Privacy Policy

This Privacy Policy explains how Medsta collects, uses, stores, shares, protects, and processes personal information, health-related information, provider information, and other data when users, patients, family members, caregivers, healthcare providers, partners, or visitors use Medsta websites, services, WhatsApp support, forms, health camps, digital tools, provider platforms, or related services.

For this Privacy Policy, Medsta, we, us, and our refer to the Medsta platform and its operator. You or user may refer to a patient, family member, caregiver, visitor, healthcare provider, provider representative, staff member, field executive, or any person interacting with Medsta.

This Privacy Policy applies to Medsta websites, user and provider portals, admin and field-support systems, WhatsApp communication, phone calls, SMS, email, social media interactions, Google Forms, registration forms, health camp forms, booking forms, provider onboarding forms, provider dashboards, offline health camp data collection, and any current or future Medsta service or communication channel.

Healthcare information is personal and sensitive. It may include prescriptions, reports, test results, symptoms, health conditions, medicines, doctor recommendations, family health information, age, gender, address, and other details. Medsta collects and processes health-related information only to provide, coordinate, improve, manage, verify, support, or communicate healthcare-related services. Medsta does not sell personal health information.

When users interact with Medsta, we may collect information needed to understand the healthcare need, coordinate services, manage payments, support users, and keep service history organized.

• Identity information such as full name, patient name, age or date of birth, gender, caregiver or guardian name, relationship with the patient, and health camp registration details.
• Contact and location information such as mobile number, WhatsApp number, email, address, area, locality, city, landmark, delivery address, sample collection address, alternate contact, emergency contact where voluntarily provided, and GPS location only if enabled or shared.
• Health and medical information such as prescriptions, diagnostic reports, lab results, medical history, symptoms, chronic conditions, allergies if voluntarily shared, medicine requirements, doctor notes, follow-up requirements, vitals collected at camps where applicable, and family health records voluntarily shared.
• Service and transaction information such as services requested, bookings, order status, appointment time, selected packages, preferred provider, cancellation or rescheduling details, complaints, feedback, service history, follow-up history, and reminder preferences.
• Payment and billing information such as payable amount, payment status, transaction references, payment gateway IDs, invoice details, refund status, coupon usage, and billing contact details. Medsta does not intend to store complete card details or sensitive banking credentials except through secure and legally permitted payment systems.
• Communication information such as WhatsApp messages, SMS, call notes or recordings where permitted and informed, emails, support tickets, complaints, feedback, chat history, consent confirmations, booking confirmations, and reminder responses.
• Website and device information such as IP address, browser type, device type, operating system, pages visited, date and time of visit, referral source, cookies, session data, error logs, and performance data.

Users may share information about family members, elderly parents, children, spouses, or dependents for healthcare coordination. When a user shares information about another person, the user confirms that they have the authority, consent, or lawful basis to share it. Medsta may collect information about children only when shared by a parent, guardian, or authorized caregiver for healthcare-related services. Medsta does not knowingly collect information about children for targeted advertising or unrelated commercial profiling.

When healthcare providers or partners interact with Medsta, we may collect information needed for onboarding, verification, listing, service coordination, settlement, compliance, and quality management.

• Provider identity and business information such as provider name, business name, legal entity name, owner or representative name, staff name, role, registration details, professional registration, pharmacy license, diagnostic center registration, hospital or clinic registration, GST, PAN, address proof, and business proof where applicable.
• Provider contact information such as mobile number, WhatsApp number, email, business address, branch address, reception number, owner or manager contact, staff contact, and provider support contact.
• Provider service information such as service categories, test menu, doctor specialties, timings, pharmacy services, home sample collection availability, physiotherapy service areas, home healthcare services, ambulance availability, pricing, discounts, turnaround time, coverage areas, slots, operating hours, staff availability, equipment, facility details, and facility images.
• Verification and trust information such as licenses, certifications, degrees, registration numbers, business documents, identity documents, accreditation details, bank verification details, facility photographs, publicly available provider information, reviews, ratings, feedback, and service quality data.
• Financial and platform information such as bank account details, UPI ID, GST, PAN, invoices, commission structure, settlement history, refund or adjustment details, dashboard usage, booking acceptance or rejection data, response time, uploaded reports or prescriptions, provider notes, support requests, and performance data.

