Privacy Policy

Part A — Privacy Policy

In-app text MN-LD-002.privacy-policy, version 1.7, effective 27 October 2026.

PART II — PRIVACY POLICY

MetaNova MedTech Allianz Private Limited is the Data Fiduciary for the personal data described below. This Policy explains how we handle it. The separate Privacy Notice you are shown when you register is the statutory notice under Sections 5 and 6 of the Digital Personal Data Protection Act, 2023; this Policy sits alongside it and gives the fuller picture. Where the two differ, the Privacy Notice prevails.

19. Scope and role

19.1 This Policy covers all personal data processed through iNNeed 1.O, including in guest emergency sessions.

19.2 The Company is a Data Fiduciary. Providers who receive your data and use it for their own professional purposes — an RMP writing a clinical note, a hospital admitting you — act as Data Fiduciaries in their own right for that processing, and their own obligations apply to them.

19.3 Our technology and payment vendors act as Data Processors on our written instructions. We remain accountable to you for what they do, as Section 8(2) of the Act requires.

20. Data we process

20.1 Identity and contact data. Name, mobile number, email, date of birth, gender, relationship to patient, emergency contacts, nominee.

20.2 Location data. Live GPS coordinates and accuracy, derived route and journey trail, captured while your booking is active. Coarse location is captured at the moment you request emergency help.

20.3 Health and clinical data, being the category we treat with the greatest care: symptoms, complaints and history; allergies, medications and pre-existing conditions; clinical notes and observations recorded by the treating RMP; video and audio recordings of teleconsultations where a session is recorded (the patient is told at the start and may ask at the start that a session not be recorded), and teleconsultation logs; clinical chat and message histories with practitioners and with the Command Centre; digital prescriptions; discharge, handover and referral summaries; uploaded documents, images and reports; and — when introduced — laboratory and diagnostic reports and the metrics within them, and medicine orders routed to a licensed pharmacy.

20.4 Emergency response data. Request time, case state history, assigned Provider, vehicle and crew identity, receiving facility, and dispatch, arrival and handover timestamps.

20.5 Recordings. Command Centre calls may be recorded, after notice. Consultations may be recorded for the patient's medical record, for quality and safety, and as evidence in case of a complaint or dispute; when a session is recorded, the patient and the doctor are told at the start and a recording indicator is shown throughout. The patient may ask at the start that a session not be recorded, and the consultation still proceeds; notes, chat and prescriptions are always kept. Recordings form part of the medical record, are access-controlled, are retained under the retention policy and are disclosed only as the law requires or to resolve a complaint.

20.6 Payment data. Amount, fee breakdown, payment method type, transaction reference, invoice. We do not store full card numbers, CVV or banking credentials.

20.7 Device and technical data. Device model, operating system, app version, IP address, device identifier, and security and diagnostic logs.

20.8 Automated support data. Inputs to and outputs from automated triage and clinical decision support, and the record of human review or override.

20.9 We do not knowingly collect caste, religion, political opinion or trade union membership, and we do not ask for them. Where such information appears incidentally within a clinical narrative you or a practitioner provides, it is protected as clinical data and used for no other purpose.

21. Purposes and lawful bases

The table in section B of the Privacy Notice sets out, for each purpose, the lawful basis relied on. In summary, we rely on:

21.1 Section 7(f) of the Act — responding to a medical emergency — for the processing necessary to respond to an emergency involving a threat to life or immediate threat to health, of you or of another person. This is what allows us to locate you and dispatch help without first collecting your consent. We treat this basis narrowly: it covers the response and its immediate close-out, and it ends when your case does. It has never covered, and will never cover, marketing, profiling or advertising.

21.2 Sections 7(g) and 7(h) — for measures to provide medical treatment or health services during an epidemic, outbreak or other threat to public health, and for measures to ensure safety or provide assistance during a disaster or breakdown of public order.

21.3 Your consent under Section 6 — for everything else that is not covered by a legal obligation, captured through the individual permissions N-1 to N-6.

21.4 Legal obligation — for tax, accounting, company-law and regulatory record-keeping, and for disclosures we are compelled to make.

