PRIVACY AND POLICY – MEDIELAJ

MedPredict Private Limited acknowledges the paramount importance of your privacy. We are committed to protecting the personal information of all Data Principals, including customers, employees, job applicants, and visitors to our website.

In accordance with our obligations under the Digital Personal Data Protection Act, 2023 (DPDPA), MedPredict Private Limited has established this Privacy Notice to ensure appropriate management of all personal information we collect or receive.

This Privacy Notice outlines the categories of personal information collected by MedPredict Private Limited. This Privacy Notice delineates the categories of personal information collected by MedPredict Private Limited, the legal grounds for such processing, applicable safeguards, and the mechanisms through which you may exercise your data protection rights regarding the processing of your personal information.

Our Commitment to You

We are committed to ensuring complete transparency in the management of your personal information. In fulfilling this commitment, we strictly adhere to the obligations set forth by the Digital Personal Data Protection Act, 2023. As a Data Fiduciary, we take our responsibilities with utmost seriousness, recognizing that your privacy is of significant importance.

Protecting Your Personal Data

MedPredict Private Limited is committed to protect your information by handling it responsibly and safeguarding it using appropriate technical, administrative and physical security measures.

Information We Disclose to Others

We share your Personal Data strictly as described in this Privacy Notice. Such sharing includes disclosure of your personal data to our affiliates, regulatory authorities (viz. NABH, NABL, and ABHA), subsidiaries, service providers, your authorized representatives in anonymized form so that your privacy remains intact. We may also transfer your personal data in circumstances involving corporate restructuring, mergers, or amalgamations to the concerned Data Fiduciary.

Purpose of collecting Personal Data

MedPredict Private Limited collects and processes your personal data only with your explicit consent or when permitted by the approved grounds of processing under DPDPA. We generally obtain this data through two methods: either you provide the data directly to us, or we collect it when you utilize our services.

Legitimate use under the DPDPA, Section 7, outlines specific circumstances where we can process your data without explicit consent. Legitimate use refers to the processing of personal data for purposes deemed lawful and necessary, even without the explicit consent of the Data Principals, listed hereunder.

• Data Principal voluntarily provided personal data for a specific purpose and has not objected to its use.
• For the State or its instrumentalities to provide subsidies, benefits, services, certificates, licenses, or permits.
• For any functions of the State related to sovereignty, integrity, and security.
• For legal obligations requiring disclosure of information.
• For compliance with judgments, decrees, or orders.
• During medical emergencies or public health threats.
• During disasters or public order breakdowns.
• For employment-related purposes such as preventing corporate espionage or maintaining confidentiality of trade secrets.

We collect and process your personal information when you visit our website or interact with our digital App to inquire about and also to avail the services we offer.

The following list specifies the various processing purposes for which MedPredict Private Limited collects and stores your personal data.

Your Rights as a Data Principal under the Digital Personal Data Protection Act (22 of 2023)

You retain control over your personal data, and we are steadfast in upholding your fundamental right to data privacy. The Digital Personal Data Protection Act 2023 confers upon you specific rights on your personal information which are enumerated hereunder.

1. Right to Information Access

You have the right to request a summary of your personal data, detailing the nature and categories of personal data processed by us, the processing activities undertaken, and the third parties with whom your data has been shared, including a description of the shared personal data. You can obtain an electronic copy of your personal data maintained in our records at no cost. Additionally, we provide clear documentation on how we utilize your information across our lending services, ensuring complete transparency in our data handling practices.

It is important to mention that this does not apply to any sharing of personal data by MedPredict Private Limited with another Data Fiduciary authorized by law to obtain such information, where sharing is based on a written request for the purpose of preventing, detecting, investigating offences or cyber incidents, or for the prosecution or punishment of offences.

2. Right to correction and erasure of personal data

We empower you to maintain control over your personal information through multiple channels. You may direct us to correct any inaccuracies in your personal information, update incomplete, irrelevant or inaccurate data in our systems, and also request complete erasure of your personal data from our records which is no longer necessary for the purpose for which it was processed unless retention is necessary for a legal purpose. We process all such requests with utmost priority while maintaining compliance with applicable regulations.

