Privacy Policy
This policy explains how Medicore, based in Chennai, Tamil Nadu, collects, uses, shares and protects personal data under the Digital Personal Data Protection Act, 2023, and how you can reach us with a question or a grievance.
1. Introduction & Who We Are
Medicore, based in Chennai, Tamil Nadu, India ("Medicore", "we", "us"), builds and operates the MediCore hospital management platform and the MediCore patient app. This policy explains what personal data we collect, why, how it is used and shared, and the rights you have over it under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law. It applies to visitors to our website, users of the MediCore patient app, and staff of hospitals that run on MediCore.
2. Two Roles We Play
Medicore acts in two distinct capacities, and it matters which one applies to a given piece of data. For the hospital management system itself, each hospital is the Data Fiduciary for its patients' clinical records — it decides what is collected and why — and Medicore is a Data Processor, hosting and running the software on the hospital's behalf under its instructions. For the MediCore patient app — the cross-hospital account you use to view your own records and grant or withdraw consent to each hospital — Medicore is the Data Fiduciary, because Medicore itself decides how that app collects, aggregates and protects your data. This policy covers both roles; where the distinction matters, we say so explicitly.
3. Personal Data We Collect
Depending on how you interact with us, we may collect: contact details (name, phone number, email, address) used to create and secure your account; authentication data (OTP codes, login timestamps, device/session identifiers); clinical and health data that a hospital using MediCore records about you as its patient (visit notes, prescriptions, lab and radiology results, bills, vitals) — this is held by that hospital and only shown in the patient app after you grant consent; consent and preference records (what you agreed to, when, and for which hospital); and website usage data (pages visited, general analytics) if you visit medicore.cc. We do not collect more than each feature needs to function.
4. How We Use Your Data
We use personal data to: operate the hospital management software and patient app; authenticate you and keep your account secure; show you your own records from a hospital once you have consented to that hospital sharing them with the app; send appointment, billing and security notifications you have opted into; respond to support requests and grievances; and meet legal, regulatory and audit obligations. We do not sell personal data, and we do not use patients' clinical data for advertising.
5. Legal Basis & Consent
Where a hospital records your clinical data directly (as its patient), that processing is grounded in your relationship with the hospital and its own notice to you. For the MediCore patient app specifically, before we show you any hospital's records inside the app, we ask for your itemised, informed consent to that hospital — a decision that is separate from whether the hospital itself uses MediCore. You can grant consent through an in-app approval or an OTP-verified flow, and you can withdraw it at any time from the app's Data Permissions screen; withdrawing hides that hospital's records again immediately and does not affect your treatment or delete anything from the hospital's own system.
6. Sharing Your Data
We share personal data with: the specific hospital(s) you are a patient of, strictly for your care and billing there; infrastructure and technology vendors who host our servers, storage and messaging (SMS/OTP) under contractual confidentiality obligations, and who do not use your data for their own purposes; payment processors when you pay a bill through the platform; and government or regulatory bodies where required by law. We do not currently publish a named register of every sub-processor; one is planned as part of our ongoing compliance work. We do not share data with third parties for their own marketing.
7. Data Retention
We keep personal data only for as long as it is needed for the purpose it was collected for, or as long as applicable law requires. Clinical and billing records are generally kept for the period required under Indian medical-records and tax regulations; account and consent-log data is kept for as long as your account is active plus a reasonable period afterward for audit and legal-defence purposes. Each participating hospital is separately responsible for its own statutory retention obligations for the clinical records it holds. We do not currently publish a fixed day/year retention schedule for every data category; if you need retention details for a specific record, contact us using the details below.
8. Security Measures
Every hospital's data is isolated at the database layer using PostgreSQL row-level security, so one hospital can never read another's records. All connections use encrypted transport (TLS). Passwords are stored using one-way cryptographic hashing, never in plain text. Access to staff accounts is protected by role-based permissions, and repeated failed logins trigger an automatic account cooldown. Sensitive actions — logins, edits, exports, consent grants and withdrawals — are recorded in an audit trail. We run scheduled backups with guarded restore procedures. No system is perfectly secure, and we continue to invest in this area as the platform grows.
9. Your Rights as a Data Principal
Under the DPDP Act you have the right to: obtain a summary of the personal data we hold about you and how it is processed; correct or update inaccurate or incomplete data; request erasure of data we are not otherwise required to keep; withdraw consent at any time (for the patient app, per hospital, from Data Permissions); and nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Some of these rights are available directly in the app today (consent withdrawal); others (data export, correction requests, nomination) are currently handled manually — contact us using the details below and we will act on your request within a reasonable time.
10. Children's Data
MediCore is used by hospitals to record care for patients of all ages, including minors, as part of their medical treatment — that data is held by the hospital as Data Fiduciary under its own consent arrangements with the minor's parent or lawful guardian. The MediCore patient app account itself is intended for use by adults managing their own (or, informally, their family's) records; we do not currently have an automated age-verification or dedicated guardian-consent flow for app accounts, and we are working on this as part of our ongoing DPDP compliance program.
11. Grievance Redressal
If you have a concern about how your personal data is handled, you can reach our Grievance Officer using the contact details published below (or, if not yet published, using the general contact details at the end of this page). We aim to acknowledge grievances promptly and resolve them within the timeline required under the DPDP Act.
12. Escalation to the Data Protection Board of India
If you are not satisfied with how we have handled your grievance, you have the right to escalate your complaint to the Data Protection Board of India, the statutory body established under the DPDP Act to adjudicate data-protection complaints.
13. Changes to This Policy
We may update this policy as our services, or applicable law, evolve. The version number and effective date at the top of this page identify the version currently in force. Material changes will be reflected here; where required by law, we will provide additional notice.
14. Contact Us
For any question about this policy or your personal data, write to us using the contact details on our website's Contact section, or to the Grievance Officer contact published above once available.