Medsta may collect information through website forms, WhatsApp messages, phone calls, SMS, email, health camp registration forms, Google Forms, provider onboarding forms, provider dashboards, admin dashboards, partner forms, social media messages, QR code scans, offline forms at societies, schools, gyms, camps or community events, prescriptions or reports shared by users, provider-submitted reports and invoices, payment partners, customer support conversations, and direct interactions with Medsta staff, field executives, or care coordinators.

Medsta may use user, patient, family, and caregiver information for the following purposes.

• Understand healthcare needs and coordinate diagnostics, medicines, doctor consultations, physiotherapy, home healthcare, health camps, reports, reminders, and recurring care.
• Share necessary details with relevant healthcare providers to complete bookings, collect samples, deliver medicines, provide reports, confirm appointments, conduct consultations, handle follow-ups, and generate bills.
• Manage reports, prescriptions, service history, repeat care, refill reminders, repeat test reminders, follow-up reminders, report collection, health package renewals, and preventive checkups.
• Communicate through WhatsApp, calls, SMS, email, website notifications, or social media for service confirmation, reminders, customer support, payment updates, offers, feedback, or complaint resolution.
• Process payments, generate bills, confirm transactions, issue refunds, reconcile provider settlements, maintain accounting records, and prevent payment fraud.
• Improve user experience, provider matching, response time, health camp operations, local healthcare demand planning, website design, customer support, offers, packages, and recurring healthcare workflows.
• Verify requests, prevent misuse, detect fraud, investigate complaints, protect users and providers, maintain platform integrity, enforce policies, and comply with legal obligations.

Medsta may use provider and partner information to onboard and verify providers, create provider profiles, list services, map service areas, route user requests, confirm availability, assign bookings, coordinate reports and medicine orders, manage settlements, calculate commissions, generate invoices, monitor service quality, review complaints, prevent fake listings, improve provider ranking or assignment, and communicate about bookings, users, reports, onboarding, training, settlements, offers, complaints, or partnership updates.

Medsta may process information based on consent, performance of requested services, legal obligations, and legitimate platform safety purposes such as fraud prevention, misuse prevention, dispute handling, account security, payment reconciliation, and compliance. Consent may be provided by submitting a form, sharing information on WhatsApp, uploading a prescription or report, registering for a camp, booking a service, signing up, agreeing to provider onboarding, continuing to use Medsta services, or giving written, digital, oral, or implied permission where legally permitted. Where processing is based on consent, users and providers may withdraw consent, but withdrawal may affect the ability of Medsta to provide active or future services.

Medsta may share user information only where necessary for service delivery, support, safety, legal compliance, or authorized operational purposes.

• Healthcare providers such as diagnostic centers, hospitals, doctors, clinics, pharmacies, physiotherapists, home healthcare providers, ambulance providers, nurses, medical professionals, health camp partners, and other relevant providers.
• Family members, caregivers, or authorized persons involved in the healthcare journey where the user requests or permits such coordination.
• Trusted technology and operational service providers such as cloud hosting providers, CRM tools, WhatsApp Business service providers, SMS providers, email providers, payment gateways, analytics providers, customer support tools, data storage tools, security tools, logistics partners, form tools, and survey tools.
• Payment partners such as payment gateways, UPI providers, banks, accounting tools, settlement partners, and tax or invoice systems.
• Legal, regulatory, tax, law enforcement, court, or dispute-resolution authorities where required or permitted by law.
• Advisors, investors, acquirers, or legal entities involved in a merger, acquisition, investment, restructuring, sale of assets, or similar business transaction, subject to confidentiality and applicable law.

Provider details may be shared with users, internal Medsta teams, payment and accounting partners, legal or regulatory authorities, and approved marketing or community channels. This may include provider name, location, services, timings, pricing, offers, specialty, ratings, reviews, contact or appointment information where applicable, availability, profile information, financial details required for settlement, and documents required for verification or compliance.

