Privacy Policy

1. Introduction

Manju Wellness LLP (“DRROO”, “Company”, “we”, “us”, or “our”), a limited liability partnership registered under the Limited Liability Partnership Act, 2008, having its registered office at 8b 57b, 1st Avenue, Ashok Nagar, Chennai, Tamil Nadu - 600083, India, operates the website www.drroo.in (“Website”) and the mobile application DRROO (“App”) (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. We are committed to protecting your privacy and ensuring the security of your personal and health information in compliance with applicable Indian laws, including:

• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPI Rules”)
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Digital Personal Data Protection Act, 2023 (as applicable)

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Services.

This Privacy Policy should be read together with our Terms and Conditions.

2. Information We Collect

We collect various types of information to provide and improve our Services. The information we collect depends on how you interact with our Services and the choices you make.

2.1 Personal Information

Personal information is data that can be used to identify you directly or indirectly. We may collect the following personal information:

• Identity Information: Full name, date of birth, gender, photograph, government-issued identification numbers (such as Aadhaar, PAN, or driving license - when required for verification)
• Contact Information: Email address, mobile phone number, postal address, emergency contact details
• Account Information: Username, password (encrypted), account preferences, profile information
• Demographic Information: Age, gender, location, language preferences
• Professional Information (for Healthcare Practitioners): Medical registration number, qualifications, specializations, clinic/hospital affiliations, experience, consultation fees

2.2 Sensitive Personal Data or Information (SPDI)

Under Indian law, certain categories of personal information are classified as Sensitive Personal Data or Information. We may collect the following SPDI with your explicit consent:

• Health Information: Medical history, current health conditions, symptoms, diagnoses, treatment records, prescriptions, lab reports, imaging reports, vaccination records, allergies, and other health-related data
• Financial Information: Bank account details, credit/debit card information, UPI IDs, payment transaction history (collected only when necessary for payment processing)
• Biometric Information: Fingerprints, facial recognition data (if used for authentication purposes)
• Password: Account passwords (stored in encrypted form)

We collect SPDI only when it is necessary to provide our Services and only with your explicit consent. You have the right to withdraw your consent at any time.

2.3 Health Records

Our Services allow you to store, manage, and share your health records. Health records may include:

• Prescriptions issued by healthcare practitioners
• Laboratory test reports and diagnostic results
• Medical imaging reports (X-rays, MRI, CT scans, etc.)
• Vaccination and immunization records
• Hospital discharge summaries
• Consultation notes and treatment plans
• Insurance documents and claims
• Any other health-related documents you choose to upload

You retain ownership and control of your health records. We store this information securely and share it only with your explicit consent or as required by law.

2.4 Information from Healthcare Practitioners

When you consult with healthcare practitioners through our Services, they may create and share the following information:

• Consultation notes and clinical observations
• Diagnoses and treatment recommendations
• Prescriptions for medicines
• Referrals to specialists or diagnostic tests
• Follow-up instructions and care plans

2.5 Automatically Collected Information

When you use our Services, we automatically collect certain information about your device and usage patterns:

• Device Information: Device type, operating system, unique device identifiers, browser type and version, screen resolution
• Network Information: Internet Protocol (IP) address, Internet Service Provider (ISP), mobile network information
• Location Information: Approximate location based on IP address; precise location only if you grant permission (used to find nearby healthcare providers)
• Usage Information: Pages visited, features used, time spent on the Services, search queries, click patterns, referring URLs
• Log Data: Access times, error logs, crash reports, and diagnostic information

2.6 Information from Third Parties

We may receive information about you from third-party sources, including:

• Partner Laboratories: Test results and diagnostic reports when you book tests through our platform
• Partner Pharmacies: Order fulfillment and delivery information
• Partner Blood Banks: Blood availability and donation records
• Payment Processors: Transaction status and payment confirmations
• ABDM (Ayushman Bharat Digital Mission): Health records linked through your ABHA (Ayushman Bharat Health Account) if you choose to link your account
• Social Media Platforms: Basic profile information if you choose to sign in using social media accounts

2.7 Communication Data

We may collect and store communications between you and DRROO, including:

• Customer support inquiries and responses
• Feedback, reviews, and ratings you provide
• Survey responses
• Any other communications you send to us

Online consultations between you and healthcare practitioners may be recorded for quality assurance and dispute resolution purposes, with appropriate notice.

3. How We Use Your Information

We use the information we collect for various purposes, all aimed at providing, improving, and personalizing our Services for you.

3.1 To Provide and Maintain Our Services

• Create and manage your user account
• Enable you to search for and book appointments with healthcare practitioners
• Facilitate online consultations between you and healthcare practitioners
• Store and manage your health records
• Process medicine orders and coordinate with partner pharmacies
• Facilitate diagnostic test bookings and deliver results
• Provide blood bank information and services
• Process payments and send transaction confirmations
• Send appointment reminders, prescription notifications, and other service-related communications

3.2 To Improve and Personalize Our Services

• Analyze usage patterns to understand how our Services are used
• Develop new features, products, and services
• Personalize your experience based on your preferences and history
• Improve the accuracy and relevance of search results and recommendations
• Conduct research and analysis to enhance healthcare delivery
• Train and improve our AI-assisted features (using anonymized data)

3.3 To Communicate With You

• Send service-related notifications (appointment confirmations, reminders, cancellations)
• Respond to your inquiries, feedback, and support requests
• Send important updates about our Services, Terms, or Privacy Policy
• Send promotional communications about new features, offers, and health-related information (with your consent, and you can opt out at any time)
• Conduct surveys to gather feedback and improve our Services

3.4 For Safety, Security, and Legal Compliance

• Verify user identity and prevent fraud, unauthorized access, and other illegal activities
• Monitor and enforce compliance with our Terms and Conditions
• Investigate and address violations, security incidents, and technical issues
• Comply with applicable laws, regulations, legal processes, or governmental requests
• Protect the rights, property, and safety of DRROO, our users, and the public
• Respond to legal claims and establish, exercise, or defend legal rights

3.5 For Analytics and Business Intelligence

• Generate aggregated, anonymized, or de-identified data for statistical analysis
• Create reports on healthcare trends, service utilization, and user demographics (using non-identifiable data)
• Measure the effectiveness of our marketing campaigns
• Make informed business decisions based on data insights

3.6 ABDM Integration

If you choose to link your ABHA (Ayushman Bharat Health Account) with DRROO, we may:

• Fetch your health records from ABDM-linked Health Information Providers (HIPs)
• Share your health records with ABDM-linked Health Information Users (HIUs) with your consent
• Store and display your ABDM-linked health records within our Services
• Use your ABHA address to uniquely identify your health records

All ABDM-related data sharing is governed by ABDM policies and requires your explicit consent.

4. Information Sharing and Disclosure

We respect your privacy and do not sell your personal information to third parties. We may share your information only in the following circumstances:

4.1 With Healthcare Practitioners

When you book an appointment or consult with a healthcare practitioner through our Services, we share relevant information with them to facilitate the consultation, including:

• Your name, contact information, and appointment details
• Health records and medical history you choose to share
• Symptoms and concerns you report

4.2 With Service Partners

We share necessary information with our service partners to fulfill your requests:

• Partner Pharmacies: Prescription details, delivery address, and contact information for medicine orders
• Partner Laboratories: Test booking details, patient information, and sample collection address
• Partner Blood Banks: Blood request details and contact information
• Delivery Partners: Delivery address and contact information for order fulfillment

4.3 With Payment Processors

We share transaction details with secure, third-party payment processors to process your payments. We do not store your complete credit/debit card information on our servers. Payment data is handled in compliance with PCI-DSS standards.

4.4 With Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Cloud hosting and data storage providers
• Email and SMS service providers
• Analytics and performance monitoring services
• Customer support tools
• Security and fraud prevention services

These service providers have access to your information only to perform specific tasks on our behalf and are obligated to protect your information and not use it for any other purpose.

4.5 With ABDM Ecosystem

If you link your ABHA account, your health records may be shared with:

• ABDM-registered Health Information Providers (HIPs) and Health Information Users (HIUs)
• National Health Authority (NHA) for ABDM-related operations

All such sharing requires your explicit consent and is governed by ABDM data sharing protocols.

4.6 For Legal and Safety Reasons

We may disclose your information if we believe it is necessary to:

• Comply with applicable laws, regulations, legal processes, or governmental requests
• Enforce our Terms and Conditions and other agreements
• Protect the rights, property, and safety of DRROO, our users, or others
• Detect, prevent, or address fraud, security, or technical issues
• Respond to an emergency that threatens the life, health, or security of an individual

4.7 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have regarding your information.

4.8 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you for purposes such as:

• Healthcare research and analytics
• Public health reporting
• Industry benchmarking
• Academic studies

4.9 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so. You may withdraw your consent at any time.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit a website. They help websites remember information about your visit, making it easier to visit the site again and making the site more useful to you.

5.2 Types of Cookies We Use

We use the following types of cookies:

• Essential Cookies: Required for the basic functionality of our Services, such as maintaining your session, remembering your login, and ensuring security. These cannot be disabled.
• Functional Cookies: Remember your preferences and settings, such as language and region, to provide a personalized experience.
• Analytics Cookies: Help us understand how users interact with our Services by collecting information about pages visited, time spent, and navigation patterns.
• Performance Cookies: Monitor the performance and speed of our Services to identify and fix issues.

5.3 Third-Party Cookies

We may allow third-party service providers to place cookies on your device for analytics and performance monitoring. These third parties include:

• Google Analytics - for website usage analysis
• Meta Pixel - for measuring website visits, advertising performance, and conversions
• Firebase - for app analytics and crash reporting
• Other analytics and monitoring tools

5.4 Other Tracking Technologies

In addition to cookies, we may use other tracking technologies such as:

• Web Beacons: Small graphic images (also called “pixel tags”) that help us track email opens and website visits.
• Local Storage: Used to store data locally on your device for faster access and offline functionality.
• Device Fingerprinting: Collecting device-specific information to identify unique devices for security purposes.

5.5 Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually
• Block third-party cookies
• Block all cookies from specific sites
• Block all cookies from all sites
• Delete all cookies when you close your browser

Please note that disabling cookies may affect the functionality of our Services and your user experience.

6. Data Security

We take the security of your information seriously and implement comprehensive security measures to protect your data.

6.1 Security Certifications

DRROO maintains the following security certifications and compliances:

• ISO 27001:2013 Certified: Our Information Security Management System (ISMS) is certified to international standards.
• ABDM Compliant: We comply with Ayushman Bharat Digital Mission security and privacy requirements.
• FHIR Compliant: We follow Fast Healthcare Interoperability Resources standards for secure health data exchange.
• NHA Approved: We are approved by the National Health Authority of India.

6.2 Technical Security Measures

We implement the following technical measures to protect your data:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS/SSL. Sensitive data at rest is encrypted using AES-256 encryption.
• Secure Authentication: We use secure authentication mechanisms including multi-factor authentication (MFA) for sensitive operations.
• Access Controls: We implement role-based access controls to ensure that only authorized personnel can access your data.
• Secure Infrastructure: Our Services are hosted on secure cloud infrastructure with multiple layers of security, including firewalls, intrusion detection systems, and DDoS protection.
• Regular Security Audits: We conduct regular security assessments, vulnerability scans, and penetration testing.
• Secure Development: We follow secure software development practices and conduct code reviews to identify and fix security vulnerabilities.

6.3 Organizational Security Measures

• Comprehensive information security policies and procedures
• Regular security awareness training for all employees
• Background checks for employees with access to sensitive data
• Confidentiality agreements with all employees and contractors
• Incident response procedures for security breaches
• Business continuity and disaster recovery plans

6.4 Password Security

Your password is stored in encrypted (hashed) form. No administrator or employee at DRROO has access to your password. If you forget your password, you will need to reset it - we cannot retrieve your existing password.

6.5 Payment Security

All payment transactions are processed through secure, PCI-DSS compliant payment gateways. We do not store your complete credit/debit card information on our servers.

6.6 Data Storage Location

Your data is stored on secure servers located in India. We do not transfer your personal data outside India except as may be necessary for specific services and only with appropriate safeguards in place.

6.7 Security Limitations

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the security of your account credentials and for any activities that occur under your account.

If you become aware of any security breach or unauthorized access to your account, please notify us immediately at support@drroo.in.

7. Data Retention

7.1 Retention Periods

We retain your information for as long as necessary to fulfill the purposes for which it was collected, including:

• Account Information: Retained as long as your account is active. Upon account deletion, data is retained for a limited period to comply with legal requirements and then securely deleted.
• Health Records: Retained as long as you maintain an account with us. You may delete specific records at any time. Upon account deletion, health records are retained as required by applicable healthcare regulations.
• Transaction Records: Retained for a minimum of 8 years as required by applicable financial and tax regulations.
• Communication Logs: Customer support communications are retained for up to 3 years for quality assurance and dispute resolution.
• Log Data: Server logs and usage data are typically retained for 90 days for security and debugging purposes.

7.2 Retention After Account Deletion

After you delete your account:

• Your personal profile information is deleted or anonymized
• Certain data may be retained in anonymized form for analytics purposes
• Data required for legal compliance, dispute resolution, or enforcement of our agreements may be retained for the legally required period
• Backup copies may persist for a limited time in accordance with our backup retention policies

7.3 Healthcare Data Retention

Medical records and health-related data may be subject to specific retention requirements under healthcare regulations. We comply with all applicable requirements regarding the retention of healthcare data.

8. Your Rights and Choices

You have certain rights regarding your personal information. We are committed to helping you exercise these rights.

8.1 Access Your Information

You have the right to access the personal information we hold about you. You can view and download most of your information through your account settings.

8.2 Correct Your Information

You have the right to correct any inaccurate or incomplete personal information. You can update most of your information through your account settings. If you need assistance, contact us at support@drroo.in.

8.3 Delete Your Information

You have the right to request deletion of your personal information. You can:

• Delete specific health records through your account
• Delete your entire account, which will trigger deletion of your personal information (subject to legal retention requirements)
• Request deletion of specific data by contacting us

8.4 Withdraw Consent

Where we process your information based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8.5 Opt Out of Marketing Communications

You can opt out of promotional and marketing communications by:

• Clicking the “unsubscribe” link in our emails
• Updating your communication preferences in your account settings
• Contacting us at support@drroo.in

8.6 Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format. You can export your health records and other data through your account settings.

8.7 Object to Processing

You have the right to object to certain types of processing, such as processing for direct marketing purposes. Contact us to exercise this right.

8.8 How to Exercise Your Rights

To exercise any of these rights, you may:

• Use the self-service options in your account settings
• Email us at support@drroo.in
• Contact our Grievance Officer (details provided below)

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

9. Children’s Privacy

Our Services are intended for users who are at least 14 years of age. We do not knowingly collect personal information from children under 14 years of age without parental consent.

9.1 Minors (14-18 years)

Users between 14 and 18 years of age may use our Services with the consent of a parent or legal guardian. The parent or guardian is responsible for:

• Reviewing and agreeing to this Privacy Policy on behalf of the minor
• Supervising the minor’s use of the Services
• Ensuring the accuracy of information provided

9.2 Children Under 14

If we become aware that we have collected personal information from a child under 14 without parental consent, we will take steps to delete that information. If you believe that a child under 14 has provided us with personal information, please contact us at support@drroo.in.

9.3 Parental Controls

We encourage parents and guardians to supervise their children’s online activities and to use parental control tools available through browsers and devices.

10. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, or services that are not owned or controlled by DRROO. This Privacy Policy applies only to our Services and does not apply to any third-party services.

We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services before providing any information to them.

Third-party services that may be linked from our platform include:

• Payment gateway providers
• Partner laboratory websites
• Partner pharmacy websites
• Social media platforms
• Health information websites

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will:

• Update the “Last Updated” date at the top of this Privacy Policy
• Post the revised Privacy Policy on our Website and App
• For material changes, notify you through email, in-app notification, or a prominent notice on our Services

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information.

Your continued use of our Services after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the revised Privacy Policy, please discontinue use of our Services and delete your account.

12. Contact Us and Grievance Officer

12.1 Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12.2 Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, we have appointed a Grievance Officer to address any concerns or grievances you may have regarding your personal information:

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt.

12.3 Regulatory Authorities

If you believe that we have not addressed your concerns satisfactorily, you may have the right to lodge a complaint with the relevant data protection authority in India.

Acknowledgment

BY USING THE DRROO PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND AGREE TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN.

If you have any questions about this Privacy Policy, please contact us at support@drroo.in.

© 2026 DRROO. All rights reserved.