Health Data Protection Notice

Who's who under the DPDP Act

• You are the "Data Principal" — the person the data is about.
• Medisage is the "Data Fiduciary" — we decide why and how your data is processed, and we are accountable for protecting it.
• "Data Processors" are the service providers who process data on our instructions (for example, cloud hosting and AI analysis providers).

What health data we handle

Depending on what you choose to add, this can include:

• Medical records, prescriptions and lab reports you upload
• Diagnostic images and scans
• Medication lists and reminder schedules
• Health readings you log (blood pressure, sugar, weight, and similar)
• Profile details for you and family members you add

Beta note: during the private beta, sample and test data should not contain real patient information.

Changes to this notice

If we make material changes, we'll post the revised notice here and in the app, and notify users of significant changes by email or in-app notice.

Processing outside India

Some of our service providers (including AI analysis providers) may process data on servers outside India. The DPDP Act permits such transfers except to countries the Government of India restricts. We choose providers we can hold to appropriate protection and confidentiality obligations.

What we never do

We do not sell your data, and we do not share your identifiable health information with advertisers.

How we handle a child's profile

• A child (under 18) profile must be created and managed by a parent or lawful guardian, who provides consent on the child's behalf.
• We do not use a child's data for tracking, behavioural monitoring or targeted advertising.
• We process a child's health data only to provide the family health-management features the parent or guardian has chosen.

Infrastructure providers

We use managed cloud hosting, a managed database and managed object storage, all with encryption at rest. We're happy to identify specific infrastructure providers to any user, auditor or enterprise partner who asks at security@medisage.app. Medisage itself holds no third-party security certification (such as SOC 2) at this stage; we'll say so here when that changes.

The limits of any security — please read

The safeguards above are our genuine best efforts, and we keep improving them. But no app, company or system — however careful — can promise perfect security. Online threats evolve constantly, and some risks sit outside our control, including the AI and infrastructure providers we rely on and the security of your own device and password.

By creating an account and using Medisage, you acknowledge and accept that:

• Data protection can never be absolute or foolproof, and you use the service understanding that a residual risk of unauthorised access or loss always remains.
• Medisage is an independent, early-stage venture. The consumer app is provided free of charge, on an "as is" and "as available" basis, without warranties of any kind.
• We make commercially reasonable best efforts to protect your data but cannot be held liable for security incidents beyond our reasonable control — including breaches of third-party providers, or access resulting from your own device, network or credentials being compromised.
• To the maximum extent permitted by law, our total liability to you in connection with the service is limited, and you agree not to hold Medisage responsible for indirect or consequential loss.
• You are responsible for keeping your login and device secure, and for choosing what information you upload.

This acknowledgment does not remove any right you hold, or any duty we owe, that cannot be waived under India's DPDP Act, 2023. It is a summary written for transparency, not legal advice; the binding terms are in our Terms of Service.