Providers who receive patient or user information through Medsta must use that information only for the specific service requested, keep it confidential, limit access to authorized staff, not sell patient data, not use patient data for unrelated marketing without proper consent, not disclose patient data to unauthorized third parties, follow applicable healthcare and privacy laws, inform Medsta immediately of suspected misuse or unauthorized access, and delete or return patient data where required and legally permitted.

Medsta retains information for as long as necessary to provide services, maintain service history, support recurring healthcare needs, send reminders, manage shared reports and prescriptions, resolve disputes, maintain provider records, process payments and settlements, comply with legal, tax, accounting, healthcare, or regulatory obligations, prevent fraud, and improve services. Information may be stored on servers, cloud systems, CRM tools, communication platforms, payment systems, or operational tools located in India or outside India, subject to applicable law. When information is no longer required, Medsta may delete, anonymize, archive, or securely restrict access to it.

Medsta uses reasonable technical, organizational, and operational safeguards to protect personal information and health-related information. These may include access controls, password protection, role-based access, restricted internal access, secure storage systems, backup practices, confidentiality expectations, secure communication practices where possible, monitoring for unauthorized access, process controls, limited sharing based on service need, and vendor security review where practical. No digital system, WhatsApp communication, internet transmission, or electronic storage method is completely secure, so users and providers should also take care while sharing sensitive documents, OTPs, payment information, and login details.

Medsta may operate through WhatsApp-first communication, phone calls, SMS, email, Google Forms, website forms, and other third-party tools. Those platforms may process data under their own privacy policies and terms. Medsta websites may use cookies, pixels, tags, analytics tools, or similar technologies to remember preferences, improve performance, analyze traffic, understand visitor behavior, improve experience, measure campaigns, detect errors, and improve security. Users may disable cookies in browser settings, but some features may not work properly.

With appropriate consent or where permitted, Medsta may send healthcare offers, diagnostic discounts, medicine offers, health camp updates, subscription plan updates, preventive health reminders, new service announcements, and community healthcare programs through WhatsApp, SMS, phone, email, or other channels. Users may opt out of promotional communication by contacting Medsta or following available opt-out instructions. Service-related communication may continue for active bookings, payments, reports, safety updates, support, legal notices, and operational requirements.

Subject to applicable law, users may request access, correction, updating, completion, deletion or erasure where legally permitted, consent withdrawal, details about use of information, grievance redressal, nomination of another person to exercise rights where applicable, and opt-out from promotional communication. Providers may request access to provider profile information, correction of inaccurate details, updates to service, pricing, timing or contact information, removal or deactivation of listing subject to active obligations, settlement clarification, deletion of certain provider information where permitted, and opt-out from certain promotional uses of provider branding subject to partnership terms. Medsta may verify identity before acting and may refuse or limit requests where retention or processing is required for law, dispute, tax, audit, fraud prevention, healthcare, active service, or another valid obligation.

If Medsta becomes aware of a personal data breach or security incident affecting users or providers, Medsta will take appropriate steps to assess, contain, investigate, and address the incident. Where required by applicable law, Medsta may notify affected individuals, authorities, or other relevant parties. Users and providers should immediately inform Medsta if they suspect unauthorized use, misuse, incorrect disclosure, or compromise of information shared through Medsta.

Medsta may update this Privacy Policy from time to time due to changes in law, services, provider operations, technology, data practices, security needs, compliance requirements, or new features. Updated versions will be posted on the Medsta website with a revised Last Updated date. Continued use of Medsta services after updates means the user or provider accepts the updated Privacy Policy unless separate consent is required by law.

For privacy questions, data requests, correction requests, deletion requests, consent withdrawal, provider data updates, or complaints, contact Medsta through the following channels.

• Website: medsta.in
• Phone: +91 83540 70437
• Privacy and support: support@medsta.in
• General care: care@medsta.in
• Grievance: grievance@medsta.in
• Grievance contact: Prakhar Sinha
• Address: Babu Banarasi Das University Incubation Cell, Lucknow, Uttar Pradesh, India