Privacy Policy

How WellSathi collects, uses, and protects your personal data.

Version v1.1Effective: October 10, 2026WellSathi Technologies Pvt. Ltd.

1. Definitions

The following terms have the meanings given below throughout this Privacy Policy:

"Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the DPDP Act, 2023.

"Sensitive Personal Data or Information" ("SPDI") means personal data as defined under Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and includes passwords, financial information, physical or mental health conditions, medical records, biometric data, and sexual orientation. Health related data collected on our Platform qualifies as SPDI.

"Data Principal" means you the individual to whom personal data relates as defined under Section 2(j) of the DPDP Act.

"Data Fiduciary" means WellSathi, which alone or in conjunction with others determines the purpose and means of processing personal data, as defined under Section 2(i) of the DPDP Act.

"Data Processor" means any person who processes personal data on behalf of a Data Fiduciary, as defined under Section 2(k) of the DPDP Act.

"Significant Data Fiduciary" means a Data Fiduciary notified as such by the Central Government under Section 10 of the DPDP Act, on the basis of the volume and sensitivity of personal data processed. WellSathi may be notified as a Significant Data Fiduciary given the nature of health data it handles, in which case additional obligations described in Section 13 will apply.

"Consent Manager" means a registered entity through whom a Data Principal may give, manage, review, or withdraw consent, as provided under Section 2(g) of the DPDP Act.

"Data Protection Board" means the Data Protection Board of India established under Section 18 of the DPDP Act.

"Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, and deletion.

2. Information We Collect

We collect only the information that is necessary for the specific purpose for which it is collected (principle of data minimisation). We do not collect more data than is required.

2.1 Information You Provide Directly

Identity and Contact Data: Full name, email address, mobile phone number, and date of birth, collected at registration.

Health and Medical Data (SPDI): Gender, stated symptoms, medical history, current medications, allergies, and health preferences shared when booking an appointment or using teleconsultation features. This is Sensitive Personal Data or Information under the SPDI Rules and is collected only upon your explicit, specific, and informed consent, obtained through a separate opt-in at the time of collection.

Payment Data: Billing details submitted to complete transactions. These are processed by our third-party payment gateway (Cashfree Payments for patient bookings (certified under PCI-DSS Level 1 standards) and PayU for clinic subscriptions). We do not store full card numbers, CVV codes, UPI PINs, or net banking credentials on our systems.

Identity Documents and Medical Records: Government issued identification documents and medical records or reports, if you choose to upload them voluntarily. Upload of such documents is strictly optional and constitutes your consent to their storage for the purpose of facilitating the specific healthcare service.

User Generated Content: Reviews, star ratings, and textual feedback submitted about healthcare providers. This information may be displayed publicly on the Platform.

Support Communications: Messages, attachments, and other content you send us through our chat function, email, or support ticket system.

2.2 Information Collected Automatically

Device and Technical Data: IP address, browser type and version, operating system, device identifiers (IMEI, IDFA/GAID where accessible), screen resolution, and referring URLs.

Usage Data: Pages and features accessed, search queries within the Platform, click events, scroll depth, session duration, and navigation paths. This data is collected through cookies and similar technologies described in Section 11.

Location Data: City or region level inferred from your IP address. Precise GPS location is collected only if you grant explicit permission through your device operating system settings. You may revoke this permission at any time from your device settings; doing so will not affect core booking functionality.

Diagnostic and Crash Data: Error logs and crash reports from our mobile applications, used solely for identifying and fixing technical issues.

2.3 Information Received from Third Parties

OAuth Authentication Data: If you log in using Google or Apple, we receive the data fields that you authorise those providers to share (typically name and email address). We do not receive your password for those services.

Healthcare Provider Data: Clinic registration details, doctor qualifications, NMC registration numbers, specialisations, and availability schedules, sourced from our partner institutions . Healthcare provider information is obtained from partner institutions and publicly available sources. While we undertake reasonable checks, WellSathi does not guarantee the accuracy, completeness, or current validity of such information.

Social Media Data: If you voluntarily connect a social media account, we receive only the profile data you authorise. You may disconnect at any time from your account settings.

