Privacy Policy

This Privacy Policy applies to information collected through our website, digital platforms, health screening programmes, assessments and related services, unless a separate privacy notice is provided for a particular service.

Our Commitment to Your Health Data

Your health data is entrusted to us. We treat it as a responsibility, not a commodity. Health information is different from ordinary contact information. A blood-pressure reading, blood-sugar result, lifestyle response or health-risk assessment can reveal something meaningful about an individual.

We therefore seek to follow these principles:

If you have a question, concern or complaint regarding:

• The personal information we hold about you;
• How your information has been collected or used;
• A screening report or health assessment;
• Sharing of your information with a partner organisation;
• Withdrawal of consent;
• Correction or deletion of information; or
• Any other privacy-related matter,

you may contact us using the details provided below. We will review and respond to your concern in accordance with applicable law and our internal grievance-redressal process.

The Grievance Officer is the designated point of contact for privacy and data-related grievances. We will endeavour to acknowledge and address grievances within the timelines prescribed by applicable law.

Where a specific service is provided through a partner organisation or another Data Fiduciary, additional grievance or privacy contacts may be provided in the applicable programme-specific notice.

DrMudhiwalla Healthtech Private Limited is a preventive health technology company focused on making health screening and health-risk awareness more accessible through everyday environments.

Our services may be provided through:

• Banks;
• Workplaces;
• Gyms and fitness centres;
• Community locations;
• Health camps;
• Partner organisations; and
• Our digital platforms.

Depending on the service, we may collect personal information and health-related information to provide screening, assessment, reporting and preventive-health services.

Depending on how you interact with us, we may collect:

Identity and contact information

• Name;
• Age or date of birth;
• Gender, where relevant to the service;
• Mobile number;
• Email address;
• Location or address, where necessary;
• Other information required to identify or communicate with you.

Account and digital information

Where applicable:

• Login or account information;
• Device information;
• IP address;
• Browser and operating-system information;
• Website interaction information; and
• Information collected through cookies or similar technologies.

Service-related information

We may collect information necessary to provide a particular screening, assessment or service. We will seek to avoid collecting information that is not reasonably necessary for the relevant purpose.

Depending on the screening or service, health-related information may include:

Physical measurements

• Height; Weight; Body Mass Index (BMI); Body Roundness Index (BRI); Waist circumference; Waist-to-height or other relevant measurements.

Vital measurements

• Blood pressure; Pulse rate; Heart rate; and Other measurements included in the applicable screening programme.

Biometric or laboratory-related measurements

• Where included: Blood glucose; Cholesterol; Other point-of-care or laboratory measurements.

Lifestyle and behavioural information

• Sleep; Stress; Physical activity; Food and dietary habits; Smoking or tobacco use; Family history; Relevant medical history; and Other questionnaire responses.

Assessment outputs

We may also generate: Screening results; Health scores; Lifestyle scores; Risk categories; Preventive-health recommendations; and Reports generated from the information collected during the assessment.

We collect and process information for purposes such as:

• Providing the requested screening or assessment;
• Measuring and recording screening parameters;
• Preparing and communicating health-screening reports;
• Generating health-risk or lifestyle assessments;
• Providing preventive-health information and recommendations;
• Administering our programmes;
• Communicating with participants regarding their service;
• Improving the quality and effectiveness of our services;
• Evaluating screening programmes;
• Maintaining appropriate records;
• Meeting applicable legal, regulatory and contractual obligations; and
• Generating aggregated or anonymised insights where permitted by applicable law.

We will not use personal information for a materially different purpose without providing appropriate notice and obtaining consent where required.

Depending on the circumstances and the applicable legal framework, we may process personal information:

• With your consent;
• To provide a service requested by you;
• To comply with applicable legal obligations;
• For other purposes permitted under applicable law; or
• Where another lawful basis for processing applies.

Where consent is required, we will seek to obtain it through an appropriate mechanism before processing the relevant information.

