Privacy Policy

Users may contact the above email for:

• Privacy-related concerns
• Data access requests
• Data correction requests
• Consent withdrawal
• Data deletion requests
• Grievance redressal

For the purposes of this Policy:

• Personal Data — any information relating to an identified or identifiable individual.
• Sensitive Personal Data — health records, medical history, diagnostic reports, biometric data, and other healthcare-related information.
• Processing — collection, storage, use, sharing, analysis, transfer, or deletion of personal data.
• Data Principal — the individual to whom personal data relates under the DPDP Act.
• Data Subject — the individual under GDPR terminology.

We may collect the following categories of data:

• Full name
• Date of birth
• Gender
• Mobile number
• Email address
• Residential address
• Employee ID
• Government identification details (where legally required)

• Medical history
• Laboratory reports
• Diagnostic reports
• Health assessments
• Vaccination records
• Occupational health records
• Fitness certificates
• Teleconsultation records
• Prescription information

• Device identifiers
• IP address
• Browser type
• Operating system
• App version
• Log files
• Usage analytics
• Crash reports

• Approximate location
• GPS location (only with explicit permission)

• Medical prescriptions
• Health records
• Insurance documents
• Identity verification documents

We process personal data under one or more lawful bases:

• Explicit consent
• Performance of a contract
• Compliance with legal obligations
• Legitimate interests
• Provision of healthcare services
• Occupational health obligations

Processing is based on:

• Consent provided by the Data Principal
• Legitimate uses permitted under applicable law
• Employment and occupational health obligations
• Medical emergency situations
• Compliance with legal and regulatory requirements

We process personal data for:

• User registration and authentication
• Scheduling appointments
• Delivering healthcare services
• Occupational health compliance
• Medical consultations
• Corporate wellness management
• Diagnostic reporting
• Health analytics and reporting
• Customer support
• Security monitoring
• Fraud prevention
• Regulatory compliance
• Improvement of services and user experience

Where required by law, we obtain:

• Freely given consent
• Specific consent
• Informed consent
• Explicit consent for sensitive health data

Users may withdraw consent at any time by contacting: legal@prognohealth.com

Withdrawal of consent shall not affect processing already lawfully undertaken.

We do not sell personal data. We may share personal data with:

• Doctors
• Laboratories
• Diagnostic centers
• Hospitals
• Occupational health specialists

Where services are employer-sponsored, limited information may be shared strictly for:

• Fitness-for-work compliance
• Statutory reporting
• Occupational health obligations

Such sharing shall be limited to authorized personnel only.

Third-party vendors providing:

• Cloud hosting
• Technical support
• SMS/email delivery
• Payment processing
• Analytics tools
• Customer service

All processors are contractually obligated to maintain confidentiality and data security.

Where disclosure is required under applicable laws, court orders, public health mandates, or regulatory investigations.

Personal data may be processed or stored outside India or the European Economic Area (EEA). Where international transfers occur, we implement appropriate safeguards including:

• Standard contractual clauses
• Contractual confidentiality obligations
• Secure hosting arrangements
• Adequacy-based transfer mechanisms where applicable

We retain personal data only for as long as necessary for:

• Healthcare delivery
• Occupational health compliance
• Legal obligations
• Tax and audit requirements
• Dispute resolution

Medical and occupational health records may be retained per applicable statutory requirements. Data no longer required is securely deleted, anonymized, or archived.

• Right to access
• Right to rectification
• Right to erasure ("Right to be Forgotten")
• Right to restrict processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right to lodge complaints with supervisory authorities

• Seek access to personal data
• Request correction and erasure
• Withdraw consent
• Nominate another individual
• Seek grievance redressal

Requests can be submitted to: legal@prognohealth.com

Users may request deletion of their user accounts, personal data, and uploaded documents by:

• In-app account deletion feature
• Email to legal@prognohealth.com

Certain information may be retained to comply with healthcare laws, occupational health regulations, and legal/audit obligations.

We implement appropriate technical and organizational safeguards including:

• Encryption in transit and at rest
• Access controls
• Secure authentication
• Audit logging
• Role-based access
• Periodic security reviews
• Vulnerability monitoring

Despite our efforts, no digital platform can guarantee absolute security.

PrognoHealth does not undertake fully automated decisions producing legal or similarly significant effects without human involvement.

Our Services are not intended for children under 18 years without parental or lawful guardian consent. Where required, verifiable parental consent shall be obtained.

We may use the following, which support security, authentication, analytics, and performance optimization:

• Cookies
• Session identifiers
• Analytics tools
• Mobile SDKs
• Device identifiers

Users may manage permissions through browser or device settings.

The App may use:

• Firebase Analytics
• Firebase Crashlytics
• Push notification services
• Cloud hosting providers
• Payment gateways

These providers may process limited technical data necessary for service functionality.

The App is intended to support healthcare management and wellness services and does not replace emergency medical care or independent medical judgment. Users should seek immediate medical attention in emergencies.

PrognoHealth complies with Google Play User Data policies, Google Play Data Safety requirements, and applicable Apple App Store privacy requirements. The App discloses:

• Data collection practices
• Data usage purposes
• Third-party sharing
• Security practices

We may revise this Privacy Policy periodically. Updated versions shall be published at www.prognohealth.com/privacy-policy. Continued use of Services after changes constitutes acceptance of the updated Policy.

We aim to respond within:

• 30 days under GDPR
• Timelines prescribed under applicable Indian laws

This Privacy Policy shall be governed by the laws of India and applicable GDPR provisions where relevant. Courts located in Pune, Maharashtra, India shall have jurisdiction, subject to applicable data protection laws.