3. Legal Basis for Processing Personal Data

The DPDP Act, 2023 does not replicate the GDPR's six ground framework. Under Indian law, personal data may be processed only on the basis of (a) your consent (Section 6, DPDP Act), or (b) one of the "legitimate uses" specified under Section 7 of the DPDP Act. We process your data on the following bases:

3.1 Consent (Section 6, DPDP Act)

We rely on your consent for:

Processing your health and medical information (SPDI) for the purpose of booking appointments or facilitating teleconsultations.

Sending promotional communications, health tips, or newsletters.

Any processing of personal data that goes beyond what is strictly necessary to provide the core booking service.

Consent on this Platform is always:

(i) free — not a condition for accessing basic services;

(ii) specific — obtained separately for each distinct purpose;

(iii) informed — accompanied by a clear and plain-language explanation;

(iv) unambiguous — provided through explicit opt-in action; and

(v) withdrawable at any time without affecting prior lawful processing.

3.2 Legitimate Uses (Section 7, DPDP Act)

We may process personal data without consent only where such processing falls within the specific categories of legitimate use permitted under Section 7 of the DPDP Act. We do not rely on implied consent or expand these categories beyond what is expressly allowed by law.:

Legal Obligation and State Functions (Section 7(a)/(b)): To comply with obligations imposed by Indian law, court orders, orders of regulatory authorities, or directions of the Data Protection Board.

Medical Emergency (Section 7(d)): To respond to a medical emergency threatening the life or immediate safety of you or another person, where consent cannot feasibly be obtained.

Public Health (Section 7(e)): For activities related to the prevention of, or response to, a public health emergency, as may be notified by competent authority.

Employment Related Processing (Section 7(f)): For processing the personal data of employees or contractors of WellSathi to the extent necessary for employment or service delivery purposes. This basis does not apply to Platform users.

We do not rely on "legitimate interests" or "contractual necessity" as standalone legal bases, as these grounds do not exist under the DPDP Act, 2023. Where our processing of your data is necessary to deliver the service you have requested, such processing is governed either by your consent or by the legitimate uses listed above. SPDI under the SPDI Rules, 2011 requires your prior written consent; we obtain this through explicit digital opt-in, which is legally equivalent under Rule 5(3) of the SPDI Rules.

4. Purposes of Processing

We process your personal data only for the purposes listed below. We do not repurpose your data for any use incompatible with the purpose for which it was originally collected. If we intend to use your data for a new purpose, we will notify you and, where required, seek fresh consent.

Service Delivery: To match you with relevant clinics and doctors, process appointment bookings, send booking confirmations, appointment reminders, and follow up notifications, and to facilitate teleconsultations where applicable. Legal basis: consent (for health data);

Account Management: To create, maintain, and secure your user account; verify your identity; and personalise your health profile and dashboard. Legal basis: consent.

Transactional Communications: To send OTPs, booking receipts, payment confirmations, and responses to your support queries. These communications are necessary for service delivery. You cannot opt out of transactional messages while your account is active. Legal basis: consent, or legitimate use strictly as permitted under Section 7 of the Digital Personal Data Protection Act, 2023.

Platform Analytics and Improvement: To analyse aggregated and anonymised usage data to understand user behaviour, fix bugs, conduct A/B testing, and develop new features. Individual user profiles are not shared externally for this purpose. Legal basis: consent (for cookie based analytics).

Healthcare Provider Verification: To verify the qualifications, NMC/State Medical Council registration, and clinic registration of healthcare providers listed on our Platform, in compliance with the Telemedicine Practice Guidelines, 2020. Legal basis: legal obligation.

Fraud Prevention and Platform Security: To detect and prevent fraudulent bookings, account takeovers, and abuse of the Platform. Legal basis: legitimate use (Section 7) and legal obligation.

Marketing and Promotional Communications: To send you offers, health tips, and newsletters. Legal basis: your explicit prior consent. Withdrawal of this consent does not affect any other services.

Legal and Regulatory Compliance: To comply with the DPDP Act, the IT Act, 2000, the SPDI Rules, the Clinical Establishments Act, 2010, the National Medical Commission Act, 2019, the Telemedicine Practice Guidelines, 2020, and any other applicable Indian law. Legal basis: legal obligation (Section 7(a)/(b), DPDP Act).

