Privacy Policy

01About this policy and the two apps it covers

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It covers both of the mobile applications we publish on Google Play.

Throughout this policy, “the Apps” means both applications together. Where something applies to only one of them, we name that app explicitly.

02Who we are

The Apps are published and operated by Cellbeans Healthcare Informatics Private Limited, a company incorporated in India.

In this policy, “we”, “us” and “our” mean Cellbeans Healthcare Informatics Private Limited.

Who controls your health data

The Apps are supplied to hospitals and clinics, which we call Healthcare Providers. For your clinical records — diagnoses, prescriptions, case papers and consultation notes — the Healthcare Provider treating you decides how those records are used, and we hold and process them on that provider’s instructions.

For your app account itself, including your login, your device permissions and your notification settings, we are the party responsible. If you want a clinical record corrected, the fastest route is usually your Healthcare Provider. You can always come to us instead, using the contact details in section 15, and we will help either way.

03What we collect

3.1 MEDSEVA PATIENT

MEDSEVA PATIENT has no profile photograph feature and never asks for access to your photos, camera roll or files.

3.2 MEDSEVA DOC

MEDSEVA DOC does not collect location data and never asks for location permission.

3.3 What we do not collect

• We do not collect your contacts, call logs, SMS messages or calendar.
• We do not collect your location, in either app. Neither app package declares any location permission at all, so neither can request or receive your position, in the foreground or the background.
• We do not use advertising identifiers. Neither app contains third-party advertising or analytics software, and neither app sends a push notification token anywhere — reminders are scheduled on your own device.
• We do not collect, store or transmit your payment details. The Apps do not take online payments, and never ask for card, UPI or netbanking details. Bills raised against your treatment are settled directly with the hospital or clinic; the bill record the app displays is described in section 3.1.
• We do not record, store or listen to your video consultations. See section 5.
• We never sell your personal data, and we never share health data for advertising.

04Device permissions, and exactly when each is used

Android asks your permission before granting any of the permissions marked below as prompted. You can refuse, or revoke permission later in Settings, then Apps, then the app name, then Permissions. Refusing a permission disables only the feature that needs it; the rest of the app keeps working.

05Video consultations

Video consultations use Jitsi Meet technology, running on our own video consultation server and displayed inside the app. Your Healthcare Provider’s system issues a private room for each individual appointment; no one can dial you, and nobody outside that appointment can join. When you join a call:

• Your camera and microphone streams are transmitted to the other participant over an encrypted connection, for the duration of the call only.
• We do not record calls, and we do not store audio or video afterwards.
• The room name, the join time and the call duration are logged, so that the consultation can be recorded as having taken place.
• Your display name is visible to the other participant.
• You can turn your camera or microphone off at any time during the call, using the in-call controls.

Please do not screenshot or record a consultation without the other person’s consent.

06How we use your data

We use the information described above to:

• create and maintain your account, and sign you in;
• book, reschedule, cancel and remind you about appointments;
• deliver video consultations;
• create, store and display clinical records, prescriptions and case papers to you and to your treating doctor;
• display the bills the hospital has raised against your treatment;
• verify a doctor’s professional credentials before granting access to clinical data;
• respond to your support requests and act on your feedback;
• keep the service secure, by detecting unauthorised access, investigating misuse, and maintaining audit logs of who viewed which record;
• meet our legal, medical record-keeping, tax and regulatory obligations.

We do not use your data for advertising, for profiling, or for automated decisions that produce legal or similarly significant effects on you.

07Our legal basis

We process personal data under the Digital Personal Data Protection Act, 2023, and, where applicable, under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which classify health and medical records as sensitive personal data.

Our basis is your consent. You give it when you accept this policy and the in-app consent screen at registration, and again separately each time you grant a device permission. Where we are required to keep records to comply with a legal obligation, such as medical record retention or tax law, we rely on that legal obligation, and we cannot delete those records on request until the retention period has expired.

