Privacy Notice & Data Processing Policy

Last Updated: July 1, 2026

Section 1. About Us

This Privacy Notice is published by MysticDoc Healthcare Private Limited (referred to as "UNO Care", "we", "us", or "our"). We are a healthcare technology platform that provides corporate health screenings, employee wellness programme, and patient consultations.

Registered Office:

253, Shri Krishna Avenue Phase 1, Lombodi, Khandwa Road, Indore, Madhya Pradesh – 452001, India.

Section 2. Grievance Officer

To exercise your data principal rights (access, correction, erasure, grievance redressal, or withdrawal of any consent), or to raise a complaint about this policy, please contact our Grievance Officer:

We aim to resolve all grievances within 7 business days.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India in the manner prescribed by the Board.

Section 3. Personal Data We Collect

We collect the following categories of personal data from employees (for corporate health camps), patients, vendors, and doctors:

• Identity & Contact: Full name, Father's name, Date of Birth, Mobile number, Alternate mobile, Email ID, City, Pincode.
• Financial Data: Razorpay payment receipts.
• Employment & Professional: Employee ID, Department, Designation.

How We Collect Your Data

We collect personal data:

1. Directly from you when you register, fill out health forms, or use our platform;
2. From your employer (for corporate health camps) when they provide employee rosters and basic identification details;
3. Automatically when you interact with our platform (e.g., IP address, session logs).

Sensitive Health Data (Highly Confidential)

1. Health Vitals & Physical Measurements
2. Pathology & Biochemistry Results
3. Diagnostic & Imaging Reports
4. Lifestyle & Habit Information
5. Clinical Documentation

Section 4. How We Use Your Data (Processing Purposes & Lawful Bases)

We process your personal data for the specific purposes set out below. For employee-related data (health screening, payroll, core healthcare records) and platform operations, we rely on legitimate uses under the DPDP Act, meaning we do not require your explicit consent for these internal processing activities. Where consent is required (sharing with your employer, or for non-employee patients), we obtain it separately.

Section 5. Sharing Your Health Data With Your Employer

For corporate health screenings, we will share your identified health screening results with your employer only if you give us explicit consent. This consent is obtained through a separate consent form before your results are shared.

You will be asked to choose one of the following three options:

• Share my full report: We share your name, employee ID, and complete medical report (all test results, doctor notes, and fitness certificate) with your employer.
• Share only out-of-range results: We share your name, employee ID, fitness certificate, and only the specific test values that fall outside the normal range (e.g., elevated cholesterol, high SGPT). The full medical report is not shared.
• Share anonymized insights only: We do not share your name or employee ID. We share only de-identified, aggregated statistics (e.g., "40% of screened employees had high blood pressure") with your employer.

Your choice is voluntary and will not affect your employment or the services you receive from us. You may change your sharing preference or withdraw this consent at any time by contacting our Grievance Officer (see Section 2). Withdrawal will be processed within 7 business days.

Safety-Critical Roles Exception

For roles governed by occupational health and safety laws (e.g., pilots, heavy machinery operators), certain medical fitness information may be required by regulation to be disclosed to the employer. In such cases, the legal obligation overrides the consent options above, and we will share the minimum data necessary to comply.

Important: Effect of Withdrawal

If you withdraw your consent after your health screening results have already been shared with your employer, UNO Care will immediately stop sharing any further data. However, the data already transmitted to your employer cannot be retrieved by us. Your employer becomes an independent Data Fiduciary for the data it has received, and its use of that data is governed by its own privacy policies. We are not responsible for the employer's subsequent handling of information already shared with your consent.

Section 6. Third Party Data Processors

We share your data with the following service providers who process data strictly on our behalf.

For Twilio, data may be processed in data centers outside India. We have conducted a voluntary Data Protection Impact Assessment and ensure that adequate contractual safeguards are in place to protect your data in compliance with Section 16 of the DPDP Act.

Legal Disclosures

In addition to the processors listed above, we may disclose your personal data:

• If required by law, court order, or a legally binding government request
• To enforce our terms of service or protect the rights, property, or safety of UNO Care, our users, or others
• To government authorities or law enforcement, in accordance with applicable laws.

Any such disclosure will be limited to what is strictly necessary and will be documented.

No Sale of Personal Data

We do not sell, rent, or trade your personal data to any third party for monetary consideration. Data sharing is limited to processors and lawful disclosures as described above.

Empaneled Diagnostic Labs & Partner Hospitals

Purpose: Conducting physical sample collection, laboratory testing, and imaging.
Data Shared: Name, Employee ID, Age, Gender, test-specific parameters.