Automated Processing: Where we use algorithms to suggest doctors or clinics based on your stated symptoms and location, such suggestions are not binding clinical decisions and are reviewed by you before any booking is confirmed. We do not make automated decisions that produce legal effects or significantly affect your health outcomes without human oversight. Legal basis: consent.

5. Sharing of Your Personal Data

We do not sell, rent, trade, or otherwise commercially exploit your personal data. We share data only in the following strictly limited circumstances:

With Your Booked Healthcare Provider: Your name, contact number, appointment details, stated symptoms, and any medical notes you choose to share are disclosed to the specific clinic or doctor you book with. This disclosure is limited to what is necessary for the provision of the healthcare service. The healthcare provider is an independent data controller for data processed in connection with your clinical care and is bound by applicable medical ethics, the SPDI Rules, and relevant healthcare regulations.

With Payment Processors: Transaction data is shared with our payment gateway partners (Cashfree Payments India Private Limited for patient bookings and PayU Payments Private Limited for clinic subscriptions) solely to process your payment. Both Cashfree Payments and PayU are PCI-DSS Level 1 certified. We do not share your health data with any payment processor.

With Cloud and Technology Service Providers: We use vetted subprocessors for hosting, database management, analytics, email delivery, and push notifications. All subprocessors are engaged under written Data Processing Agreements that:

(i) restrict processing to our documented instructions;

(ii) prohibit subprocessing without our prior written consent;

(iii) require equivalent security standards; and

(iv) obligate prompt notification of any data breach.

With Legal or Regulatory Authorities: We will disclose personal data to a court, government authority, law enforcement agency, or regulatory body only where we receive a valid legal order or statutory direction, or where disclosure is necessary to prevent imminent harm to a person's life or safety. We will, to the extent permitted by law, notify you before complying with any such order.

In a Business Transfer: If WellSathi undergoes a merger, acquisition, demerger, or sale of material assets, your personal data may be transferred to the successor entity as part of that transaction. We will:

(i) provide you at least 30 days' prior written notice via email and a prominent in app notice;

(ii) ensure the successor entity is bound by this Privacy Policy or a materially equivalent policy; and

(iii) offer you the opportunity to delete your account before the transfer is completed, subject to overriding legal retention requirements.

Aggregated and Anonymised Statistics: We may publish or share statistical reports derived from Platform data. Such reports are fully anonymised and cannot be used, directly or indirectly, to identify any individual.

All third-party recipients of personal data are required, by contract, to:

maintain the confidentiality and security of your data;

use it only for the disclosed purpose;

comply with applicable Indian data protection law; and

promptly notify us of any security incident or breach involving your data.

6. Data Retention

We retain personal data only for the period necessary to fulfil the purpose for which it was collected, or as required by applicable law, whichever period is longer. The following retention schedules apply:

Data Category	Retention Period and Legal Basis
Account and Profile Data	Duration of active account + 3 years after deletion. Basis: Limitation Act, 1963 (3year limitation period for contract based civil claims).
Health Data and Medical Records (SPDI)	7 years from date of last appointment. Basis: Medical Records Standards under the Clinical Establishments Act, 2010 and applicable State health regulations.
Transaction and Payment Records	8 years from transaction date. Basis: Section 128, Companies Act, 2013 (books of account); Income Tax Act, 1961.
Teleconsultation Records	7 years from date of consultation. Basis: Telemedicine Practice Guidelines, 2020.
Cookie and Analytics Data	Up to 12 months. See Section 11.
Consent Records	Duration of active account + 7 years after deletion or consent withdrawal. Basis: evidentiary retention for regulatory enforcement; limitation period under applicable law.
Support Correspondence	3 years from closure of support ticket. Basis: Limitation Act, 1963.
Security and Audit Logs	2 years. Basis: IT Act, 2000 and applicable CERT In directions.

Data Category

Retention Period and Legal Basis

Account and Profile Data

Duration of active account + 3 years after deletion. Basis: Limitation Act, 1963 (3year limitation period for contract based civil claims).