21.5 We record the lawful basis at the time of processing. We do not re-characterise the basis afterwards to suit a question we are later asked.

22. Disclosure

22.1 To Providers. The minimum necessary, and no more. An ambulance crew receives your location, destination and the clinical flags relevant to your transport — not your medical history. During an emergency trip, your assigned ambulance crew can call you, and you can call them, through the app. Your number is shared only for that trip. If you asked for help for someone else, the crew can call you too. An RMP receives what is clinically relevant to the consultation. A pharmacy receives the prescription and the delivery address.

22.2 To our Command Centre operators, who work under a protocol prohibiting export, download, print, screenshot or transmission of anything they see, and whose every access to a clinical record is logged.

22.3 To processors — cloud hosting, telephony, video infrastructure, messaging, payments and analytics — under written contracts limiting them to processing on our instructions.

22.4 To authorities, where legally compelled. We satisfy ourselves that a request is lawful, disclose only what is required, log every disclosure, and inform you where we are permitted to.

22.5 In a corporate transaction, to an acquirer, subject to this Policy continuing to apply.

22.6 What we never do. We do not sell your personal data. We do not share your health data with advertisers, data brokers, insurers or your employer. We do not use your health data to target advertising.

23. Cross-border transfer — United States hosting

23.1 Our application interface is delivered through infrastructure operated by Vercel Inc. Our back-end services and database run on the Base44 platform in a cloud environment hosted in the United States of America. Your personal data, including live location coordinates, video consultation logs and recordings, clinical chat histories, digital prescriptions and future laboratory reports and diagnostic metrics, is transferred to, stored on and processed in that environment.

23.2 Legal basis. Rule 15 of the Digital Personal Data Protection Rules, 2025 permits transfer of personal data outside India, subject to the Company meeting any requirement the Central Government specifies by general or special order in respect of making that data available to a foreign State or an entity under its control. We comply with any such order and maintain a live register of exactly which data classes are held where, so that we can respond quickly if one is issued.

23.3 Safeguards. Transport encryption in transit; encryption at rest; role-based access with named accounts; logging of every human access to clinical records; contractual commitments from our processors; and separation of our clinical data store from our operational, financial and verification systems.

23.4 The limits of those safeguards, stated plainly. Data held in another country is subject to that country's laws. A foreign authority may in some circumstances be able to compel access in ways Indian law would not permit. We cannot promise otherwise. We would rather you knew.

23.5 Your choice. Permission N-4 covers this transfer. We do not currently operate an India-resident processing environment, so if you are not willing for your data to be stored outside India we cannot provide you with a registered account. We say this rather than presenting the permission as optional when it is not. This does not affect your ability to request emergency help. The Company keeps under review whether to move its clinical data store into India.

24. Retention

As set out in section E of the Privacy Notice, and summarised: consent records, account life plus 7 years; emergency case records, 7 years; detailed location trail, 90 days; consultation records and prescriptions, at least 3 years per the Telemedicine Practice Guidelines, 2020 and thereafter while permission N-3 subsists; unconverted guest emergency records, automatically deleted 45 days after case closure; recordings, 12 months unless a claim is open; invoices and tax records, 8 years; access logs, at least 1 year.

At the end of a period, data is deleted or irreversibly de-identified. Where an obligation requires us to keep something after you have asked for erasure, we tell you specifically what we have kept and why.

25. Security

25.1 Encryption in transit and at rest; role-based access control with least privilege; individually attributed accounts with no shared credentials; logging of every access to clinical records, retained for audit; separation of the clinical data store from operational, financial and provider-verification systems; blocking of export, download and bulk extraction from the operator console; multi-factor authentication for staff and provider accounts; and periodic security testing.

25.2 Provider verification systems are architecturally isolated from clinical records. The systems that check whether a doctor's registration is valid have no ability to read what that doctor wrote about a patient.

25.3 Breach. If a personal data breach occurs we will inform each affected person without delay, describing what happened, what data was involved, the likely consequences and what we and they should do; and we will report it to the Data Protection Board of India within 72 hours of becoming aware of it, as Rule 7 requires. We maintain a breach register.

