Patient Confidentiality

Confidentiality sits at the heart of the relationship between you and the people who care for you. When you tell a clinician how you feel, you expect that trust to be respected — and we commit to respecting it.

This commitment rests on the duty of medical confidentiality under the National Medical Commission (NMC) / Indian Medical Council code of ethics and the Telemedicine Practice Guidelines, 2020, together with the health-data protections of the Digital Personal Data Protection Act, 2023 (DPDP Act). NovareHealth applies these to everything that happens on the novarehealthai.com platform.

This document explains, in plain language, what information we protect, who may access it, when your consent is needed, and what rights you have over your own record.

We treat as confidential all information that identifies you or relates to your health, including:

• your identity and contact details;
• the symptoms, complaints and reason for each consultation;
• diagnoses, clinical assessments and the clinician's notes;
• prescriptions, medicines, and test or lab results;
• your clinical record and care history;
• the notes and transcripts of your teleconsultations, which are part of your clinical record, and any audio or video recordings you have consented to.

The simple fact that you are our patient is itself confidential information.

Access to your record is restricted and based on a strict need-to-know rule. In principle, the people who may access your clinical information are:

• the clinician who is treating you;
• you, to your own record;
• authorised clinic staff, only where their role requires it (for example, scheduling, billing or support).

Every access to your record is captured in an audit log, so it is possible to know who saw what and when. Anyone not involved in your care has no access to your clinical information.

As a rule, and consistent with the Telemedicine Practice Guidelines, 2020 and the DPDP Act, your clinical information is shared beyond the team treating you only with your consent.

In concrete terms, this means that:

• sharing your record across different clinics happens only if you consent to it;
• bringing a second doctor into your consultation — for example, for a second opinion — happens only with your consent;
• you may withdraw your consent at any time, without that affecting the continuity of your care.

When you give consent, we ask for it clearly and specifically, so you know exactly what you are authorising.

The Meddy artificial-intelligence assistant, available through AskMeddy, is bound by exactly the same duty of confidentiality as a member of the health team.

Meddy processes your information only to assist you and your clinician with your care — for example, to organise information, support triage, or help prepare notes. It does not use your clinical record for purposes unrelated to your care, and its access is equally limited and audited.

Your consultation is transcribed to prepare your clinical notes — that transcript forms part of your medical record. Consistent with the Telemedicine Practice Guidelines, 2020, audio or video recording is separate and happens only if you consent. Before any recording begins, you are asked for consent and told what will be recorded.

These notes and transcripts are confidential clinical information, with the same protection and the same access rules as the rest of your record. You may decline audio/video recording without that preventing the consultation — or its transcription for your notes — from taking place.

We protect your information with appropriate technical and organisational measures, including encryption in transit and at rest, access controls, and audit logs.

Your health information is stored on infrastructure that respects the data-residency rules applicable to your region, in line with the DPDP Act, 2023 and good data-protection practice.

There are strict and exceptional situations in which the law permits or requires the disclosure of clinical information without your consent. These are only:

• where there is a serious and imminent risk of grave harm to you or to another person, and disclosure is necessary to prevent it;
• where a law or a court order requires it;
• where there is a legal duty of public-health or notifiable-disease reporting.

In these cases, we disclose only the minimum necessary, to the body competent to receive it, and we log the disclosure. Outside these exceptions, we do not share your information without your consent.

The record is yours and, under the DPDP Act, 2023, you have clear rights over it:

• to view your clinical information;
• to obtain a copy of your record;
• to request the correction of information that is inaccurate or incomplete.

You can exercise these rights through the platform or by contacting us. We will help you do so simply.

We take any failure of confidentiality very seriously. If an incident affects your information, we act to contain and remediate it, and we notify you — and, where applicable, the Data Protection Board of India (under the DPDP Act, 2023) — in accordance with the law.

If you are not satisfied with how we handle a concern, you may also escalate it to the Data Protection Board of India (under the DPDP Act, 2023).

When you manage a dependent's record — for example, a minor child or a family member in your care — the account holder is responsible for that record and may access the dependent's clinical information on their behalf.

This management always respects the dependent's confidentiality and the limits set by law, particularly as the dependent gains autonomy.

If you have questions or worries about the confidentiality of your information, talk to us — we are here to reassure you.

You can contact our data-protection lead at admin.in@novarehealthai.com or our support team at support@novarehealthai.com.

For a formal complaint, you may contact our Grievance Officer, Hemanth Kumar, at largebox.consulting@gmail.com. This commitment is governed by the laws of India.