For health screening, consent may be obtained through a physical or digital consent form, checkbox, assessment interface, registration process or another appropriate mechanism.

Consent should be meaningful. Where required, the relevant notice will explain: What information is being collected → Why it is being collected → How it will be used → Whether it will be shared → How consent can be withdrawn.

Access to personal information is restricted to persons and organisations that reasonably need it for an authorised purpose.

Depending on the service, this may include:

• Authorised DrMudhiwalla personnel;
• Healthcare professionals involved in the service;
• Technology and infrastructure providers;
• Communication service providers;
• Laboratory or diagnostic service providers, where applicable;
• Other service providers acting on our behalf; and
• Partner organisations, but only to the extent applicable to the programme and permitted by the relevant notice, consent or law.

Access should be based on the purpose for which the information is required, rather than simply on the organisation's involvement in the programme.

This depends on the specific programme. A partner organisation does not automatically receive your complete health record merely because the screening takes place at its premises.

Where a programme is designed to share only a final category or outcome, such as:

Green | Yellow | Red

the partner may receive only that permitted outcome. For example, in a gym screening programme, the gym may receive the participant's final category where the participant has been informed of and consented to such sharing, while detailed health information remains confidential.

Where detailed information needs to be shared for a specific service, the relevant notice or consent mechanism will communicate this.

We do not sell identifiable health information.

We may share identifiable health information only where appropriate and permitted, such as:

• To provide a service requested by you;
• With healthcare professionals involved in providing the service;
• With authorised service providers processing information on our behalf;
• With a partner organisation where such sharing is specifically part of the programme and appropriately disclosed/authorised;
• Where you have provided the required consent; or
• Where disclosure is required or permitted by applicable law.

We seek to limit such sharing to the information reasonably necessary for the relevant purpose.

No. DrMudhiwalla does not sell identifiable personal information or identifiable personal health information.

We do not treat an individual's health information as a commercial asset to be sold to advertisers, banks, employers, insurers, marketers or other third parties.

This does not prevent us from using appropriately aggregated or anonymised information for legitimate purposes where permitted by applicable law.

We may use basic website or contact information for legitimate communications relating to our services, where permitted by applicable law and subject to applicable consent requirements.

However:

• We do not use identifiable health information to target individuals with advertising.
• We do not intend to use information such as: Blood pressure; Blood glucose; Cholesterol; Sleep score; Stress score; Health-risk category; or Other identifiable health information to create targeted advertising profiles for commercial advertising.

Where we use cookies, analytics or similar technologies on our Website, their use will be subject to the applicable notice, settings and consent requirements.

We do not use identifiable personal health information to train general-purpose AI or machine-learning models without appropriate disclosure and lawful authorisation.

We may use technology, including software-assisted analytics or artificial intelligence, to support legitimate functions such as:

• Data processing; Report generation; Administrative automation; Service improvement; Statistical analysis; or Other functions necessary to provide our Services.

Where AI or machine-learning technology is used in a manner involving personal information, we will seek to apply appropriate safeguards and comply with applicable law.

Yes. Preventive health screening can generate valuable population-level insights.

Where permitted by applicable law, we may use appropriately aggregated or anonymised information to:

• Understand population-level health trends;
• Evaluate screening programmes;
• Measure programme effectiveness;
• Improve our screening protocols;
• Develop and improve products and services;
• Conduct statistical analysis;
• Support research;
• Develop preventive-health insights; and
• Prepare reports for partner organisations.

Such information should not identify an individual.

Personal information may be stored using our own systems and/or third-party technology and cloud infrastructure providers engaged by us.

Depending on the technology architecture and service involved, information may be stored or processed on servers located in India or other jurisdictions where permitted under applicable law.

We will take appropriate contractual, technical and organisational measures in relation to such processing. The specific technology providers used by us may change from time to time as our systems evolve.

We retain personal information only for as long as reasonably necessary for:

• Providing the relevant service;
• Maintaining appropriate health or service records;
• Fulfilling contractual or legal obligations;
• Resolving disputes;
• Maintaining security and audit records; or
• Other legitimate purposes permitted by applicable law.