26. Your rights

26.1 You have the rights described in section F of the Privacy Notice: to obtain a summary of your data and of our processing and sharing; to correction, completion and updating; to erasure; to nominate a person to exercise your rights on your death or incapacity; and to grievance redressal.

26.2 Clinical records are not user-editable. A correction request against a prescription or a clinical note is routed to the practitioner who created it. Altering a medical record at a patient's request would be falsification, and we will not do it. The practitioner's response is recorded alongside the original.

26.3 Exercising a right. Profile → Privacy and Consent, or partners@metanovahealth.in. Acknowledged and completed within the time limits set by applicable law.

26.4 Withdrawal. Any permission can be withdrawn at any time, from the same screen where it was given, with the same effort. Withdrawal is prospective. We pass it on to our processors without undue delay.

26.5 Complaint. If we do not resolve your concern, you may complain to the Data Protection Board of India.

27. Children and vulnerable persons

27.1 Where the patient or user is under 18, verifiable consent from a parent or lawful guardian is required.

27.2 We do not undertake tracking or behavioural monitoring of children and we do not direct advertising at children. Permissions N-5 and N-6 are disabled and cannot be enabled on a minor's profile.

27.3 Similar protections apply to a person with a disability who has a lawful guardian.

27.4 None of this delays or prevents emergency assistance to a child or to anyone else.

28. Automated decision-making

28.1 We do not make decisions producing legal effects on you by automated means alone.

28.2 When automated triage is introduced, its outputs are informational and are subject to human review and override. The Company records, for every automated output that affects a case, whether the disclaimer was shown, whether a human reviewed it and whether a human overrode it. Outputs generated by software are identified as such.

29. Cookies and similar technologies

Our web interfaces use only strictly necessary and functional cookies, together with such analytics as you have permitted. We do not use advertising or cross-site tracking cookies on health-related surfaces.

30. Contact

MetaNova MedTech Allianz Private Limited

CIN U62099HR2026PTC144011 · Gurugram, Haryana, India

partners@metanovahealth.in

For any question about this Policy, to exercise a right, to raise a grievance, or to reach the person responsible for data protection at the Company, write to the address above.

31. Changes to this Policy

We publish the current version and its effective date. Where a change materially affects you, we will show it to you with a summary of what changed and, where the change requires it, ask for your permissions again.

Document MN-LD-002 (Privacy Policy) v1.7 — MetaNova MedTech Allianz Private Limited.

Part B — Privacy Notice

In-app text LX-02.dpdp-notice, version 1.6, effective 27 October 2026.

This is the statutory notice under sections 5 and 6 of the Digital Personal Data Protection Act, 2023, shown in the app before you give your permissions. Where it differs from Part A, this notice prevails.

NOTICE TO YOU ABOUT YOUR PERSONAL DATA

MetaNova MedTech Allianz Private Limited (CIN U62099HR2026PTC144011), a company incorporated in India with its registered office at Gurugram, Haryana, operating the iNNeed 1.O platform, is the Data Fiduciary for the personal data described in this notice. This means we decide why and how your data is processed, and we are accountable to you for it under the Digital Personal Data Protection Act, 2023.

This notice tells you, in plain language, exactly what we collect, why, who else sees it, where in the world it is stored, how long we keep it, and how you can withdraw your permission at any time. Please read it before you give the permissions on the previous screen.

A. The exact categories of data we handle

Identity and contact data. Your name, mobile number, email address if you give one, date of birth, gender, your relationship to the patient where you are booking for someone else, and the emergency contacts you choose to add.

Location data. Your live GPS coordinates, the accuracy of each fix, and the resulting route and journey trail, captured while a booking of yours is active. We capture your coarse location the moment you request emergency help, before you have done anything else, because that is the fastest way to send help to the right place.

Health and clinical data. The symptoms, complaints and medical history you or someone acting for you describes; your allergies, current medications and pre-existing conditions where you record them; the clinical notes and observations recorded by the registered medical practitioner who consults with you; video and audio recordings of teleconsultations where a session is recorded (you are told at the start, and you may ask at the start that a session not be recorded); chat and text message histories exchanged during a consultation or with our Command Centre; digital prescriptions issued to you; discharge and handover summaries; documents, images and reports you upload; and, when we introduce those services, laboratory and diagnostic test results, reports and the metrics contained in them, and the medicine orders routed on your behalf to a licensed pharmacy.

