MediWalkers Health Private Limited · Jurisdiction: India · Website: https://www.mediwalkers.com
1. Introduction and scope
MediWalkers Health Private Limited ("MediWalkers", "we", "us" or "our") respects the privacy of individuals using our digital healthcare services. This Policy explains how we collect, use, share, secure, retain and otherwise process personal data through our website, apps, patient and doctor portals, and applicable partner and hospital-facing services.
Our offerings may include doctor appointment booking, video/audio consultations, second opinions, e-prescriptions, diagnostic bookings, pharmacy coordination, preventive health services, companion care, and hospital management software (HMS). Some offerings may be provided by independent healthcare professionals or service partners.
This Policy describes our practices; any processing requiring consent will be subject to a separate appropriate notice and consent mechanism. A person may be unable to use a requested service if data strictly necessary for that service is not provided.
2. Relevant legal framework
We aim to process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and applicable rules, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025, as their respective provisions become applicable. Sector-specific healthcare, telemedicine, medical record and professional confidentiality rules may also apply.
Where services are used outside India, additional jurisdiction-specific notices and arrangements may be necessary; this India Policy is not itself a US HIPAA notice.
3. Personal data we collect
- Account and identity data. Name, contact details, age/date of birth, address, login credentials, profile details, preferred language, emergency contacts and, when necessary and legally appropriate, identity verification information.
- Patient and clinical data. Symptoms, medical history, allergies, medicines, prescriptions, consultation notes, diagnostic results, medical documents, appointment and referral information, and healthcare preferences.
- Healthcare professional data. Qualifications, registration numbers, specialities, experience, clinic affiliation, availability, professional credentials, verification records, photos, tax and settlement information.
- Organization and partner data. Hospital/clinic details, representative contact details, business registrations, agreements, billing and support records.
- Transaction data. Booking fees, invoices, payment method category, payment confirmations, refund and settlement references. Payment providers may handle full card credentials; we do not intend to store card CVV data.
- Technical information. Device and browser information, IP address, app version, session/activity information, logs, cookie identifiers and approximate location derived from technical data. Precise location is accessed only where required for an enabled feature and permissions allow.
- Companion-care information. Pickup/service address, booking instructions, mobility assistance needs, emergency contacts, provider assignment and service status.
We collect this information when supplied through forms, uploaded documents, consultations, support communications, connected systems or authorized partners, and through normal technology operation.
4. Why we process personal data
We use data as necessary to create accounts, verify doctors and care partners, arrange appointments, enable consultations and care coordination, manage electronic prescriptions and records, facilitate diagnostics/pharmacy services, operate HMS, deliver companion care, and respond to service queries.
We also process relevant data to administer payments and refunds, issue invoices, maintain reliability, troubleshoot errors, prevent misuse, protect accounts, meet legal obligations, and manage legitimate complaints and disputes. Aggregated or de-identified information may be used for operational insights where appropriate.
Optional promotional outreach, unrelated research, and other activities requiring consent will rely on a separate lawful basis and appropriate choices. We do not sell identifiable patient medical records to advertisers or data brokers.
5. Consent, notices and withdrawal
Where consent is required by applicable law, we present a notice describing the relevant personal data and purpose and ask for the required affirmative action. Distinct choices may apply to health-record sharing, marketing, precise location, optional consultation recording, ABDM access and other optional uses.
Consent may be withdrawn by using an available platform control or emailing info@mediwalkers.com. Withdrawal does not undo earlier lawful processing, and necessary records may be kept if legally required. Certain services may not remain available without information needed to perform them.
6. Doctor–patient consultations and recordings
Consultation information is intended for the patient, the relevant practitioner and authorized parties involved in care or administration. Practitioners are responsible for their clinical advice and applicable professional duties.
MediWalkers uses Zoom Video SDK for relevant communications. Consultation recording is disabled by default. We do not treat a consultation as permission to record it. If a recording function is ever enabled for a particular session, we will give an appropriate notice and obtain any required consent, including explaining recording access and retention. Technical connection/session metadata may still be processed by relevant technology providers in accordance with their contractual roles.
7. Electronic records, prescriptions and HMS
Authorized users may access relevant clinical records and prescriptions for legitimate care purposes. Appropriate access control, authentication, logging, encryption and backup safeguards will be implemented according to the actual service design and risk.
For HMS subscriptions, the hospital or clinic may determine the purposes and means of processing patient data (as Data Fiduciary where the DPDP framework applies), and MediWalkers may act as its Data Processor. The parties’ responsibilities for instructions, security, consent, requests, retention, incidents, subcontractors and deletion must be specified in their signed service/data-processing agreements. Other arrangements may involve different roles depending on actual facts.
8. Labs, pharmacy, care providers and other partners
When you request a connected service, we may send the selected provider only the personal and health information reasonably necessary to fulfill that request, such as name, contact details, prescription/test request, visit location and order status.
