Your records,
your rules.

MediConsult exists because Indians deserved a healthcare platform that takes their data as seriously as their health. This policy explains — in plain language — what we collect, why, how we keep it safe, and how you can control it.

This policy applies to the mediconsult.life website. It does not cover the third parties we hand you off to — Razorpay for payment, Calendly for scheduling where a doctor’s calendar is hosted there, and Google Meet or Zoom for the video call itself. Each has its own policy.

Account: name, date of birth, gender, phone, email, profile photo.

Health: symptoms, prescriptions, lab reports, imaging and other records you upload or your doctor adds.

Bookings: doctors you searched and visited, slots, payment status, refunds.

Device: IP address, browser type, and crash logs to keep the platform stable.

To match you with the right clinician and process bookings.

To make your medical history available to the doctor you book — only at the moment of the consult, with your consent.

To send transactional messages (booking confirmations, reminders, refunds). You can opt out of marketing notifications at any time.

To meet our legal obligations and to fight fraud.

The doctor you book — and only that doctor — sees your relevant medical history for the duration of the consult.

Razorpay processes payments. Where a doctor’s calendar is hosted on Calendly, the scheduling step runs on Calendly, which receives your name and email so it can send you and the doctor the invite. Both are bound by their own privacy policies.

We never sell your data. We never use your health data for advertising. Full stop.

Read and correct your details from your dashboard at any time. For a full copy of your data, email us and we will send it to you.

Delete your account — email support@mediconsult.life and we erase your data within 30 days, except where law requires us to keep records (e.g. invoices for 7 years). We handle this by hand rather than behind a one-click button, so an accidental press can’t wipe your medical history.

Object to processing or restrict it. We respond within 7 days.

Complain to a Data Protection Officer. Ours is reachable at support@mediconsult.life.

Encrypted in transit. Every page and every API call is served over HTTPS/TLS.

Your password is stored only as a one-way hash (bcrypt) — nobody at MediConsult can read it. Password-reset links are stored hashed as well, are single-use, and expire.

Card details never reach us. Payment is completed on Razorpay’s own checkout, a PCI DSS Level 1 certified gateway, and we only ever receive the result.

Reports and prescriptions you upload are stored outside the public web folder, so they cannot be reached by guessing a URL. Every download runs an access check first.

Role-based access. You see your own records; a doctor sees only the patients who booked with them.

Hosted on our provider’s managed infrastructure in India. We do not transfer your health data out of the country for our own purposes.

What we do not claim: we are not ISO 27001 certified, we do not hold a third-party security audit, and we are not a HIPAA covered entity — HIPAA is a United States law and does not govern care delivered in India. We would rather describe the protections we actually run than display a badge we have not earned.

We use a small set of first-party cookies to keep you signed in and remember your preferences.

Any analytics we run is cookie-free and aggregate-only — it reports how many people visited a page, never who they were.

We do not run third-party advertising trackers.

For users under 18, we require a parent or legal guardian to set up the account and consent to processing.

A child’s records get exactly the same protections as an adult’s, and are visible only to the verified guardian and the doctor they book.

When we update this policy we change the date at the top of this page, and we keep the previous wording on file. For changes that materially affect how your data is used, we will contact you.

Material changes (new data uses, new third parties) require fresh consent. You can decline and continue using the platform with the older terms until 60 days have passed.

Email: support@mediconsult.life · DPO: support@mediconsult.life

Post: mediconsult.life, Satellite Road, Mota Varacha, Surat 394101.

Grievance officer: reachable at support@mediconsult.life (we aim to resolve within 7 days). Write to us and it goes to the person responsible for privacy complaints.