Privacy Policy

a) Information you give us

• Identity and contact details: name, mobile number, email, age, gender, and profile details you provide during onboarding.
• Health information (sensitive personal data): symptoms, medical history, conditions, allergies, medications, lifestyle inputs, body measurements, and the questionnaires you complete.
• Documents and lab reports you upload (including images and PDFs), and the text/data extracted from them.
• Communications: messages you send in chat, and the audio of consultations that a Doctor records.
• Payment-related details you provide to complete a transaction (processed by our payment partner; see Section 4).

b) Information collected automatically

• Device and technical data: device model, operating system, app version, IP address, and diagnostic/crash logs.
• Usage data: features used, interactions, and session information.
• Push-notification tokens (to deliver reminders and alerts).

c) Information from Doctors and admins

• Consultation notes, assessments, prescriptions, care plans, and appointment records generated in connection with your care.

We use your information to:

• Create and manage your account and verify you via OTP.
• Provide the core Services: health tracking, AI summaries, document processing, booking, consultations, chat, appointments, prescriptions, and care plans.
• Connect you with Doctors and enable your assigned care team to view the information necessary to provide care.
• Process payments and prevent fraud.
• Send you service messages, reminders, and notifications.
• Maintain safety, quality, medical records, and legal compliance, including retaining consultation recordings where applicable.
• Improve, secure, and troubleshoot the Services.
• Comply with legal obligations and enforce our Terms.

• We process your personal data on the basis of your consent and to provide the Services you request.
• Health data is treated as sensitive and processed only for the purposes above.
• You may withdraw your consent at any time, though doing so may limit our ability to provide some or all of the Services.

We do not sell your personal data. We share it only as needed:

• With Doctors and your care team, so they can review your relevant health information, consult with you, and provide care.
• With service providers (data processors) acting on our behalf, under confidentiality obligations, including:
  • Razorpay for payment processing.
  • Agora (or equivalent) for real-time video/audio calling.
  • Google Firebase for authentication (OTP), push notifications, and crash reporting.
  • Cloud hosting and storage providers.
• For legal reasons, where required by law, court order, or to protect rights, safety, and prevent fraud or harm.
• In a business transfer, as part of a merger, acquisition, or reorganisation, subject to this Policy.

Payments are handled by our payment partner. We do not store your full card number, CVV, UPI PIN, or bank credentials. We retain limited transaction records (such as amount, date, status, and a payment reference) for accounting, support, and legal purposes.

• Your data is stored on secured servers, and we apply reasonable technical and organisational safeguards, including access controls, authentication, and audit logging of sensitive access.
• Access to your health data by Doctors is permission-based and logged.
• No method of transmission or storage is fully secure; while we strive to protect your data, we cannot guarantee absolute security.

• We retain your information for as long as your account is active and as needed to provide the Services.
• Medical records, prescriptions, consultation notes, and consultation recordings may be retained for the periods required under applicable medical-record and legal requirements, even after account deletion.
• Transaction and tax records are retained as required by law. When no longer required, data is deleted or anonymised.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to legal and medical-record requirements.
• Withdraw your consent to processing.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
• Raise a complaint about how your data is handled.

To exercise these rights, contact us at health@ctrlznow.com. You can also delete your account from within the App.

The Services are intended for users in the 18+ age group. We do not knowingly collect data from minors. If we learn that we have collected a minor’s data, we will delete it.

We send push and in-app notifications for reminders, appointments, messages, and account activity. You can control notifications through your device settings; disabling them may limit certain features.

Our website and portals (for doctors and administrators) may use cookies and similar technologies for authentication, security, and session management. You can manage cookies via your browser settings.

Where data is processed or stored outside India by our service providers, we take steps to ensure it is protected consistent with this Policy and applicable law.

We may update this Privacy Policy from time to time. The current version will always be available at www.ctrlznow.com/privacy. Continued use of the Services after changes take effect constitutes acceptance.

You may contact us for any concern or complaint about your data at health@ctrlznow.com or +91 98190 91116.

We will acknowledge and address complaints within the timelines required by applicable law.