Independent laboratories, pharmacies, practitioners and companion-care providers may be responsible for their own processing and legal obligations. Their own privacy notices may apply. We will assess and document specific partner-sharing arrangements, purposes, contractual duties, and complaint routes as part of partner onboarding.
9. Payment, communications and support providers
Authorized payment service providers may process transactions. We may use service vendors for email, SMS, WhatsApp, cloud hosting, communications, identity verification, security monitoring, analytics and customer support. Providers should receive only data needed for defined services under appropriate contractual terms.
We send operational messages such as booking confirmations, care updates, invoices and security notices. Marketing messages, if used, are subject to applicable consent and opt-out requirements.
10. AWS hosting, storage location and cross-border access
Our platform may use Amazon Web Services (AWS) and other approved processors for application infrastructure, data storage, logs, backup and disaster recovery. The exact AWS region(s), backup locations, subprocessor access paths and international support arrangements depend on the deployment configuration and must be documented and maintained in our internal records.
We will assess transfers and access from outside India against applicable restrictions, security controls and contractual safeguards. This Policy does not assert that all data or backups remain exclusively in India, because that depends on verified infrastructure configuration and provider operations.
11. Security
We seek to apply reasonable technical and organizational safeguards proportionate to the data risks, including appropriate encryption in transit and at rest, role-based access, authentication, logging, vulnerability management, controlled administrative access, secure backups and incident-response processes. Specific controls are implemented according to system architecture and relevant agreements.
No internet service can guarantee absolute security. Users should protect account credentials and report suspected misuse to info@mediwalkers.com.
12. Retention, backups and deletion
We retain personal data for the period needed to provide the requested service, meet applicable medical record, taxation, financial, contractual and other legal obligations, defend lawful claims, and maintain justified security records. Periods vary by record category and may differ for hospitals controlling records in HMS.
MediWalkers will maintain an approved retention schedule identifying record categories (including account records, medical records, appointments, invoices, security logs, recordings if any, and backups), retention triggers, legal requirements, responsible owners and deletion procedures. We do not state a fixed retention period in this public Policy until that schedule has been approved and verified.
When retention is no longer justified, information is erased, anonymized or disposed of securely, subject to technical backup cycles and binding legal restrictions. Where a hospital or independent provider controls a record, its retention duties may also apply.
13. Cookies, analytics and marketing preferences
We may use essential cookies and similar technologies for login, security, session continuity and performance. Optional analytics, advertising pixels or other non-essential tracking, if deployed, will be identified in a cookie notice or preference mechanism as applicable.
Before activation of non-essential technologies, we will verify the actual vendors, purpose, data flows, retention, consent requirements and opt-out options. Browser controls may block some cookies, but disabling essential cookies may affect operation.
14. Children and family accounts
If we offer services to persons under 18, appropriate parent or lawful guardian arrangements and verifiable consent will be implemented where required. We will not intentionally use children’s personal data for prohibited tracking, behavioural monitoring or targeted advertising. Family members must have appropriate authority before submitting another person’s information.
15. Privacy rights and grievance handling
Subject to the provisions of applicable law that are in force and any lawful exceptions, individuals may request information about processing, correction or completion of inaccurate information, updating, erasure, withdrawal of consent, grievance redressal and other statutory rights (including nomination where applicable).
To submit a request, email info@mediwalkers.com. We may verify identity and authorization before acting. Requests affecting clinical records may require preservation of a medically accurate audit trail or compliance with record-retention requirements. Where legally available, an individual may approach the appropriate regulator after following the required grievance procedure.
16. Security incidents
We will investigate and address suspected personal data breaches. Where applicable law requires notification to affected individuals or authorities, we will provide notifications in the prescribed manner and timeframe, describing relevant facts and protective steps.
17. Analytics, research and AI
We may use aggregated or properly de-identified service data to understand usage and improve functionality. Identifiable medical records will not be treated as available for unrelated AI training, commercial research or advertising solely because a user has accessed the platform. Any additional use will require a suitable lawful basis, safeguards and necessary notice or consent.
18. Third-party links and policy updates
External websites and independent partner services may maintain their own privacy policies; please review them when using those services. We may revise this Policy as services, vendors and laws evolve. The latest version will show its effective or last-updated date, and material changes will be communicated or separately consented to where legally required.
19. Contact and grievance officer
MEDIWALKERS HEALTH PRIVATE LIMITED
Registered office: 8-2-293/82/A/89, Flat No. 3, 3rd Floor, Jubilee Hills, Hyderabad – 500033, Telangana, India
Website: https://www.mediwalkers.com
Privacy and grievance email: info@mediwalkers.com
Grievance Officer: Abhishek Reddy Baddam
Please include enough information for us to identify your account and describe the privacy request without emailing unnecessary sensitive medical details.
20. Relationship with other terms
This Policy should be read together with applicable patient terms, doctor/partner terms, hospital/HMS agreements, consent notices, and other published service conditions. If a service requires separate consent, this Policy does not replace that consent.