Privacy Policy

Introduction

VerumPrime is operated by Om Prakash Kumar (Proprietor), trading as VerumPrime (“we”, “us”, “our”). We are the data fiduciary responsible for personal data processed through verumprime.in. This Privacy Policy applies to all users of the Platform.

1. Information We Collect

We collect the following categories of information:

• Account information — name, email address, phone number, password (hashed), date of birth, and gender provided when you register or sign in via Google.
• Health information — symptoms, preferred specialties, appointment history, prescriptions, and any clinical notes you upload. We treat this as confidential personal data and protect it with additional safeguards under our security program.
• Payment information — transaction IDs, payment status, and the masked instrument used. Full card numbers and UPI PINs are never seen or stored by us; they are handled by our PCI-DSS-compliant payment partners.
• Usage data — pages visited, search terms, listings viewed, bookings made, and time stamps.
• Device & cookies — IP address, browser type, operating system, device identifiers, and cookies used to keep you signed in and to remember preferences.

2. How We Use Information

• To provide and improve the Platform, including matching you to relevant hospitals and doctors.
• To process payments and confirm bookings.
• To send transactional notifications (appointment confirmations, reminders, refunds).
• To prevent fraud, abuse, and security incidents.
• To comply with applicable law and respond to lawful requests.
• To analyse aggregated, de-identified usage so we can build a better product.

3. How We Share Information

We share personal data only as described below:

• With hospitals and doctors you book — so they can prepare for your visit. Only the information necessary for the appointment is shared.
• With payment processors — including Cashfree, to process consultation fees and refunds.
• With legal authorities — if required under Indian law, by court order, or to protect the rights, safety, or property of users or the public.
• With service providers who operate under contractual confidentiality obligations and process data only on our instructions (hosting, email delivery, error monitoring, media storage).

We do not sell your personal data. We do not share it with advertisers for ad targeting.

4. Data Retention

We retain your personal data for as long as your account is active and for as long as needed to provide the Platform. Certain records (such as transaction and tax records) are kept for longer where required by Indian law — typically up to eight (8) years for financial records. When data is no longer required, we delete or anonymise it.

5. Data Security

We use industry-standard safeguards to protect your data, including transport-layer encryption (TLS) for all traffic, encryption at rest for stored records, role-based access controls, audit logging, and regular security reviews. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authorities as required by law.

6. Your Rights under DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data, subject to legal retention requirements.
• Withdraw consent for processing where consent is the legal basis.
• Nominate another person to exercise these rights in case of your incapacity or death.
• Lodge a grievance with our Grievance Officer (see section 12).

To exercise any of these rights, email dpo@verumprime.in. We will respond within the timelines required by law.

7. Children's Privacy

The Platform is intended for users aged 18 and above. Users below 18 may use the Platform only with the involvement and verifiable consent of a parent or legal guardian, who is responsible for any data submitted on the minor's behalf. We do not knowingly collect data from children without such consent.

8. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. You can disable cookies in your browser, but parts of the Platform (such as login and bookings) may not work without them. We do not use third-party advertising cookies.

9. Third-Party Services

We rely on the following sub-processors to operate the Platform. Each is bound by contractual confidentiality and data-protection obligations:

• Cashfree — payment processing for consultation fees and refunds.
• Cloudinary — image and media storage for hospital, doctor, and report uploads.
• Google — OAuth-based sign-in (we only receive your name, email, and profile picture).
• Vercel — hosting and edge delivery of the Platform.
• Sentry — error monitoring (data is scrubbed of PII before being sent).

10. International Data Transfers

Your data is primarily stored on infrastructure located in India (AWS Mumbai region). Some processing — such as edge caching by Vercel — may occur outside India. We transfer data only to jurisdictions that provide an adequate level of protection or under appropriate contractual safeguards, as permitted under Indian law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. For material changes, we will provide additional notice (for example, by email or a prominent notice on the Platform).

12. Data Protection / Grievance Officer

Under the DPDP Act, 2023 and the IT Rules, 2021, the Data Protection and Grievance Officer is:

13. Contact

For any privacy-related questions, write to dpo@verumprime.in or use the Contact page. Our registered phone number is available on the Contact page.