Section 7. Data Retention

We do not retain data indefinitely. Our retention schedule is:

• Patient Health Records: 10 years from the date of last consultation (medical record-keeping standards).
• Employee Health & Payroll Records: Duration of employment + 7 years thereafter (statutory compliance).
• OTPs & Revoked Tokens: Purged automatically within 24 hours.
• Audit Logs: 3 years, then permanently deleted.
• Consent Records: Retained for 7 years after the consent is withdrawn or your account is closed, to demonstrate compliance with the DPDP Act.

Section 8. Your Data Principal Rights (DPDP Act Sections 11-14)

You have the following rights:

1. Right to access a summary of your personal data.
2. Right to correction of inaccurate or incomplete data.
3. Right to erasure when data is no longer necessary or consent is withdrawn (subject to legal retention requirements).
4. Right to withdraw consent for the employer sharing consent, or any other consent you have given, at any time. Withdrawal will be as easy as giving consent.
   1. How to Withdraw Consent: To withdraw consent for employer data sharing (or any other consent), you can email our Grievance Officer. We will process your request within 7 business days.
5. Right to grievance redressal — contact our Grievance Officer (Section 2). If dissatisfied, you may escalate to the Data Protection Board of India.

To exercise these rights, email our Grievance Officer. We will verify your identity and respond within a reasonable timeframe.

Section 9. Cross-Border Data Transfer

Your primary data (AWS S3 & RDS) is stored in India (Mumbai region). Certain communications routed via Twilio may be processed outside India. We ensure that any such transfer complies with Section 16 of the DPDP Act and is subject to a voluntary Data Protection Impact Assessment to manage risks.

Section 10. Our Responsibilities & Disclaimers

We take our obligations under the Digital Personal Data Protection Act, 2023 ("DPDP Act") seriously. The following statements explain what we are responsible for, and what we cannot be held liable for.

a. Compliance with Law

UNO Care is a Data Fiduciary as defined under the DPDP Act. We process your personal data in accordance with the provisions of the Act and the rules thereunder, including:

• Taking reasonable security safeguards to prevent personal data breach
• Notifying the Data Protection Board and affected Data Principals in the event of a breach as required
• Ensuring our data processors adhere to contractual obligations consistent with the DPDP Act
• Responding to your rights requests (access, correction, erasure, grievance redressal) in a timely manner.

b. Security Disclaimer

We implement industry-standard technical and organizational measures to protect your data. However, no method of electronic storage or transmission is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. You also have a responsibility to keep your login credentials confidential; we are not liable for any loss arising from your failure to do so.

c. Third-Party Links and Services

Our platform may contain links to third-party websites or integrate with services like Razorpay and Twilio. Once you leave our platform or interact with a third-party service, that third party's own privacy policy and terms govern the data they collect. We are not responsible for the data practices of any such third party beyond the contractual obligations we have placed on them as our data processors.

d. Limitation of Liability for Events Beyond Our Control

To the fullest extent permitted by law, UNO Care shall not be liable for any loss or damage arising from:

• Any unauthorized access to or loss of data that occurs despite our having taken reasonable security safeguards in compliance with the DPDP Act
• Any processing carried out by your employer or the corporate client after we have lawfully transferred the data pursuant to your consent and sharing option
• Any force majeure event (such as cyber-attacks by state actors, natural disasters, pandemics, or mandatory government orders) that makes performance impossible or impracticable.

e. Accuracy of Data Provided by You

We rely on the information you (or your employer) provide to us. We are not responsible for any consequences arising from inaccurate, incomplete, or outdated information that you or your employer has submitted. It is your responsibility to keep your information up to date and to request corrections where necessary.

f. Not a Medical Diagnosis or Advice

UNO Care is a technology platform that facilitates health screening and record-keeping. We do not provide medical diagnoses, treatment recommendations, or clinical decision-making. Any lab reports, vitals, or health summaries made available through our platform are for informational and employment-screening purposes only. Always consult a qualified medical professional for personal health advice.

g. Data Breach Notification

In the unfortunate event of a personal data breach, we will activate our incident response team (which includes our Grievance Officer and IT security personnel). We will promptly assess the severity and, if the breach is likely to result in harm to your rights, we will notify the Data Protection Board of India and affected Data Principals without undue delay, as required under the DPDP Act.

h. Your Obligations as a Data Principal

By using our services, you agree:

• To provide accurate and truthful information
• Not to impersonate any other person
• To keep your account credentials secure and not share them with anyone
• To respect the confidentiality of any medical information you may inadvertently have access that does not belong to you.

Section 11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children without the consent of a parent or guardian. If we become aware that we have collected such data without proper consent, we will delete it promptly.

Section 12. Data Integrity

We only process personal data for the purposes outlined in this policy. We take reasonable steps to ensure that the data we hold is accurate, complete, and up to date, and we rely on you to inform us of any changes.

Section 13. Changes to This Policy

We may update this Privacy Notice from time to time. We will notify you of material changes through our platform or via email. The "Last Updated" date at the top will reflect the latest version.

Section 14. Contact Us

For any questions or to exercise your rights, please contact: