Use a short layered notice at each collection point and link to this complete notice.

1. Data Fiduciary and Contact [LEGAL ENTITY], trading as JMR Care & Cure, determines the purposes and means of processing described in this Notice. Privacy questions and rights requests may be sent to [PRIVACY CONTACT]. The consumer grievance officer is [DETAILS].

2. Categories of Personal Data We may process: identity and contact details; age, date of birth and gender; account credentials; guardian and dependent details; appointment and payment information; clinical history, symptoms, diagnoses, allergies, prescriptions, medicines, laboratory orders and reports, vital signs and uploaded documents; doctor and facility identifiers; pharmacy orders and delivery details; communications; device, login, security and audit data; and consent records. We do not request access to a phone contact list merely to provide telemedicine.

3. Purposes We process data to create and secure accounts; verify identity and guardianship; book and conduct consultations; give authorised doctors access to relevant records; create and deliver prescriptions; coordinate laboratory tests and report review; verify and fulfil medicine orders; process payments; send service notifications; provide support; maintain clinical, pharmacy, financial and security records; prevent fraud and misuse; comply with law; respond to lawful requests; and improve service quality using appropriately limited or de-identified information.

4. Legal Grounds and Consent Where processing is based on consent, consent will be requested through a clear affirmative action for a specified purpose and limited to necessary data. Some processing may also be necessary for services requested by you, compliance with law, medical emergencies, employment-related purposes or other recognised lawful uses. Optional marketing and non-essential analytics are kept separate.

5. Sources Data may come from you; a parent, guardian or authorised family member; doctors; the clinic; the dispensing pharmacy; the partner laboratory or collection provider; payment, messaging, hosting and delivery providers; ABHA/ABDM services where separately enabled; and security or fraud-prevention systems.

6. Recipients Information is shared only as needed with authorised doctors and clinic personnel; the licensed dispensing pharmacy and pharmacist; the laboratory and collection provider; payment gateways; secure cloud, software, messaging and video providers; delivery partners for minimum necessary delivery details; professional advisers, insurers and auditors; and government, courts or regulators where legally required. Doctors do not receive unrestricted access to every patient record.

7. Cross-Border and Hosting [STATE HOSTING LOCATION AND PROVIDERS]. If a processor or service involves processing outside India, JMR Care & Cure will assess applicable restrictions, contractual safeguards and necessity before use. Highly sensitive clinical content should not be included in ordinary messaging notifications.

8. Retention Records are retained only for the service purpose, patient safety, continuity of care, prescription and pharmacy obligations, tax/accounting, dispute resolution, cyber-security logs and legal requirements. Retention periods differ by record type and applicable law. When retention is no longer required, data will be securely erased, anonymised or irreversibly de-identified. Account closure does not automatically erase legally required medical or transaction records.

9. Security We use role-based and patient-context access, multi-factor authentication for privileged users, encryption in transit and at rest where implemented, secure file storage, backups, access logs, monitoring, vulnerability management, malware scanning, incident response and contractual controls for processors. No system is completely risk-free. Affected individuals will be informed of a qualifying personal data breach as required by applicable law.

10. Your Rights Subject to applicable law and verification, you may request information about processing, access to available information, correction, completion or updating, erasure where retention is unnecessary, withdrawal of consent, grievance redressal and nomination of another individual to exercise rights in specified circumstances. Withdrawal does not invalidate earlier processing and may prevent us from continuing an optional service.

11. Children and Dependants A child’s profile may be created only through a verified parent or lawful guardian workflow. We do not use a child’s health account for behavioural advertising or unnecessary tracking. When the child becomes an adult, the account and access arrangements should be reviewed and transitioned.

12. Cookies and Analytics Necessary cookies support login, security and preferences. Optional analytics or marketing technologies are activated only according to the Cookie Notice and user choice. Clinical data, diagnosis, prescription content and report names must not be sent to advertising platforms.

13. Complaints Contact [PRIVACY CONTACT]. Please describe the issue and provide the account contact used for registration. We may verify identity before disclosing or changing records. You may also use remedies available under applicable Indian data-protection, consumer and other laws.

14. Updates We will show the effective date and archive material versions. Material changes will be communicated. A new purpose that is not compatible with the original notice will require an updated notice and, where required, fresh consent.

Point-of-Collection Short Notice Display beside registration fields: JMR Care & Cure will use the details you provide to create and secure your account, arrange consultations, maintain authorised health records, coordinate laboratory and pharmacy services, and send necessary service notices. Health information will be shared only with authorised providers and service partners for these purposes or as required by law. Read the full Privacy Notice. You can manage consent and privacy requests in Account > Privacy.