Privacy Policy

Version 2.2 – Effective and Updated for 2026

At Medavas Health Private Limited (“Medavas”, “we”, “our”, or “us”), we deeply value your trust and are unconditionally committed to safeguarding your privacy and confidential health information. This comprehensive Privacy Policy explains how we collect, use, store, process, and protect your personal, health, and technical data when you use the Medavas Website (www.medavas.com) and the Medavas Mobile Application (available on Google Play Store as com.medavas.app and Apple App Store).

By downloading, accessing, or using the Medavas platform, website, or mobile application, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

⚠️ Urgent Non-Emergency Notice

Medavas provides scheduled tele-consultations, emotional wellness guidance, and clinical self-assessments. Medavas is NOT an emergency response service or crisis intervention facility. If you or someone you know is experiencing acute psychiatric distress, self-harm impulses, suicidal ideation, or a medical emergency, please immediately contact:

• Tele-MANAS (Govt. of India 24x7 Mental Health Helpline): Dial 14416 or 1800-891-4416 (Toll-Free)

• National Emergency Number: Dial 112

• KIRAN Helpline: Dial 1800-599-0019

• Or visit the nearest hospital emergency room.

1. Information We Collect

To provide high-quality mental wellness tools and facilitate confidential consultations with certified professionals, we collect the following categories of information:

A. Personal & Account Information

• Contact Details: Your full name, email address, mobile phone number, and account password.

• Demographic Info: Age, date of birth, gender, and preferred language for counselling.

• Emergency Contact (Optional): Name and contact details of a trusted person you designate for emergency wellness support.

B. Health, Emotional & Clinical Information

• Self-Assessment Screeners: Responses and calculated scores from standardized clinical screeners you voluntarily complete (such as PHQ-9 for Depression, GAD-7 for Anxiety, DASS-21, ASRS for ADHD, and ISI for Insomnia).

• Daily Wellness Tracking: Daily mood logs, habit completions, journal entries, sleep logs, and breathing session logs you record.

• Session Details: Appointment booking history, preferred practitioner specializations, and uploaded medical prescriptions or diagnostic reports.

C. Device, Network & Technical Information

• Hardware & Network Identifiers: IP address, device model, operating system version, browser type, and push notification tokens (Firebase Cloud Messaging).

• Usage Data: In-app navigation patterns, feature interactions, and diagnostic crash logs.

2. Mobile Device Permissions & Hardware Usage Disclosures

In accordance with Google Play Developer Policies, we disclose the exact reasons our mobile application requests specific device permissions:

• Camera (android.permission.CAMERA): Required exclusively for live, real-time video consultations between you and your licensed therapist or psychologist. Camera feeds are end-to-end encrypted in transit. Medavas never accesses your camera in the background, and never records or stores live video sessions without prior explicit written authorization.

• Microphone & Audio (android.permission.RECORD_AUDIO, MODIFY_AUDIO_SETTINGS): Required strictly for two-way audio during tele-consultation sessions and interactive speech tools. Audio streams are encrypted and are never listened to by unauthorized third parties.

• Storage & Media Access (READ_EXTERNAL_STORAGE / Photos): Requested solely when you voluntarily upload a document (e.g., previous prescription, clinical discharge summary, or profile avatar). Medavas does not scan or access your private photo gallery or unselected files.

• Biometric Hardware (USE_BIOMETRIC, USE_FINGERPRINT): Used to offer optional biometric screen unlock (Fingerprint / Face ID) for convenient and secure access. All biometric authentication is processed entirely by the local Android KeyStore / BiometricPrompt subsystem on your device. Raw biometric mathematical templates are never transmitted to or stored on Medavas servers.

• Push Notifications (POST_NOTIFICATIONS): Used to deliver timely reminders for upcoming therapy appointments, session start notices, practitioner chat messages, and wellness habit streaks. You can toggle notifications on or off anytime in device settings.

3. Confidentiality & Doctor-Patient Privilege

Privacy in mental healthcare is sacred. Any details, thoughts, or medical history you share with our licensed Psychologists, Psychiatrists, Therapists, and Counsellors during private consultations are protected by strict professional confidentiality and doctor-patient privilege standards.

• No Medavas staff, marketing personnel, or technical contractors can eavesdrop on, join, or view your live one-on-one video or audio consultations.

• Consultation clinical notes made by experts are encrypted and accessible only to that expert and you.

• Duty of Care Exception: Information may only be disclosed if a certified practitioner determines in good faith that there is an immediate, catastrophic threat to your life or the safety of others, or when strictly compelled by a lawful court order.

4. Payment Processing & Financial Security

When you book consultation slots, recharge your Medavas wallet, or purchase wellness packages:

• All financial transactions are processed securely through certified, Reserve Bank of India (RBI)-authorized payment aggregators (e.g., Razorpay) complying with PCI-DSS Level 1 standards.

• Medavas never collects, stores, or processes your full credit card number, debit card number, CVV code, UPI PIN, or net banking passwords on our servers.

• We only retain non-sensitive transaction receipts (e.g., Transaction ID, date, amount, currency, invoice reference) for tax, accounting, and refund management.

5. Data Retention & Account Deletion Policy

In full compliance with Google Play's App Account Deletion and User Data policies, Medavas empowers users with complete control over their personal data:

A. How to Request Account & Data Deletion

You have the absolute right to delete your Medavas account and purge your associated personal data at any time through any of the following methods:

1. Directly In-App: Open the Medavas Mobile App > Tap Profile > Scroll to Support & About > Tap Delete Account > Confirm deletion.

2. Via Web Portal: Visit our online support desk at https://medavas.com/contact-us and submit an account deletion request.

3. Via Email: Send an email from your registered email address to support@medavas.com or privacy@medavas.com with the subject “Account Deletion Request”.

B. What Happens When You Delete Your Account

• Immediate Action: Your login credentials, session tokens, device identifiers, and notification push tokens are instantly invalidated, revoking all active sessions across all devices.

• Data Purged: Your profile details, contact information, mood tracking logs, journal reflections, habit histories, and self-assessment scores are permanently deleted from active production databases within thirty (30) days.

• Statutory Medical Record Retention: In compliance with the Indian Telemedicine Practice Guidelines and healthcare statutory regulations, electronic records of medical consultations conducted, practitioner digital prescriptions issued, and financial invoices are retained for the legally mandated period (minimum three [3] years) strictly for clinical liability and tax auditing purposes, after which they are securely expunged.

6. Data Security & Storage Architecture

• All data transmissions between your browser, the mobile app, and our servers are encrypted using TLS 1.3 / HTTPS with modern cipher suites.

• Databases and cloud storage buckets are encrypted at rest using AES-256 encryption.

• We conduct continuous vulnerability assessments, edge DDoS mitigation, and role-based access restrictions to prevent unauthorized access.

7. Children's Privacy

The Medavas platform is intended for individuals aged 18 years and older. If a minor (under the age of 18) utilizes counselling services, such consultations must be registered and supervised with the explicit verifiable consent of a parent or legal guardian.

8. Contact & Grievance Redressal

If you have any questions, concerns, or grievances regarding this Privacy Policy or the handling of your confidential data, please reach out to our designated Grievance Officer:

• Entity: Medavas Health Private Limited

• Attn: Privacy & Data Protection Officer

• Email: privacy@medavas.com / support@medavas.com

• Official Website: https://medavas.com

• Corporate Address: New Delhi, Delhi, India