Emergency response data. The time you requested help, the state of your case at each moment, which independent provider was assigned, the identity of the vehicle and crew, the hospital or facility involved, and the timestamps of dispatch, arrival and handover.

Call and session recordings. Calls to and from our Command Centre may be recorded. Video consultations may be recorded for your medical record, for quality and safety, and as evidence if there is a complaint or dispute; when a session is recorded, you and the doctor are told at the start and a recording indicator is shown throughout. You may ask at the start that a session not be recorded, and the consultation still goes ahead; the doctor's notes, the chat and any prescription are always kept. A recording forms part of your medical record, is access-controlled, is kept under the retention policy and is disclosed only as the law requires or to resolve a complaint. You are told this at the start of each call and each session.

Payment and transaction data. The amount, the fee breakdown, the payment method type, the transaction reference and the invoice. We do not store your full card number, CVV or banking credentials — those go directly to our payment processor.

Device and technical data. Device model, operating system version, app version, IP address, and a device identifier used to keep your account secure.

Automated support data. When we introduce automated triage and clinical decision support, the information you provide to it and the suggestions it returns, together with the record of the human who reviewed or overrode each suggestion.

B. Why we process each category, and on what legal basis

C. Who else receives your data

• The independent providers who serve you — the registered medical practitioner you consult, the ambulance operator and crew who attend you, and the hospital or facility you are taken to. They receive only what they need. The ambulance crew, for example, receive your location, your destination and the clinical flags that matter for your transport; they do not receive your medical history. During an emergency trip, your assigned ambulance crew can call you, and you can call them, through the app. Your number is shared only for that trip. If you asked for help for someone else, the crew can call you too.
• Our Command Centre operators, who coordinate your case and who work under a strict protocol that forbids them from exporting, downloading, printing or photographing anything they see.
• Our technology and payment processors, who process data on our written instructions and only for us. We remain responsible to you for what they do.
• Government authorities, courts and law enforcement, where we are legally required to disclose. We will tell you when we are permitted to.

We do not sell your personal data. We do not share your health data with advertisers, data brokers, insurers or employers. If you have not ticked N-5, we will not market to you at all.

D. Where your data is stored — cross-border transfer

Please read this section carefully. It concerns the storage of your health information outside India.

The iNNeed 1.O application interface is delivered through infrastructure operated by Vercel Inc. Our back-end services and our database run on the Base44 platform in a cloud environment hosted in the United States of America.

This means that your personal data — including your live location coordinates, your video consultation logs and recordings, your clinical chat histories, your digital prescriptions, and, when we introduce those services, your laboratory reports and diagnostic metrics — is transferred to, stored on, and processed on servers physically located outside India.

We tell you plainly what protects that data and what does not:

• it is encrypted in transit using industry-standard transport encryption, and encrypted at rest on the hosting infrastructure;
• access is restricted to named, role-based accounts, and every access to your clinical records by a person is logged, including who they were and why they were entitled to look;
• our processors are bound by written agreements requiring them to process your data only on our instructions and to maintain security safeguards;
• this transfer is permitted by Rule 15 of the Digital Personal Data Protection Rules, 2025, which allows transfer outside India subject to any requirements the Central Government may specify. We maintain a register of exactly which categories of your data are stored where, and we will comply with any such requirement if one is issued;
• however, data stored in another country is subject to the laws of that country, and a foreign government or court may in some circumstances be able to compel access to it in ways that Indian law would not permit. We cannot promise otherwise, and we would rather tell you than not.

If you are not willing for your data to be stored outside India, we are not able to provide you with a registered iNNeed 1.O account, because we do not currently operate an India-resident processing environment. This does not affect your ability to call for emergency help.

E. How long we keep your data

When a retention period ends, the data is deleted. Where we are obliged to keep something after you have asked us to delete everything else — a tax invoice, for example — we will tell you exactly what we have kept and why.