Health Data and Medical Records (SPDI)

7 years from date of last appointment. Basis: Medical Records Standards under the Clinical Establishments Act, 2010 and applicable State health regulations.

Transaction and Payment Records

8 years from transaction date. Basis: Section 128, Companies Act, 2013 (books of account); Income Tax Act, 1961.

Teleconsultation Records

7 years from date of consultation. Basis: Telemedicine Practice Guidelines, 2020.

Cookie and Analytics Data

Up to 12 months. See Section 11.

Consent Records

Duration of active account + 7 years after deletion or consent withdrawal. Basis: evidentiary retention for regulatory enforcement; limitation period under applicable law.

Support Correspondence

3 years from closure of support ticket. Basis: Limitation Act, 1963.

Security and Audit Logs

2 years. Basis: IT Act, 2000 and applicable CERT In directions.

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised using industry standard methods.

Account Deletion & 14-Day Revocable Grace Period:

You may request account deletion at any time directly through your account dashboard or at /delete-account.

14-Day Grace Window: Your account is placed into a pending_deletion status for 14 calendar days. During this period, all public listings and active bookings are suspended, but you may sign in at any time to cancel the deletion request.

Automated Cryptographic Anonymization: Upon expiration of the 14 days, our automated DPDP compliance service permanently deactivates the account and cryptographically anonymizes all PII. The patient name is permanently redacted to "Deleted Patient", phone numbers and addresses are wiped, and profile assets are deleted from storage.

Statutory Retention Lock: In compliance with the Clinical Establishments Act, 2010 and NMC regulations, clinical consultation records and prescriptions are legally mandated to be retained for 3 years, and financial transaction records for 8 years under the Companies Act and Income Tax Act. Such records cannot be prematurely erased.

Multilingual Notice Access:

In accordance with Section 6(3) of the Digital Personal Data Protection Act, 2023, this notice is available in English and may be requested in any of the 22 languages specified in the Eighth Schedule to the Constitution of India by contacting [email protected].

7. Data Security

We are required under Section 43A of the Information Technology Act, 2000, Rule 8 of the SPDI Rules, and Section 8(5) of the DPDP Act to implement reasonable security practices and procedures. We implement the following measures:

Encryption in Transit: All data exchanged between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). Unencrypted HTTP connections are rejected.

Encryption at Rest: Sensitive Personal Data stored on our servers is encrypted using AES-256. Database-level encryption is applied to all tables containing health or financial data.

Access Controls: Personal data is accessible only to authorised personnel on a strict need to know basis, enforced through rolebased access controls (RBAC), multi-factor authentication for administrative access, and audit logging of all access events.

Vendor Security: All Data Processors are contractually required to implement security standards at least equivalent to our own and to undergo periodic security assessments.

Vulnerability Management: We conduct regular automated vulnerability scans and periodic penetration tests by qualified third-party security firms. Critical vulnerabilities are remediated within 72 hours of identification.

Incident Response: We maintain a formal incident response plan. In the event of a personal data breach, we will:

(i) notify the Data Protection Board of India in the manner and within the timeline prescribed under the DPDP Act and any rules made thereunder; and

(ii) notify affected Data Principals in the prescribed manner without undue delay, describing the nature of the breach, the data categories involved, likely consequences, and the remediation steps taken.

Employee Obligations: All employees with access to personal data are bound by confidentiality obligations and receive mandatory data protection training upon joining and annually thereafter.

Despite these measures, no system of data transmission or storage is completely secure. We cannot guarantee absolute security. If you suspect any unauthorised access to your account, please contact us immediately at [email protected].

8. Your Rights as a Data Principal

The DPDP Act, 2023 and the SPDI Rules, 2011 confer the following rights on you. We will not charge a fee for exercising these rights unless a request is manifestly repetitive or unfounded, in which case we will inform you of the fee before proceeding.

8.1 Right to Access Information (Section 11, DPDP Act)

You have the right to obtain from us:

A summary of the personal data we hold about you and the purposes for which it is being processed.

Identification of all Data Processors and the third parties with whom your personal data has been shared, along with the purpose and legal basis for each disclosure.

