Privacy Policy

Draft under legal review. This policy is not yet final.

Effective date: [Insert before launch] • Last updated: [Insert date]

1. Scope and our role

This Privacy Policy applies to HealthRam’s website, apps, portals, customer support and supported healthcare-coordination services. Depending on the service, HealthRam may process personal data for its own lawful purposes and may also exchange information with pharmacies, laboratories, doctors, payment providers, delivery partners and other authorized service providers. Those organizations may have independent legal and professional responsibilities for information they process.

2. Personal data we may collect

• Identity and contact data: name, date of birth, address, phone number, email and government-identification details where required for verification.
• Health and service data: prescriptions, medicine details, refill history, allergies or relevant health information supplied for a service, diagnostic requests/results where authorized, prescriber information and care-coordination status.
• Caregiver and authorization data: caregiver relationship, permissions, consent/authorization status and communication preferences.
• Insurance and payment data: insurer/member information where used, billing details, transaction status and limited payment-related information. Payment card credentials may be handled directly by payment processors rather than stored by HealthRam.
• Partner and professional data: pharmacy, laboratory, clinic, doctor and business-contact information, credentials and onboarding data.
• Technical data: IP address, device/browser information, security logs, session data, cookie choices and website usage data.

3. Why we use personal data

• Create and secure accounts; verify identity, eligibility, prescriptions and service requests.
• Coordinate refills, medicine orders, delivery, caregiver access, diagnostics and supported clinical-service workflows.
• Provide support, notifications, fraud prevention, safety checks, service monitoring and dispute resolution.
• Process payments, maintain records, meet legal/regulatory obligations and protect the rights and safety of users, partners and HealthRam.
• Improve products and service quality using appropriately limited data; optional analytics or marketing technologies are used only in accordance with applicable consent requirements.

4. Consent and lawful processing

Where consent is the applicable basis, HealthRam will request clear and specific consent and provide a way to withdraw it. Withdrawal does not affect processing already lawfully completed and may prevent us from providing a service that requires the relevant data. We may also process data where permitted or required by applicable law, including for certain legitimate uses, legal obligations, emergencies, fraud/security prevention or establishment/exercise of legal claims, as applicable.

5. When we share information

We may share only the information reasonably necessary with authorized pharmacies, laboratories, doctors/clinics, caregivers selected by the patient, delivery/logistics providers, payment providers, technology/cloud vendors, customer-support vendors, professional advisers, insurers where applicable, and government/regulatory authorities where required or permitted by law. We do not sell personal data to advertisers. Health-related data should not be disclosed for unrelated advertising purposes without an appropriate lawful basis and required consent.

6. Retention and security

We retain personal data only for as long as needed for the purposes described, applicable healthcare/business record requirements, dispute resolution, fraud prevention and legal obligations. HealthRam uses reasonable technical and organizational safeguards such as access controls, authentication, encryption where appropriate, logging, vendor controls, backups and incident-response procedures. No electronic system can be guaranteed completely secure.

7. Your privacy rights

Subject to the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, as applicable and as brought into force from time to time, and other applicable law, individuals may have rights to obtain information about processing, request correction/completion/updating, request erasure where applicable, withdraw consent, use grievance redressal mechanisms and nominate another individual to exercise rights in specified circumstances. Requests may require identity verification and may be limited where law requires continued processing or retention.

8. Children

Where HealthRam knowingly processes personal data of a person under 18, it will apply applicable parental/guardian consent and child-data protections. HealthRam does not intend to use children’s personal data for targeted advertising or prohibited tracking/behavioral monitoring.

9. Cookies, cross-border processing and changes

Cookie and similar-technology use is explained in the Cookie Policy. Approved service providers may process data from locations permitted by applicable law and contractual safeguards. We may update this Policy as services or legal requirements change; material changes will be communicated when required.

10. Contact and grievance

Privacy questions, consent withdrawal requests and rights requests may be submitted through /legal/grievance. The published page should identify the appropriate privacy/grievance contact and provide current contact details before launch.