F. Your rights, and how to use them

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• obtain a summary of the personal data we hold about you and what we do with it, and the identities of everyone we have shared it with. Use Profile → Privacy and Consent → Download my data;
• have inaccurate or incomplete data corrected, completed or updated. Profile fields you can edit yourself. A clinical record — a prescription or a doctor's note — cannot be edited by you or by us, because that would be falsifying a medical record; instead we route your request to the practitioner who created it, and their response is recorded alongside it;
• have your data erased when it is no longer needed. Use Profile → Privacy and Consent → Delete my data;
• nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Use Profile → Nominee. We encourage you to do this;
• complain to us, and if we do not resolve it, to the Data Protection Board of India.

G. Withdrawing your consent

You can withdraw any consent at any time, and it is exactly as easy as giving it was.

Go to Profile → Privacy and Consent. The same list of permissions appears, in the same order, with the same wording. Switch off any of them. That is the whole process — no email, no phone call, no form, no reason required.

Before you confirm, we will tell you plainly what stops and what continues. Withdrawing consent works from the moment you withdraw it; it does not make our earlier processing unlawful, and it does not cancel a booking that is already under way or erase an invoice we are legally required to keep.

If you withdraw a consent that is essential to a service — permission to process your data for the service itself, or to pass information to the provider serving you — we will not be able to provide that service, and we will say so plainly rather than degrade it silently.

You can also delete your account entirely from the same screen.

H. Children and people you are booking for

If you are under 18, a parent or guardian must consent for you, and we will verify that. We do not track children's behaviour and we do not send marketing to children — those options are switched off and cannot be switched on.

If you are booking for someone else — a parent, a spouse, a colleague — you are telling us that you are entitled to do so. The person receiving care has their own rights over their own records, and where they are able to exercise them, we will give them the ability to do so.

I. Security, and what happens if something goes wrong

We encrypt your data in transit and at rest, restrict access by role, log every access to clinical records, and retain those logs. If a personal data breach occurs, we will inform you without delay, tell you what happened and what to do about it, and report it to the Data Protection Board of India within 72 hours of becoming aware of it, as Rule 7 of the DPDP Rules, 2025 requires.

J. How to contact us

For any question about this notice, to exercise any right, to raise a grievance, or to reach the person responsible for data protection at MetaNova:

Email: partners@metanovahealth.in

MetaNova MedTech Allianz Private Limited, Gurugram, Haryana, India

We acknowledge and resolve grievances within the time limits set by applicable law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

K. Changes to this notice

If we change this notice in a way that materially affects you, we will show you the new version and ask for your permissions again. We will not rely on a fresh consent you never actually gave.

Notice version 1.6.

Part C — This website

C1. What we collect here

• What you tell us in a form: your name, phone number, email, city or area, organisation and role, and the details you choose to share (for example your speciality, fleet size or society size).
• Technical data: standard server logs (IP address, browser type, pages requested and time) kept by our hosting provider for security and reliability.
• Analytics, only if you allow it: which pages and buttons are used, without identifying you. See the Cookie Policy.

Please do not send health information through the website forms. They are for enquiries, applications and early access — not for medical requests. In an emergency, call 112.

C2. Why, and on what basis

To respond to your enquiry, application or early-access request and follow up about it; to verify and onboard providers who apply; to tell you when MetaNova is available where you live, if you asked; to keep the website secure and, with your consent, understand how it is used; and to meet legal obligations. We rely on the consent you give when you submit a form, and on legal obligation where the law requires us to keep records. You can withdraw consent at any time by writing to us.

C3. Who sees it

Only the people at MetaNova who need it to respond to you, and service providers acting on our instructions (website hosting, form delivery, email and, if you allow it, analytics) under written contracts. We disclose to authorities only where legally compelled. We do not sell personal data.

C4. How long we keep it

Website enquiries and applications are kept as long as needed to respond and to continue the relationship you asked for, and are deleted within 24 months of our last contact with you — sooner if you ask, unless the law requires us to keep them longer.

C5. Your rights and who to contact

You have the rights described in Part A, clause 26. Write to partners@metanovahealth.in, or contact our Grievance Officer, Uma Anand, as set out on Grievance Redressal. If we do not resolve your concern, you may complain to the Data Protection Board of India.