protect your information.
10. Personal Data Breach and Security Incidents
If HealthFora is aware of a personal data breach, we will assess and respond to the incident in accordance with applicable law, including applicable requirements concerning containment, documentation, notification and remedial measures. Where notification is legally required, we will provide the prescribed information to the relevant authority and affected Data Principals within the applicable timelines.
11. Data Retention and Deletion
We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, provide the requested services, maintain records required by applicable law or regulation, comply with contractual or accounting obligations, prevent fraud, resolve disputes, enforce agreements, or establish, exercise or defend legal claims.
When personal data is no longer required, we will delete, anonymize or otherwise dispose of it in accordance with applicable law and our retention procedures. Requests for deletion may be subject to lawful retention requirements, including medical, financial, tax, regulatory or dispute-related obligations.
12. Your Rights and Choices
Subject to applicable law and any prescribed conditions or exceptions, you may have the right to:
- Obtain information about the personal data processed by HealthFora and seek access to such data through the prescribed mechanism.
- Request correction or updating of inaccurate, incomplete or misleading personal data.
- Request erasure of personal data where retention is no longer necessary or where otherwise permitted by law.
- Withdraw consent where processing is based on consent.
- Raise a grievance concerning the processing of your personal data.
- Nominate another individual to exercise rights in the event of your death or incapacity, where and as provided by applicable law.
- Opt out of optional marketing communications at any time. Service and transactional communications may continue where necessary.
To exercise applicable rights, contact us at support@healthfora.in. We may require reasonable information to verify your identity before acting on a request. Requests will be handled within the timelines and subject to the conditions prescribed under applicable law.
13. Children's Privacy
HealthFora is not intended for use by individuals under 18 without the involvement of a parent or guardian. A parent/guardian may create and manage bookings on behalf of a minor. Where personal data of a child is processed, HealthFora will implement age-appropriate and parent/guardian verification and other safeguards required by applicable law. HealthFora will not knowingly use children's data for targeted advertising or undertake prohibited tracking or behavioral monitoring.
14. Cookies and Similar Technologies
We use cookies, SDKs and similar technologies to keep you signed in, remember preferences, maintain security, understand Platform usage and improve services. Where required, non-essential cookies or similar technologies will be used only after obtaining the necessary consent. You may control cookies through your browser or device settings; disabling certain technologies may affect Platform functionality.
15. Third-Party Links and Services
The Platform may contain links to third-party websites, applications or services. Their privacy practices are governed by their own policies, and HealthFora is not responsible for the privacy or security practices of independent third parties. Users should review the applicable privacy notices before providing personal data to such parties.
16. Changes to This Policy
We may amend this Privacy Policy from time to time to reflect changes in our services, technology, law or regulatory requirements. Material changes will be communicated through the Platform, email or another appropriate mechanism before or when they take effect, as required by applicable law. The updated version will state its effective date.
17. Grievance Redressal and Contact
For questions, requests, complaints or concerns relating to this Privacy Policy or the processing of personal data, please contact our designated grievance/contact person at:
If you are dissatisfied with the response to your grievance, you may exercise such further rights or approach the competent authority/Data Protection Board of India, where applicable, in accordance with the procedure prescribed by law.
18. Regulatory and Legal Compliance
HealthFora intends to operate its Platform in accordance with applicable Indian laws and regulations relating to privacy, data protection, information technology, healthcare services, electronic records, consumer protection and other requirements applicable to its activities. Where a conflict arises between this Policy and a mandatory requirement of applicable law, the mandatory legal requirement will prevail to the extent of the conflict.