Any other information related to your personal data or our processing activities, as may be prescribed under the DPDP Act.

8.2 Right to Correction and Erasure (Section 12, DPDP Act)

You have the right to:

Correct personal data that is inaccurate or incomplete. We will update your records without unreasonable delay upon verification.

Erase personal data that is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Where erasure is not possible due to a legal obligation, we will restrict processing of the data to only what is required by law and will inform you accordingly.

Note: The DPDP Act does not currently provide a standalone "right to data portability" equivalent to the GDPR. We aspire to provide your data in a machine readable format (JSON or CSV) on request and will do so on a best efforts basis, but this is not a legally mandated right under current Indian law.

8.3 Right to Withdraw Consent (Section 6(4), DPDP Act)

You may withdraw your consent to any consent based processing at any time, without any penalty to your access to core services. Withdrawal is effective prospectively and does not affect the lawfulness of processing conducted prior to withdrawal. Withdrawal of consent takes effect within seven (7) business days of receipt of a valid withdrawal request. Within this period, we will cease all processing activities for which consent was the sole legal basis, delete or anonymise any data that has no other legal basis for retention, and confirm completion of withdrawal to you in writing (e-mail). Processing already completed before your withdrawal remains lawful. Where a legal retention obligation prevents immediate deletion, we will restrict processing to the minimum required by law and notify you of the specific obligation and its expiry date.

To withdraw consent:

For health data and medical records: Contact [email protected] with the specific data and processing purpose for which you are withdrawing consent.

For marketing communications: Use the unsubscribe link in any promotional email, or update your notification preferences in your account settings.

For analytics cookies: Update your preferences through the cookie consent centre (accessible from the Platform footer).

8.4 Right to Nominate (Section 14, DPDP Act)

You may nominate another individual to exercise your rights under the DPDP Act on your behalf in the event of your death or incapacity. To register a nominee, submit a written request to [email protected].

8.5 Right to Grievance Redressal (Section 13, DPDP Act)

You have the right to lodge a complaint with our Grievance Officer (see Section 14). If your complaint is not resolved to your satisfaction within 30 days of acknowledgement, you may escalate to the Data Protection Board of India once it is constituted and operational.

8.6 How to Exercise Your Rights

Submit a written request to [email protected], clearly identifying:

(i) the right you wish to exercise;

(ii) the personal data concerned; and

(iii) your preferred mode of response.

We will acknowledge your request within 72 hours and provide a substantive response within 30 days.

We may ask you to verify your identity before processing the request. Where a request is refused, we will provide the reason in writing.

9. Children's Privacy

Our Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors without the consent of their parent or legal guardian. All users must confirm during account registration that they are at least 18 years old.

Guardian Facilitated Bookings:

Where a parent or legal guardian makes a booking on behalf of a minor, the guardian's consent to this Privacy Policy covers the processing of the minor's health data for the purpose of that booking.

The guardian is responsible for the accuracy of the information provided and for ensuring the minor's interests are protected. Data relating to the minor will be stored in connection with the guardian's account.

If we discover that personal data of a minor has been collected without valid parental or guardian consent, we will delete it promptly.

Parents or guardians who believe their child's data has been collected in error should contact [email protected] immediately.

10. Cross Border Transfer of Personal Data

Your personal data is primarily stored and processed on servers located in India. We prioritise storage of health data within India wherever technically and commercially feasible.

Where we transfer personal data outside India for example, to subprocessors using cloud infrastructure in other jurisdictions we do so only in compliance with Section 16 of the DPDP Act, 2023 and any rules or orders made thereunder by the Central Government identifying permissible countries or territories.

Where the Central Government has not yet specified permissible territories for a particular transfer, we apply standard contractual protections and ensure the recipient country provides adequate data protection.

We do not transfer health data or medical records outside India without your explicit consent, except where required to deliver a specific cross-border teleconsultation service that you have requested.

11. Significant Data Fiduciary Obligations

If the Central Government, by notification under Section 10 of the DPDP Act, designates WellSathi as a Significant Data Fiduciary based on the volume or sensitivity of personal data we process, we will comply with the following additional obligations and will notify you of the designation:

Appointment of a Data Protection Officer (DPO): We will appoint a DPO, who will be accountable to our Board of Directors, represent us before the Data Protection Board, and serve as the point of contact for Data Principals on all data protection matters.

