Medhorizone Privacy Policy

1. Information We Collect

The information we collect depends on the features you use and the permissions you provide.

1.1 Account and Profile Information

Medhorizone may collect:

• Mobile number.
• Email address.
• Date of birth.
• Gender.
• Profile photograph, if you choose to provide one.

Name,Mobile number, email address, and date-of-birth information are protected using encryption within our application infrastructure.

Gender and certain other profile information may be stored separately according to the requirements of the application.

2. Health Information

Medhorizone allows users to voluntarily provide, manage, and view health-related information.

Depending on the features you use, this may include:

• Height and weight.
• Blood group.
• Blood pressure.
• Blood sugar.
• Steps and physical activity.
• Sleep information.
• Mood-related information.
• Menstrual/period information.
• Pregnancy-related information.
• Medical conditions.
• Medicines.
• Allergies.
• Other health information that you voluntarily enter or generate through supported Medhorizone features.

3. Medical Documents

Medhorizone allows you to upload and manage certain health-related documents, including:

• Medical reports.
• Prescriptions.
• Diagnostic reports.
• Health records.
• Other supported medical documents.

Uploaded medical documents are stored using encrypted cloud storage mechanisms.

Additional information associated with these documents is stored in our backend systems.

You can delete individual documents using the available functionality in the App.

4. Apple Health / HealthKit

The iOS version of Medhorizone may use Apple's HealthKit framework to access step information.

Currently:

• Medhorizone reads step information from Apple Health/HealthKit where the user grants the required permission.
• Medhorizone does not write information back to Apple Health.
• Medhorizone does not request access to unrelated HealthKit categories unless such access is introduced and separately disclosed.
• HealthKit information is used for health and fitness-related functionality and personalised health insights.

Apple Health and HealthKit are controlled by Apple, and users can manage HealthKit permissions through Apple's system privacy settings.

Apple requires apps using HealthKit to clearly explain their use of health data and obtain the applicable user permissions.

5. Sleep, Activity, Mood, Period and Pregnancy Information

Depending on the features you use, Medhorizone may process information relating to:

• Physical activity.
• Step count.
• Sleep.
• Mood.
• Menstrual cycles.
• Pregnancy-related information.

This information may be used to provide relevant application functionality, reminders, visualisations, summaries, and personalised health insights.

You control the information you choose to enter into Medhorizone.

6. Approximate Location Information

Medhorizone may determine your approximate location during the initial registration process using your IP address.

For this purpose, Medhorizone may use an IP-based geolocation service to determine information such as:

• Country.
• State or region.
• City or approximate geographical area.

IP-based location is approximate and is not intended to identify your precise physical location or street address.

Medhorizone does not continuously track your physical location through this registration process.

7. Device and Technical Information

Medhorizone may collect limited technical information about your device and application environment.

This may include information such as:

• Device type.
• Operating system and version.
• Application version.
• Device or installation identifiers where provided by the applicable service.
• Technical information required to operate the application.
• Crash and diagnostic information.
• Other technical information necessary for security and troubleshooting.

This information may be used to maintain, secure, troubleshoot, and improve Medhorizone.

8. IP Address

We may process your IP address for purposes including:

• Approximate location determination during registration.
• Security.
• Fraud and abuse prevention.
• Technical troubleshooting.
• Protecting the Medhorizone Services.
• Investigating security incidents.

IP-based location information should not be interpreted as precise GPS location information.

9. Crash and Error Information

Medhorizone uses Firebase Crashlytics to identify application crashes, errors, and technical problems.

Crashlytics may process technical information associated with application crashes and failures, which can include information such as device information, operating system information, application version, crash information, and related diagnostic information.

We use this information to:

• Identify crashes.
• Diagnose technical problems.
• Improve application stability.
• Improve application performance.
• Identify and resolve software defects.

Firebase documents that its services may process technical information and that retention periods vary by Firebase service and configuration.

10. Analytics

Medhorizone uses Firebase Analytics to understand how users interact with the App and to improve application functionality and user experience.

Analytics information may include:

• Application usage events.
• Application version.
• Device and technical information.
• Session-related information.
• Other information collected by Firebase Analytics according to its configuration.

We do not intentionally use health information such as medical conditions, medicines, medical documents, blood pressure, blood sugar, or similar health information as advertising or analytics identifiers.

Firebase provides controls for developers to manage and disable Analytics collection where appropriate.

11. How We Use Your Information

We may process your information for the following purposes.

11.1 Providing Medhorizone Services

To:

• Create and maintain your account.
• Authenticate your account.
• Store and display your health information.
• Provide health-management features.
• Store and manage medical documents.
• Provide reminders and notifications.
• Provide Care Circle functionality.
• Provide personalised health insights.
• Maintain and operate the App.

11.2 Personalised Health Insights

Medhorizone may process selected health information to generate personalised health insights.

