Privacy Policy

Large Box Consulting Pvt Ltd. (Private Limited Company), with registered office at 395/15, Vinayaka Layout, Immadihalli Main Road, Whitefield, Bengaluru, Karnataka, India 560066 and registered under CIN U74999KA2022PTC162194, operates the AskMeddy platform and the Meddy health assistant. Under the DPDP Act, 2023, NovareHealth is the Data Fiduciary that determines the purpose and means of processing your personal data, and you are the Data Principal.

When a clinic or health professional uses AskMeddy to provide care, that clinic is the Data Fiduciary for the clinical data it records, and NovareHealth acts as a Data Processor on its behalf.

Our Grievance Officer is Hemanth Kumar, reachable at largebox.consulting@gmail.com. For data-protection matters you may also write to admin.in@novarehealthai.com, and for general support to support@novarehealthai.com.

This Policy applies to the sites on the novarehealthai.com domain, the AskMeddy mobile and web apps, teleconsultations, the health records vault and all interactions with the Meddy assistant.

Consistent with the DPDP Act's notice requirement, this Policy itemises the personal data we collect, the purposes for which it is processed, how you may exercise your rights, and how you may complain to the Data Protection Board of India. We will seek your consent before processing, and our requests for consent are presented in clear and plain language.

We collect the following categories of personal data:

• Account data: name, password (in encrypted form), language and region, role (patient, clinician, employer).
• Contact data: email address, phone number and, where relevant, a delivery address for medicines.
• Demographic data: date of birth, sex, and data of dependents you add under your responsibility.
• Device and usage data: IP address, device and browser type, identifiers, pages visited and event logs, for security and service improvement.
• Payment data: handled by our payment providers; we do not store full card details.

The service involves processing health information, which is sensitive personal data or information (SPDI) under the IT Act, 2000 and the SPDI Rules, 2011, and personal data under the DPDP Act. This includes:

• Symptoms, complaints and history you describe to Meddy or your clinician.
• Medical records and documents you upload to your health vault.
• Prescriptions, lab orders and results.
• Vital signs and measurements you record.
• Transcripts and notes generated from your teleconsultations.

We collect and process such data with your consent and only for the purposes you are notified of, in accordance with the SPDI Rules and the DPDP Act. You can withdraw your consent at any time, as described in the rights section.

We use your data to:

• Create and manage your account and authenticate you securely.
• Enable consultations, scheduling, prescriptions and deliveries.
• Let the Meddy assistant support you — for example, organising your history, summarising records, suggesting triage questions and helping your clinician prepare notes.
• Communicate with you about appointments, reminders and service changes.
• Keep the service secure, prevent fraud and meet legal obligations.

It is important to be clear about the role of AI: Meddy is decision-support, consistent with the principle that telemedicine tools assist a registered medical practitioner. It does not replace a clinician's judgment and does not autonomously diagnose or prescribe. Its suggestions are intended to be reviewed by you and your clinician, who retains clinical responsibility.

Sensitive data is not used for advertising.

Under the DPDP Act, our primary basis for processing is your consent, which is free, specific, informed, unconditional and unambiguous, given for a notified purpose. We process personal data only for that purpose and limit collection to what is necessary.

Where permitted, we may also process data for certain legitimate uses recognised under the Act. You may give, manage or withdraw consent directly, and we will support consent given or withdrawn through a Consent Manager registered with the Board, where you choose to use one.

We share data only as needed and under contract with the following Data Processors and recipients:

• Clinicians and clinics you choose to see, so they can provide care and maintain the clinical record.
• Payment providers, to process transactions.
• Video infrastructure (LiveKit) that supports teleconsultations.
• AI model providers that process Meddy requests under contracts limiting use to the service's purposes.
• Government and regulatory authorities, where required by law or a lawful order.

We do not sell your personal data. Each Data Processor is bound by contract to process data only on our instructions and to maintain reasonable security safeguards.

We operate by region. Data associated with the India deployment is held on that region's infrastructure, and we aim to minimise transfers outside it.

Where any transfer outside India is necessary — for example, to an infrastructure processor — we do so subject to applicable restrictions under the DPDP Act and appropriate contractual safeguards, and we continue to protect that data under this Policy.

We keep personal data for as long as needed for the notified purposes, or for the period required by law — in particular clinical records subject to retention requirements applicable to medical records and telemedicine.

When the purpose is served and retention is no longer required, we erase your personal data and require our processors to do the same, save where law requires otherwise.

As required by the DPDP Act and the SPDI Rules, we maintain reasonable security safeguards, including encryption in transit and at rest, role-based access control, audit logging and environment segregation, to prevent breaches.

No system is entirely free of risk; we work continuously to protect your data and train our team in confidentiality and security.

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of your personal data and the processing activities undertaken.
• Correct, complete, update and erase your personal data.
• Withdraw consent as easily as it was given, and object to further processing.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Grievance redressal through our Grievance Officer, and portability of the data you provided to us.

To exercise these rights, contact Hemanth Kumar at largebox.consulting@gmail.com, or admin.in@novarehealthai.com. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We use cookies and similar technologies to keep your session signed in, remember your preferences (such as language and region) and measure service performance.

You can manage cookies in your browser settings; disabling some may affect essential features.

Where a user is a child (under 18) or a person with disability with a lawful guardian, we process personal data only after obtaining verifiable consent from the parent or lawful guardian, as required by the DPDP Act. In practice, a child's health data is handled under the responsibility of the adult who adds them as a dependent.

We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

In the event of a personal data breach, we will take steps to contain it and will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required by the DPDP Act.

We may update this Policy and will publish the revised version on novarehealthai.com with the update date; material changes will be communicated. For privacy matters, contact our Grievance Officer Hemanth Kumar at largebox.consulting@gmail.com, admin.in@novarehealthai.com, or support at support@novarehealthai.com.

If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India (under the DPDP Act, 2023). This Policy is governed by the laws of India, and the courts at Bengaluru, India have jurisdiction.