You may withdraw your consent at any time, as described in section 11. Withdrawing consent does not affect processing already carried out, and it may mean we can no longer provide the service to you.

08Who we share data with

Each Healthcare Provider’s data is kept in a separate database, so one clinic cannot see another clinic’s patients.

We do not sell personal data to anyone, for any purpose.

09Where your data is stored

Your data is stored on servers hosted with Amazon Web Services in the Asia Pacific (Mumbai) region, in India. All communication between the Apps and those servers uses HTTPS. If we ever transfer data outside India, we will do so only to countries not restricted under the Digital Personal Data Protection Act, 2023, and under appropriate contractual safeguards.

10How long we keep it

11Your rights, and how to exercise them

You have the right to:

• know what personal data we hold about you, and who we have shared it with;
• have data corrected where it is wrong, and completed where it is incomplete. Profile details can be edited in the app; clinical entries are corrected by the doctor who wrote them, on request;
• have your data erased and your account deleted, as described in section 12;
• withdraw your consent at any time, as easily as you gave it;
• nominate another person to exercise these rights on your behalf, if you die or become incapacitated;
• complain to our Grievance Officer, whose details are in section 15, and then to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, write to support@cellbeans.com from the email address or phone number registered on your account. We respond within 30 days. There is no charge.

12Deleting your account

You can ask us to delete your account and the personal data associated with it, without installing anything, in either of these ways:

• Complete the account deletion request form for your app:
  MEDSEVA PATIENT — https://forms.gle/Qt4MkVF6KNLpwej86
  MEDSEVA DOC — https://forms.gle/v3rsb5sxL5teKSgm6
• Or email support@cellbeans.com with the subject “Delete my account”, from the email address registered on your account.

We will verify that the request comes from you, and then delete your data within 30 days. We will confirm by email when it is done.

What is deleted: your login credentials, session tokens, profile details, contact details, profile photograph, feedback and notification settings.

What is kept, and why: clinical records and billing records must be retained for the periods set out in section 10, because Indian medical record-keeping and tax law require it. Those records are de-linked from your app login and are no longer accessible through the Apps. They are deleted once the retention period ends. For a doctor’s account, records of the clinical entries you authored remain within the patients’ medical records, as they must.

13Security

We take reasonable technical and organisational measures to protect your data. These include:

• encryption of data in transit between the Apps and our servers, using HTTPS with TLS;
• token-based authentication, with each session tied to a token that expires;
• role-based access control, so that a doctor sees only their own patients, and each Healthcare Provider’s data sits in its own database;
• audit logging of access to clinical records;
• one-time password verification for login and for password reset.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India, as the law requires.

14Children and dependants

MEDSEVA PATIENT is not intended for independent use by anyone under 18. A parent or legal guardian may register and manage a child’s care from their own account, and by doing so confirms that they have the authority to provide the child’s health information. We do not knowingly create accounts for children without verifiable parental consent, and we do not use children’s data for tracking or for targeted advertising. If you believe a child has registered without consent, write to support@cellbeans.com and we will remove the account.

MEDSEVA DOC is restricted to registered medical practitioners and clinical staff.

15Contact us

For any privacy question, data rights request, or security concern:

We acknowledge every grievance within 24 hours, and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

16Medical disclaimer: not for emergencies

Information in the Apps supports the relationship between you and your doctor. It does not replace an in-person examination where one is clinically necessary. Teleconsultations are provided in line with the Telemedicine Practice Guidelines, 2020, issued under Indian law.

17Changes to this policy

We will update this policy when our practices change. The version number and the effective date at the top always tell you which version you are reading. For material changes, such as a new category of data, a new recipient or a new purpose, we will notify you in the app and, where the law requires it, ask for your consent again. Continuing to use the Apps after a change means that you accept the updated policy.

This version, 1.1, replaces version 1.0 of 1 September 2026. It corrects the account deletion instructions, removes descriptions of features that are not enabled in the current release, and states our device permissions exactly as they appear in the published app packages.