The retention period may differ depending on the nature of the information and the service. When personal information is no longer required, we will seek to delete it or otherwise dispose of it securely, subject to legal, regulatory or legitimate retention requirements.

We implement reasonable technical and organisational measures appropriate to the nature and risks associated with the information we process. These may include:

• Access controls;
• Authentication mechanisms;
• Role-based access;
• Encryption or other security measures where appropriate;
• Secure transmission;
• Logging and monitoring;
• Backup and recovery procedures;
• Confidentiality obligations for authorised personnel; and
• Security controls for service providers.

No electronic system or method of transmission can be guaranteed to be completely secure. However, we seek to continuously improve our safeguards as our systems, services and security risks evolve.

Subject to applicable law and the relevant provisions being in force, you may have rights including:

• The right to obtain information about your personal data and its processing;
• The right to request correction of inaccurate or incomplete information;
• The right to request erasure of personal information where applicable;
• The right to withdraw consent where processing is based on consent;
• The right to access information regarding sharing of personal data, where applicable;
• The right to raise a grievance; and
• The right to nominate another individual to exercise applicable rights in accordance with law.

Where processing is based on consent, you may withdraw your consent by contacting us through the details provided in this Privacy Policy or by using the withdrawal mechanism made available for the relevant service.

We aim to make withdrawal of consent reasonably straightforward. Where technically and legally applicable, the process for withdrawing consent should be comparable to the process through which consent was given.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. Withdrawal may also not require deletion of information where continued retention or processing is required or permitted by applicable law.

You may contact us at: privacy@drmudhiwalla.com

with the subject: Privacy Request – [Nature of Request]

For example:

• Privacy Request – Access
• Privacy Request – Correction
• Privacy Request – Deletion
• Privacy Request – Consent Withdrawal
• Privacy Complaint

We may need to verify your identity before acting on a request concerning your personal information. This is intended to protect your information from unauthorized access or deletion.

If we become aware of a personal data breach, we will take appropriate steps to:

• Assess and contain the incident;
• Secure affected systems;
• Investigate the nature and extent of the breach;
• Take steps to mitigate potential harm;
• Notify affected individuals where required;
• Notify relevant authorities or regulatory bodies where required; and
• Take corrective measures to reduce the likelihood of recurrence.

Our response will be carried out in accordance with applicable legal and regulatory requirements.

Our Services are primarily intended for adults unless a particular programme expressly provides otherwise.

Where a service involves a child or another individual who requires a parent, guardian or other authorised person to provide consent under applicable law, we will seek to implement the appropriate consent mechanism.

We do not knowingly seek to collect children's personal information for unrelated commercial purposes.

We may use third-party providers for services such as:

• Cloud hosting;
• Website infrastructure;
• Communication and messaging;
• Email;
• Analytics;
• Data processing;
• Laboratory services;
• Report generation; and
• Other operational functions.

Such providers may process information on our behalf where necessary to provide the relevant service. We seek to ensure that appropriate contractual and security safeguards apply to such processing.

Our Website may contain links to third-party websites or services. We are not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policy of any third-party website before providing personal information.

Our Website may use cookies, analytics tools and similar technologies to:

• Operate the Website;
• Understand Website usage;
• Improve performance;
• Maintain security; and
• Understand how visitors interact with our content.

Where required, we will provide appropriate notice and obtain consent for non-essential cookies or similar technologies.

We may update this Privacy Policy from time to time to reflect:

• Changes in our services;
• Changes in our technology;
• Changes in our data practices;
• Changes in applicable law or regulations; or
• Changes in our privacy and security practices.

The updated version will be published on this Website with a revised "Last Updated" date. Where required by applicable law, we will provide additional notice or obtain consent for material changes.

This Privacy Policy shall be governed by the laws of India.

Any dispute arising in connection with this Privacy Policy shall be subject to applicable Indian law and the jurisdiction of the competent courts or authorities as provided by law.