Independent Data Audit: We will engage a qualified independent data auditor annually to assess our compliance with the DPDP Act and applicable rules.

Data Protection Impact Assessment (DPIA): Before deploying any new processing activity or technology that is likely to result in a high risk to the rights of Data Principals (including new AI or algorithmic features), we will conduct and document a DPIA.

Algorithmic Accountability: We will implement measures to ensure that our recommendation algorithms do not produce biased or discriminatory outcomes and will make a summary of such measures available to Data Principals on request.

13. ThirdParty Websites and Integrated Services

Our Platform may contain links to, or integrations with, third-party websites and services (including partner clinic portals, insurance aggregators, and pharmacy delivery platforms).

WellSathi has no control over the data practices of these third parties. We are not responsible for their privacy policies, content, or security.

We encourage you to read the privacy policy of every thirdparty service you access through our Platform before providing any personal data to it.

Third-party services integrated directly into our Platform such as Cashfree Payments and PayU for transactions and Google/Apple for authentication operate under their own privacy policies.

We select third-party service providers based on commercially reasonable diligence; however, we are not responsible for their independent data practices.

14. Amendments to This Privacy Policy

We may update this Privacy Policy from time to time. The revised Policy will be posted on our Platform with a new "Last Updated" date.

We will categorise changes as follows:

Material Changes Requiring Fresh Consent: Changes that introduce a new category of personal data to be collected; expand the purposes for which existing data may be used; add new categories of third parties with whom data is shared; or reduce your rights.

For such changes, we will:

(i) notify you by email to your registered address at least 14 days before the change takes effect;

(ii) display a prominent inapp notice; and

(iii) seek your explicit fresh consent before the change takes effect.

If you do not provide consent, your existing data will continue to be processed under the previous version of this Policy, and you may request deletion of your account.

Non Material Changes: Clarifications, typographical corrections, updates to contact details, or restructuring of the document without substantive change to your rights or our practices.

We will display a notice on the Platform and update the "Last Updated" date.

Continued use of the Platform following such changes constitutes acknowledgement of the revised Policy.

15. Grievance Officer and Contact Details

In accordance with Section 13 of the DPDP Act, 2023 and Rule 5(9) of the SPDI Rules, 2011, we have appointed a Grievance Officer to address complaints and queries relating to personal data processing.

Legal Entity	WellSathi Technologies Pvt. Ltd. (GSTIN: 20TAHPS6203P1Z1)
Grievance Officer Name	Designated Officer, WellSathi Legal & Compliance Department
Designation	Grievance Redressal & Data Protection Officer
Privacy / Data Requests	[email protected]
General Support	[email protected]
Registered Address	Khamarbendi, Chas, Bokaro, Jharkhand – 827013, India
Response Timeframe	Acknowledgement within 72 hours; substantive response within 30 days of receipt
Escalation Data Protection Board	If your complaint is not resolved within 30 days, you may escalate to the Data Protection Board of India at www.dpbi.gov.in once it becomes operational

Governing Law and Jurisdiction:

This Privacy Policy is governed by the laws of the Republic of India.

Any disputes arising out of or in connection with this Policy that cannot be resolved through our internal grievance mechanism shall be subject to the jurisdiction of the competent courts located in Delhi, India.

Regulatory Authority:

WellSathi's processing of personal data is subject to the oversight of the Data Protection Board of India (under the DPDP Act) and the Ministry of Electronics and Information Technology (under the IT Act, 2000 and SPDI Rules).

WellSathi Technologies Pvt. Ltd.

Registered Office: Khamarbendi, Chas, Bokaro, Jharkhand – 827013, India

GSTIN: 20TAHPS6203P1Z1

+91 8434668180 (Mon–Sat, 9:00 AM – 7:00 PM IST)

Compliance & Inquiries

General Queries: [email protected]

Grievance Redressal Officer: [email protected]

Privacy & Data Protection: [email protected]

Account Deletion & Data Removal Policy