You have the right to withdraw your consent at any time. Because our platforms process data via our mobile application, you can easily exercise this right by clicking our Consent Withdrawal Deep Link, which will open the Privacy Settings directly on your device. Alternatively, navigate to Home > Profile Tab > Delete Your Account inside the MediElaj App.

3. Grievance Resolution Rights

We maintain a robust grievance redressal framework focused on protecting your privacy interests. This includes a dedicated data protection channel at MedPredict Private Limited and a structured grievance redressal mechanism. You have the right to register your grievances with us in respect of any act or omission regarding the performance of MedPredict Private Limited obligations in relation to fair processing of your personal data or the exercise of their rights under the DPDP. Our team upholds a strict commitment to address and resolve all privacy-related concerns within 30 days of receipt, ensuring prompt and effective resolution of your queries.

4. Right to Nominate

You retain the right to designate a nominee who shall exercise these rights on your behalf, ensuring continuity of data protection in the event of incapacity or death. This nomination can be modified at any time through our formal processes, providing you with flexibility in managing your data protection preferences and rights.

At MedPredict Private Limited, we manage your data rights requests promptly as per DPDP Act 2023 guidelines. To protect your privacy, we verify your identity before processing any requests. If we require additional time beyond standard processing periods, we will inform you of the expected completion date. In cases where we cannot fulfil a request, we will provide a clear explanation such rejection.

For assistance, contact our Data Protection Officer at dpo@medielaj.com.

Retention and Deletion

We ensure that your Personal Data is accurate and kept up to date. MedPredict Private Limited retains personal Data for as long as necessary for the purpose of processing, or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. Because these needs can vary for different data types and purposes, actual retention periods can vary.

Even if we delete your Data, it may persist on backup or archival media for audit, legal, tax or regulatory purposes.

Data Transfer Outside India

MedPredict Private Limited does not transfer data outside India as per the regulatory compliance but still in rarest cases if allowed by the Regulatory authority or if data is mandated by law to be shared then in such cases, MedPredict Private Limited will ensure secure and compliant transfer of personal data beyond Indian borders in accordance with the Digital Personal Data Protection Act 2023. We implement robust safeguards through:

• Adherence to transfer regulations specified by the Data Protection Board of India.
• Compliance with governmental restrictions on data flows to notified countries.
• Implementation of prescribed contractual safeguards for permitted international transfers.
• Regular monitoring of cross-border data protection requirements.

We maintain transparency in our international data processing activities and undertake transfers only to countries approved by the Central Government. For specific inquiries about our cross-border data practices, please contact our Data Protection Officer at dpo@medielaj.com.

Changes to this Privacy Notice

This Privacy Notice may be amended in response to changes in our privacy practices or upon directives from governmental authorities. Any modifications will be published on this website. If there are significant changes affecting the processing of your personal data, we will notify you via email or other available communication channels.

Duration of Data storage

Your personal data will be deleted once the specific purpose for which it was collected has been fulfilled. However, we will retain your data for the duration required by applicable laws and regulations. In compliance with our legal obligations, we will store your data until the end of the designated organizational retention periods. Additionally, your data will be retained until the expiry of applicable statutory limitation periods necessary to assert, exercise, or defend legal claims.

Once these periods have elapsed and the data is no longer necessary for the intended purposes, we will systematically delete the relevant data.

Link to other Websites

Our websites may feature buttons or tools that link to services provided by other companies. We encourage you to review the privacy policies of these external sites, as they may have their own privacy statements in place. Please note that we cannot be held responsible for the privacy practices of these external sites.

Data Protection Officer

The responsible party for the processing and protection of your personal data is MedPredict Private Limited.

If you have any questions regarding data protection or questions relating to the processing of your personal data or the exercise of your rights, please contact us by either using the contact form at the bottom of this page or at the following address, telephone number or email address:

How to Submit a Request

To submit an access, correction, or deletion request, you can use the Data Principal Access Request Form. To submit a request as an authorized agent on behalf of a consumer, contact us at support@medielaj.com. For questions or concerns about our privacy notices and practices, contact us at dpo@medielaj.com. If you have any concerns about our processing of your personal data, you are entitled to lodge a complaint with the Data Protection Board. You can find the contact details for the board in your jurisdiction here.

Disclaimer

Please note that only individuals who are 18 years of age or older, and who have the capacity to access our platforms, are permitted to share personal data with us.