Privacy Policy

Depending on how you use our services, we may collect the following categories of personal data. We only ask for what we actually need — we don't collect data for the sake of it.

You can choose not to provide certain information, but that may limit some features. We may verify your phone number with a one-time password (OTP) sent to your phone, or through other verification modes.

Your information is used to:

• Process and deliver your medication orders, lab test bookings, and home nursing appointments.
• Verify prescriptions and facilitate consultation with registered medical practitioners.
• Send you order updates, refill reminders, appointment confirmations, and test results.
• Respond to your support queries, feedback, and complaints.
• Operate, evaluate, and improve our platform, website, and mobile application.
• Detect, prevent, and address fraud, illegal activity, and security threats.
• Comply with applicable laws, conduct audits, and maintain quality assurance.
• Send marketing messages about our services — but only with your consent, and you can opt out at any time.

Prescriptions are about as personal as it gets, and we treat them that way:

• Only the licensed pharmacist fulfilling your order can access your prescription — nobody else in the company can see it by default.
• Prescription images are stored encrypted and are never fed into any marketing or analytics system.
• We don't look at your prescriptions to figure out what ads to show you.
• We retain prescription records for a minimum of 2 years from the date of dispensing, as required under the Drugs and Cosmetics Act, 1940 and Rules, 1945.

We share your information only when it's necessary to deliver a service to you, or when the law requires it. All third parties are required to implement data protection measures at least as protective as those described in this policy.

We may collect, analyse, and use de-identified or aggregated data — from which your identity cannot be determined — for research, improving our services, and understanding customer behaviour and trends. This data may also be shared with partners and group entities in an anonymised and aggregate manner so they can understand how users use our platform. De-identified data is not subject to the same restrictions as personal data under this policy, provided it cannot be re-identified.

Our website uses cookies to work properly and to help us understand how people use it. We use:

You can turn cookies off in your browser settings, though some parts of the site may not work as well if you do. Most browsers allow you to control cookies, including whether to accept them and how to remove them. You can also set your browser to notify you when you receive a cookie.

We use WhatsApp and SMS to keep you updated on your orders, upcoming nurse visits, test results, and refill reminders. By giving us your phone number, you're okay with receiving these messages.

• To stop WhatsApp messages, send "STOP" to our WhatsApp number or email privacy@evirishealth.com.
• To opt out of SMS, reply "STOP" to any message, or register on the national DND registry via the TRAI DND app or by calling 1909.
• Opting out of marketing messages won't affect order confirmations and other transactional updates you need.

Messages you send us on WhatsApp are also subject to WhatsApp's own privacy policy, so it's worth reviewing that too.

When you use our mobile app, we ask for the following permissions to optimise your experience. You can change any of these at any time through your device settings.

We take security seriously. The measures we have in place include:

• All data in transit is encrypted using TLS 1.2 or higher.
• Health records and sensitive personal data are encrypted at rest.
• Access to patient data is restricted — only staff who genuinely need it can see it, under strict confidentiality obligations.
• Prescription images are stored encrypted and are never fed into any marketing or analytics system.
• No employee or administrator has knowledge of your account password.
• We run regular internal security audits and reviews, and are working toward alignment with ISO/IEC 27001 information security standards.
• Prescription storage and handling complies with the Drugs and Cosmetics Act, 1940, the Drugs and Cosmetics Rules, 1945, and CDSCO guidelines for digital prescription management.

That said, no system is completely immune. We keep improving our security and are working toward alignment with ISO/IEC 27001 information security standards. If you ever notice anything unusual with your account, please contact us straight away.

If we ever experience a data breach that could affect your personal information, here's what we'll do:

1. 1 Report the breach to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of becoming aware, as required under the CERT-In Directions, 2022.
2. 2 Notify affected users without unnecessary delay if their personal or health data was compromised, in line with the Digital Personal Data Protection Act, 2023.
3. 3 Tell you what happened, what data was affected, what it could mean for you, and what we're doing about it.
4. 4 Log and review every incident internally, regardless of how minor it seems.

If you think your data with us has been compromised, please email privacy@evirishealth.com straight away and we'll investigate.

We don't hold onto your data longer than we need to:

When we no longer need your data, we delete it, anonymise it, or archive it securely. Even after deletion, data may persist on backup or archival media for audit, legal, tax, or regulatory purposes.

Your data is hosted on secure servers. Some of our technology vendors — such as cloud hosting providers — may process or store data outside India. When this happens, we ensure appropriate contractual safeguards are in place to protect your data to the same standard we apply here, in compliance with the DPDPA 2023 and applicable cross-border data transfer requirements.

We only transfer personal data to recipients that ensure at least the same level of data protection as we provide under this policy, whether located in India or any other country.

Our platform may link to third-party websites — payment gateways, WhatsApp, partner portals. Once you leave our site, this policy no longer applies. We're not responsible for the collection or disclosure of your information by any external sites, and we'd recommend checking the privacy policies of any external sites you visit through us.

Our services aren't intended for use by children without a parent or guardian involved. If you are under 18, you may use our website or app only with the involvement of a parent or guardian. If we find that we've collected personal data from a minor without proper authorisation, we'll delete it promptly. If you are a parent or guardian and discover that your child under 18 has obtained an account, please alert us at privacy@evirishealth.com and we'll delete that information.

Under the Digital Personal Data Protection Act, 2023, you have the following rights over your data:

To use any of these rights, just email us at privacy@evirishealth.com. We'll respond to your request within 30 days.

We process your personal and health data only when we have a valid legal reason — primarily because you've given us consent, or because it's necessary to deliver the service you've asked for, or because we're legally required to. If we're relying on your consent, you can withdraw it at any time by writing to us. Withdrawing consent won't undo anything already done, but it may mean we can no longer provide certain services that depend on that data.

• You can update or delete your personal information through your account settings at any time.
• You can opt out of marketing messages — email, SMS, or WhatsApp — whenever you want.
• You can turn off cookies in your browser settings, though some site features may be limited.
• You can manage app permissions through your device settings at any time.
• Choosing not to share certain information is always an option, though it may limit some features.

We'll update this page when the policy changes and revise the date at the top. For significant changes, we'll also send you a notification by email or through the app. The updated version will be effective as soon as it is accessible on our website. We encourage you to review this policy periodically to stay informed about how we're protecting your information.

This policy is governed by Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any disputes relating to this policy fall under the jurisdiction of the courts in Hyderabad, Telangana.

If any provision of this policy is found to be invalid, illegal, or unenforceable, that provision will be deemed deleted to the extent required, and the remaining provisions will remain in full force.

If you have a concern about how we've handled your data, the best place to start is our Grievance Officer. Reach out and we'll acknowledge your complaint within 72 hours and resolve it within 30 days, in line with Rule 5(9) of the IT (SPDI) Rules, 2011. If you're still not satisfied, you can escalate to the Data Protection Board of India once it's constituted under the DPDPA 2023.