Privacy policy

This policy explains how MedPrax (“we”) handles information you share through MedPrax Care.

What we collect

Contact details: name, phone number, email address and country.
Health information you choose to share: descriptions of your condition, medical reports and images.
Technical information such as pages visited, used to keep the site secure and improve it.

How we use it

To contact you about your enquiry and coordinate your care.
To help you choose a hospital. Your enquiry comes only to MedPrax. We share medical information with a partner hospital only after discussing it with you and with your agreement.
To arrange travel support you request, such as visa invitation letters.

Consent and your choices

We process health information only with your explicit consent, given when you submit an enquiry. You can withdraw consent, ask for a copy of your data or ask us to delete it at any time by writing to support@medprax.in.

Security and retention

Your enquiry, messages and medical files are encrypted and stored on Amazon Web Services under a HIPAA Business Associate Agreement. Only you (through your private page, opened with a one-time code) and the MedPrax care team can read them. Every time a member of our team opens your enquiry or a file, it is recorded. A partner hospital sees your information only after you agree. We keep enquiry data for as long as needed to provide the service and meet legal obligations, then delete it.

HIPAA

MedPrax Care is HIPAA compliant. We follow the HIPAA Privacy, Security and Breach Notification Rules for the health information you share on our platform. That means written security policies, trained staff, two-step sign-in for everyone on our team, a record of every time staff open your information, and Business Associate Agreements with the providers that host it.

Your rights

Whichever country you live in, you can ask us to:

give you a copy of the information we hold about you, in a portable format;
correct anything that is wrong or incomplete;
delete your information;
stop or limit how we use it, or withdraw your consent at any time (this doesn’t affect what we did before);
name someone to exercise these rights for you if you can’t.

Write to support@medprax.in from the email address on your enquiry. We reply within 30 days.

Children

For patients under 18, a parent or guardian sends the enquiry and gives consent on their behalf.

MedPrax is the controller of your information. We process your health information on the basis of your explicit consent (GDPR Article 9(2)(a)), and your contact details to answer your enquiry at your request (Article 6(1)(b)). MedPrax Care complies with the EU and UK General Data Protection Regulation.

Your information is stored in India (Amazon Web Services, Mumbai) and shared with a hospital in India only with your agreement, because that is where your treatment happens.
We keep it only as long as described above, then delete it.
You can complain to the data protection authority in your country, though we’d like the chance to put things right first.

Patients in India (DPDP Act 2023)

MedPrax is the Data Fiduciary for your personal data. We use it only for the purposes listed above and only with the consent you give when you send an enquiry; you can withdraw it as easily as you gave it. MedPrax Care complies with the Digital Personal Data Protection Act, 2023.

Grievance Officer: Kunal Chaturvedi, support@medprax.in. We respond to grievances within 90 days.
If we can’t resolve your concern, you can complain to the Data Protection Board of India.
If your personal data is involved in a breach, we will tell you and the Board as the law requires.

Email and WhatsApp

Our emails only tell you that something is waiting on your private page; they don’t contain your medical details. If you choose to message us on WhatsApp, those messages are handled by WhatsApp under its own terms, outside our platform. For anything medical, please use your private page.

Contact

Questions about privacy: support@medprax.in.