Privacy Policy

1. Who we are and what this policy covers

MMH is a platform operated by SYNVERTIX TECHNOLOGIES PVT LTD, #26, Krishnareddy Layout, Konappana Agrahara, Electronic City Phase-2, Near Vinayaka Temple, Bengaluru - 560100. MMH connects patients with independently verified doctors and hospitals across India. For the personal data described in this policy, SYNVERTIX TECHNOLOGIES PVT LTD is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and you are the Data Principal.

This policy is written to comply with the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and (until those provisions are replaced) the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It applies to patients, doctors, hospital/clinic accounts and their staff, and visitors to our website.

One important distinction: for the medical records a doctor creates about you (prescriptions, notes, uploaded reports), the treating doctor or hospital is responsible for the clinical content and for its medical-record retention duties; MMH stores and transmits that information on their behalf and on yours, as a technology platform.

2. What personal data we collect, why, and on what basis

We collect only what is needed for the purposes above (data minimisation). We do not use your health data for advertising, and we do not sell your personal data.

Aadhaar: Aadhaar is only one of five ID types — you are free to choose another. If you choose Aadhaar we read the card images you upload to check the card is genuine; we do not use Aadhaar for anything other than that verification, and the number is stored encrypted.

3. Legal basis — your consent, and limited legitimate uses

We process your personal data mainly on the basis of your free, specific, informed, unconditional and unambiguous consent, given by a clear affirmative action (a tick-box that is never pre-selected). At registration you consent separately to:

• General processing of your account data for the purposes in section 2
• Sharing your records with the doctor treating you (and, for a hospital-affiliated doctor, read-only visibility of prescriptions to that hospital's management for quality review)
• Marketing communications — optional, and never a condition of using MMH

Certain processing does not need fresh consent because the law permits it — for example responding to a medical emergency, complying with a court order or law, and preventing fraud. We will only rely on these "legitimate uses" where they truly apply.

Withdrawing consent: you may withdraw consent at any time, as easily as you gave it — use the in-app account settings / "Delete My Account" flow, or email us. Withdrawal does not affect processing already done, and we may keep records the law requires us to keep (section 9). If you withdraw consent that a feature needs, that feature may stop working.

4. Who can see your data

• Doctors see the records of patients they have treated (and records you grant them access to). A doctor cannot see another doctor's patients.
• Hospital management (for hospital-affiliated doctors) has read-only access to prescriptions issued under their hospital, for clinical quality review. They cannot edit them.
• Reception / front-desk / doctor's own staff see appointment and queue information; access to clinical content is limited to what the role needs.
• MMH Support has limited, logged access, only to resolve your support request.
• MMH Admin has oversight access for verification, platform operation and compliance.
• We do not disclose your data to any other doctor, hospital or third party without your consent, except as described in section 5 or where the law requires.

5. Service providers (Data Processors) we use

We use carefully chosen service providers who process personal data only on our instructions, under contract, and only for the purpose stated. Categories:

• Payment gateway and verification provider (Cashfree Payments India Pvt. Ltd.) — takes payments and payouts; verifies PAN, Voter ID, Driving Licence, Passport, Aadhaar-card images and bank-account holder names.
• Messaging providers — SMS, WhatsApp and push-notification services that deliver OTPs and appointment alerts (registered under TRAI's DLT framework).
• Cloud hosting and storage — servers located in India, where your data and documents are kept.
• Email delivery, maps/geocoding (to verify establishment locations and show distance) and speech-to-text (to turn a voice note into text).

We may also disclose data to government authorities, courts or law-enforcement agencies when we are legally required to (for example under a lawful order), and to our professional advisers under confidentiality. If MMH's business is ever merged or transferred, your data will only move on terms at least as protective as this policy, and you will be told.

6. Where your data is stored

Your data is hosted on servers located within India. If we ever use a processor that handles data outside India, we will do so only in accordance with section 16 of the DPDP Act and any restrictions the Government of India notifies, and we will update this policy first.

7. How we protect your data

• Sensitive fields (such as ID numbers and bank details) are encrypted at rest, and all traffic is encrypted in transit with TLS.
• Access is role-based and every access to sensitive records is logged, giving us an audit trail of who accessed what and when.
• One-time passwords and rate limits protect logins; staff accounts are separately permissioned.
• Uploaded documents are stored in private (non-public) storage and served only to authorised users.
• We take reasonable security safeguards as required by section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, 2025, and keep the logs the Rules require for at least one year.

No system is perfectly secure; please keep your password and OTPs private and log out on shared devices.

8. Your rights as a Data Principal

Under the DPDP Act, 2023 you have the right to:

• Access — get a summary of the personal data we hold about you, what we have done with it, and who we have shared it with
• Correction and completion — have inaccurate or incomplete data corrected, and outdated data updated
• Erasure — have your data erased when it is no longer needed for the purpose it was collected for (subject to legal retention — section 9)
• Withdraw consent at any time (section 3)
• Grievance redressal — complain to us first; if you are not satisfied you may complain to the Data Protection Board of India
• Nominate another person to exercise your rights if you die or become incapacitated

You can view and correct most details in your account. For anything else, email us (section 12); we will verify your identity and respond within 90 days at the latest, usually much sooner. Exercising your rights is free. You also have duties under the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

9. How long we keep data

• Account and profile data: while your account is active, and erased when you delete it, except as below.
• Financial and billing records: kept for the period required by tax and company law (up to 8 years), with personal identifiers redacted where possible.
• Medical records: doctors and hospitals are bound by medical-record retention rules (generally at least 3 years under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002). Your health-records vault entries are erased when you delete your account, but a doctor's own clinical record of a consultation may be retained by that doctor as the law requires.
• Security and access logs: at least one year, as the DPDP Rules require.
• Data we must keep to defend a legal claim or comply with a court/authority order is kept only until that need ends.

10. Children's data

A person under 18 is a child under the DPDP Act. If a patient is under 18, a parent or lawful guardian must create/authorise the account and give verifiable consent through our minor-consent flow before the account is activated. We do not track, profile or show targeted advertising to children, and we do not process a child's data in any way that could harm their well-being. The same applies to a person with a disability who has a lawful guardian.

11. If there is a data breach

If a personal-data breach affects you we will tell you without delay — what happened, its likely consequences, what we have done, what you can do to protect yourself, and who to contact — and we will report it to the Data Protection Board of India, with the detailed report within 72 hours, as the DPDP Rules require.

12. Grievance Officer and contact for privacy requests

For any privacy question, rights request or complaint, contact our Grievance Officer:

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational, after first raising your complaint with us.

13. Cookies, local storage and the offline app

We use only essential cookies and browser storage: your session, security (CSRF) token, chosen language, and — for the installable app — a service worker and local storage that let the live queue keep working during poor connectivity. We do not use advertising or cross-site tracking cookies.

14. Changes to this policy

We may update this policy when our practices or the law change. The "Last updated" date above shows the current version; for material changes we will notify you in the app or by email, and where the change needs your fresh consent we will ask for it.

15. Contact us

SYNVERTIX TECHNOLOGIES PVT LTD
#26, Krishnareddy Layout, Konappana Agrahara, Electronic City Phase-2, Near Vinayaka Temple, Bengaluru - 560100
Email: contact@synmmh.com · Phone: +91 - 9742 65 65 66 · 080 - 68 44 44 66