Privacy Policy

We collect the information you provide when creating an account, booking appointments, or submitting diagnostic requests. For patients, this includes your full name, phone number, age, gender, address, and the specific diagnostic or consultation services requested. When you upload a prescription or diagnostic inquiry, clinical notes or test requisitions are processed. For staff and clinicians, we collect credential details, professional registrations, and operational logs. On our mobile applications, camera and location permissions are requested strictly for on-device barcode/sample scanning and finding nearby healthcare facilities.

Your personal and diagnostic data is utilized strictly to deliver requested healthcare operations: scheduling outpatient tokens, routing laboratory specimen pickups, securely archiving and delivering diagnostic test reports, generating itemized billing invoices, and providing verified customer support. We do not sell, rent, or trade your personal or medical data to any advertising brokers or unverified third parties.

MedFlow enforces strict tenant database and role-based access isolation. Each healthcare organization can only access patient records, appointments, and diagnostic data explicitly registered under its own facility. Your records are never disclosed or shared with unrelated providers on the platform without your verified consent.

Transactional notifications (e.g., OTP login verification, appointment token booking receipts, specimen collection confirmations, and WhatsApp/SMS delivery of finalized diagnostic reports) are service-essential communications. Promotional communications, health package updates, or marketing campaigns require separate opt-in consent and will always contain a clear, one-click opt-out or STOP mechanism.

Patients under 18 years of age may only use the platform under the active supervision of a parent or lawful guardian who registers on their behalf. Authorized caregivers or family representatives may submit appointment requests or receive diagnostic reports for dependents only with documented parental or patient authorization.

User account data is retained while your account remains active. Diagnostic laboratory results, OPD consultation records, and pharmacy dispensing records are retained in compliance with statutory medical record mandates (including National Medical Commission guidelines and Clinical Establishments Acts, requiring preservation for a minimum statutory period of three years, or longer as mandated by healthcare regulators).

We rely on vetted infrastructure providers for cloud hosting, secure object storage, SMS/WhatsApp gateways, and payment processing under rigorous non-disclosure and security agreements. Diagnostic test results, patient prescription attachments, and identifiable clinical records are strictly quarantined and never transmitted to third-party tracking, analytics, or behavioral advertising platforms.