For example, depending on the feature and information available, this may include:

• Step information.
• Physical activity.
• Sleep information.
• Selected health measurements.
• Other relevant health information.

The purpose is to provide users with useful, personalised health-related insights.

11.3 Application Improvement

We may use technical, analytics, and crash information to:

• Understand how the application is used.
• Identify application problems.
• Fix bugs.
• Improve performance.
• Improve reliability.
• Develop and improve features.
• Maintain application security.

11.4 Security and Fraud Prevention

We may process relevant information to:

• Detect unauthorized access.
• Prevent misuse.
• Detect fraudulent activity.
• Protect user accounts.
• Protect our systems.
• Investigate security incidents.

11.5 Legal and Regulatory Requirements

We may process or retain information when reasonably necessary to:

• Comply with applicable laws.
• Respond to lawful requests.
• Protect our legal rights.
• Resolve disputes.
• Prevent fraud or abuse.
• Establish, exercise, or defend legal claims.
• Comply with regulatory requirements.

12. AI-Powered Health Insights

Medhorizone currently uses Google Gemini to generate certain personalised health insights.

To generate these insights, Medhorizone may send selected health-related information to the applicable Gemini service.

The information provided for this purpose is intended to contain relevant health information rather than direct personal identifiers.

We do not intentionally send the following information to Gemini for generating these health insights:

• Your name.
• Your mobile number.
• Your email address.
• Your uploaded medical documents.

Examples of information that may be used for health insights include:

• Steps.
• Sleep information.
• Physical activity.
• Selected health measurements.
• Other relevant health information needed to generate the requested insight.

Gemini processing is performed through the applicable Google service used by Medhorizone and is subject to the applicable Google terms and privacy practices.

You should consult a qualified healthcare professional when you require medical diagnosis, treatment, medication advice, or emergency care.

Google's documentation describes different data-handling and retention conditions depending on the Gemini service and usage configuration. Therefore, Medhorizone does not represent that all Gemini processing has zero data retention unless the specific service configuration provides that protection.

13. Care Circle and Health Information Sharing

Medhorizone provides a Care Circle feature that allows you to share selected health information with people you choose.

You control which information you choose to share.

Depending on the functionality available in the App, you may choose to share selected information with:

• Family members.
• Other trusted individuals.
• Healthcare professionals connected through the Care Circle functionality.

You should only share information with people you trust.

You may change or revoke sharing permissions using the available Medhorizone functionality.

If another person has already viewed, copied, downloaded, photographed, or otherwise independently retained information that you previously shared, Medhorizone may not be able to recover or delete that independently retained copy.

14. Information Sharing and Disclosure

We may provide information to service providers that help us operate Medhorizone.

These service providers may include:

• Cloud hosting providers.
• Cloud storage providers.
• Authentication and security service providers.
• Analytics providers.
• Crash-reporting providers.
• AI service providers.
• IP-based geolocation providers.
• Other technology providers required to operate the Services.

These providers process information according to the services they provide and applicable contractual, technical, and legal requirements.

We do not currently provide user health information to:

• Insurance companies.
• Pharmacies.
• Laboratories.
• Hospitals.

through the current production Medhorizone functionality.

Medhorizone may introduce healthcare integrations in the future. If new functionality materially changes how personal or health information is processed or shared, we may update this Privacy Policy and provide additional notices or obtain additional permissions where required.

15. Third-Party Services

Medhorizone currently uses certain third-party services to operate and improve the App.

Third-party services may have their own privacy policies and terms. Where appropriate, users should also review the privacy practices of the relevant third-party service.

16. Data Security

We take reasonable technical and organisational measures designed to protect personal and health information against unauthorized access, alteration, disclosure, loss, or destruction.

Depending on the information and processing involved, our security measures may include:

• Encryption of sensitive information.
• Encrypted storage of medical documents.
• Secure network communication.
• Secure authentication mechanisms.
• Access controls.
• Secure credential and secret management.
• Server-side security controls.
• Application security controls.
• Monitoring and crash reporting.
• Security procedures for detecting and responding to incidents.

Access to sensitive information is restricted according to operational requirements.

Although our administrative application does not provide ordinary administrators with the ability to view uploaded medical documents, limited technical access may be possible in exceptional circumstances where necessary for legitimate operational, maintenance, security, or legal purposes.

No electronic transmission, storage system, or security mechanism can be guaranteed to be completely secure.

If we become aware of a security incident affecting personal information, we will take appropriate steps required under applicable law, including investigation, mitigation, and notification where legally required.

17. Data Storage and Hosting

Medhorizone's production application infrastructure is hosted using Scala Hosting.

Our primary production infrastructure and associated data systems are located in India, including infrastructure located in or associated with Bangalore, as applicable to the services used by Medhorizone.

Certain third-party service providers may process information outside India.

