Privacy Policy

This policy applies to everyone who uses greenhealtheasy: patients, doctors, lab clinics, medical stores (pharmacies), and delivery agents. It explains what personal data we collect through the website and app, why, how it's used, who it's shared with, how long we keep it, and how you can exercise your rights.

It should be read alongside our shorter Privacy Notice, which summarizes the same information in the standalone form required by the Digital Personal Data Protection Rules, 2025.

When you register or book with us as a patient, we collect your name, date of birth, gender, mobile number, email, address, and — as you use the service — your medical history, symptoms, consultation notes, prescriptions, lab reports, diagnostic results, a doctor's clinical notes on your visit, appointment history, and payment records. We use this to create and run your account, match you with doctors and labs, let a doctor record and act on a consultation, deliver lab reports and medicines, process payment, and send you booking/OTP emails.

Doctors, lab clinics, and medical stores that register with us provide their name, qualification, medical registration number and issuing council, specialty, contact details, practice/clinic address, consultation fee, languages spoken, working hours, and a professional photograph where provided. We verify this information (in particular the registration number) before a profile is shown publicly, and we keep an internal record of who reviewed and approved each registration.

A patient account is not automatically treated the same regardless of age. Where a patient's date of birth indicates they are under 18, we do not allow the account to be created or updated without a parent or legal guardian providing their own name, relationship to the patient, phone number, and explicit consent to that processing, in line with the Digital Personal Data Protection Act, 2023.

A parent/guardian who registers or manages a minor's account is responsible for the accuracy of the information provided and can withdraw consent, or request the account and its data be deleted, by contacting us at the details in the Grievance section below.

We use strictly necessary cookies to keep you signed in and remember your session — the site does not function without these. Where we use analytics, it is limited to aggregate, non-identifying usage patterns (e.g. which pages are visited) to improve the product; we do not feed medical history, symptoms, consultation notes, prescriptions, lab results, or any other health data into any analytics or advertising tool, and we do not use tracking cookies to build advertising profiles.

Where a booking involves a fee, payment is processed by a licensed third-party payment gateway. We do not store your full card, UPI, or bank credentials on our servers — we retain only the transaction reference, amount, and status needed to reconcile your booking and provide a receipt.

Consultation notes, diagnoses, advice, referrals, lab reports, and prescriptions are entered by the doctor or lab/pharmacy handling your booking — clinical decisions are always made by that licensed professional, not by greenhealtheasy's software. These records are visible to you, to the doctor/clinic/pharmacy involved in that specific booking, and to platform admins solely for verification, support, and dispute-resolution purposes.

Video consultations run on a third-party video service (accessed via a random, unguessable link generated per appointment) and are not recorded or stored by greenhealtheasy. Please don't share sensitive documents or payment details during a video call.

We rely on a small number of third-party service providers strictly to operate the platform: cloud infrastructure to host the application and database, an email service to deliver OTP and booking notifications, a video-call provider for online consultations, and a payment gateway. Each is bound to use your data only to provide that specific service to us, not for their own purposes. We do not sell, rent, or otherwise trade personal or health data to any third party.

We keep account and profile data for as long as your account remains active. Appointment, consultation, prescription, and lab-report records are kept for as long as applicable medical record-keeping obligations require even after account closure, and are otherwise deleted or anonymized once no longer necessary for the purpose they were collected for. Payment transaction records are kept as required by applicable tax and financial regulations.

We apply layered technical and organizational safeguards appropriate to the sensitivity of health data, including:

• All traffic to and from the site is encrypted in transit (HTTPS/TLS); data is encrypted at rest on our hosting infrastructure where the platform supports it.
• Strong password requirements, OTP email verification, and JWT-based session tokens for authentication.
• Role-based access control — a doctor, lab, pharmacy, delivery agent, or patient can only see the records their role and relationship to a booking entitle them to; platform administrators go through a separate verification workflow before provider accounts go live.
• An internal audit trail recording who created or changed a consultation record, prescription, or lab report, and when.
• Secrets (database credentials, email/API keys) are kept out of source control and managed through environment configuration, never committed to our codebase.
• We do not write medical data (diagnoses, notes, results) into application logs, and we exclude health data from any analytics tooling.
• Regular backups and a documented recovery process to protect against data loss.

No system is perfectly secure, and we continue to invest in these controls as the platform grows — including stronger authentication for administrator accounts.

You can request deletion of your account and associated personal data at any time by writing to us (see Grievance section below). We will action the request unless we're legally required to retain specific records (for example, completed medical/consultation records under applicable health record-keeping rules) — where that applies, we will tell you what is retained and why, and delete everything else.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Know what personal data we hold about you and how it is being processed.
• Correct inaccurate or incomplete data, and update outdated data.
• Request erasure of your data, subject to any legal retention obligations described above.
• Withdraw consent for any processing that relies on it, at any time and as easily as you gave it.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Lodge a complaint with our Grievance Officer, and subsequently with the Data Protection Board of India if unresolved.

For any privacy question, data-rights request, or complaint, contact our Grievance Officer at grievance@greenhealtheasy.com or through our Contact Us form. We aim to acknowledge every request within 48 hours and resolve it within 30 days. If you remain unsatisfied, you may escalate your complaint to the Data Protection Board of India.

If we become aware of a breach that risks your personal data, we will investigate and contain it as our first priority, notify the Data Protection Board of India and affected users as required under the Digital Personal Data Protection Act, 2023, and take corrective action to prevent recurrence. We will tell you what happened, what data was involved, and what we're doing about it — in plain language, not legal boilerplate.