Where information is processed by third-party providers in other jurisdictions, such processing will be subject to the applicable contractual, technical, and legal requirements.

18. Data Retention

We retain personal information and health information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, complying with legal obligations, resolving disputes, preventing fraud and abuse, and protecting our legal rights.

Different categories of information may have different retention periods depending on their purpose and the service through which they are processed.

Third-party services such as analytics, crash reporting, authentication, cloud infrastructure, and AI services may also have their own applicable retention periods.

19. Account Deletion

You can delete your Medhorizone account using the account deletion functionality provided in the App.

When you request account deletion:

1. Your account is moved into a deletion or inactive state.
2. Your account is no longer treated as an active Medhorizone account.
3. Your personal and health information is scheduled for deletion from our active systems.
4. Associated information is deleted or de-identified according to our applicable deletion procedures and retention requirements.

For example, information may temporarily remain in:

• Security logs.
• Backup systems.
• Disaster-recovery systems.
• Fraud-prevention records.
• Technical logs.
• Third-party systems subject to their applicable retention periods.

Such information may remain for a limited period according to applicable operational, security, backup, or legal retention requirements.

We may retain certain information where necessary or permitted for:

• Compliance with applicable law.
• Legal obligations.
• Fraud prevention.
• Security purposes.
• Dispute resolution.
• Establishing, exercising, or defending legal claims.
• Protecting the rights, property, or security of Medhorizone, our users, or others.

Where information is no longer required for these purposes, it will be deleted or irreversibly anonymised according to our applicable retention and deletion procedures.

Information contained in backups may be securely overwritten or deleted according to the applicable backup lifecycle rather than immediately when the account deletion request is submitted.

20. Your Privacy Rights

Subject to applicable law, you may have rights relating to your personal information, including rights to:

• Obtain information about personal data processed by us.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of personal information where applicable.
• Withdraw consent where processing is based on consent.
• Request information regarding processing of your personal information.
• Exercise other rights available under applicable data-protection laws.

We may need to verify your identity before processing certain requests to prevent unauthorized access to personal information.

The Digital Personal Data Protection Act, 2023 provides rights and mechanisms relating to consent, withdrawal of consent, and other data-principal matters. Applicable requirements may also depend on the effective implementation of the Act and Rules.

21. Consent and Withdrawal of Consent

Where we rely on consent as the legal basis for processing personal information, you may withdraw that consent subject to applicable law.

We will provide appropriate mechanisms for withdrawing consent where required.

Withdrawal of consent may affect your ability to use certain Medhorizone features.

For example, if you do not provide permission to access Apple Health step information, features that depend on that information may not function.

Withdrawal of consent does not affect the legality of processing performed before consent was withdrawn.

Where processing is permitted or required by law without consent, withdrawing consent may not require us to stop such processing.

Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, and withdrawal should be as easy as giving consent where consent is the basis of processing.

22. Children's Privacy

Medhorizone is intended to support users of different age groups.

Where a user is a child or otherwise requires consent from a parent or lawful guardian under applicable law, the applicable consent and verification requirements will apply.

We will process children's personal information in accordance with applicable legal requirements.

We do not knowingly require children to provide more personal information than is necessary for the relevant Medhorizone service.

Parents or lawful guardians who believe that information relating to a child has been provided or processed inappropriately may contact us using the contact information provided in this Privacy Policy.

23. Notifications

Medhorizone may send:

• Health reminders.
• Activity reminders.
• Sleep reminders.
• Health-related educational information.
• Personalised health-related notifications.
• Application and account notifications.

The content and frequency of notifications may depend on the features you use and your notification preferences.

You can manage notification permissions through the App and/or your device settings.

Some notifications may contain or refer to health-related information. If other people have access to your device, you should consider your device's notification-preview and lock-screen settings.

24. Data Accuracy

Medhorizone allows users to enter and manage certain health information.

You are responsible for providing information that is accurate and reasonably up to date.

If you identify inaccurate information, you should update it through the available App functionality or contact us where applicable.

25. No Sale of Personal or Health Information

We do not use users' health information to sell advertising or provide health information to data brokers.

We may use third-party service providers to operate Medhorizone, as described in this Privacy Policy.

Use of a service provider to process information on our behalf is different from selling personal information.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may occur because of:

• New Medhorizone features.
• Changes in data-processing practices.
• Changes in third-party services.
• Changes in applicable laws or regulations.
• Changes in security practices.
• Improvements to our Services.

If material changes are made, we may provide notice through the App, website, email, or another appropriate communication method where required.

The "Last Updated" date at the beginning of this Privacy Policy indicates the latest revision date.

27. Contact Us

28. Applicable Law

This Privacy Policy is intended to operate in accordance with applicable laws and regulations of India, including applicable data protection and privacy requirements.

Where applicable law provides additional rights, protections, obligations, or requirements, those requirements will apply to the extent required by law.