Privacy Policy

By using the Application and/or the Services, you agree and consent to the collection, transfer, use, storage, disclosure and sharing of your information as described and collected by us in accordance with this Policy. If you do not agree with the Policy, please do not access the Application or use any of the Services.

If you use the Application and/or the Services on behalf of someone else (such as your child) or an entity (such as your employer), you represent that you are authorised by such individual or entity to (i) accept this Policy on such individual’s or entity’s behalf, and (ii) consent on behalf of such individual or entity to our collection, use and disclosure of such individual’s or entity’s information as described in this Policy. Where our Services are used by or on behalf of a child, being an individual below the age of eighteen (18) years, you warrant that you are the legal parent and/or lawful guardian of such child and you agree to have consented to us to process the personal data of such child in the manner prescribed under the Digital Personal Data Protection Act, 2023 and the rules made thereunder.

You may withdraw your consent to the processing of your Personal Information or Sensitive Personal Data or Information, in whole or in part, at any time by writing to our Grievance Officer / Data Protection Officer at the contact details set out in Section 14 (Grievance Officer, Data Protection Officer and Application Security) below, or, where available, through the privacy settings within the Application. The withdrawal of consent shall not affect our obligation to continue retention of data where required under any law of the Country, and the lawfulness of any processing carried out based on your consent before its withdrawal, and may result in our inability to provide you certain Services that are dependent on the information for which consent has been withdrawn.

i. Section 43A of the Information Technology Act, 2000 (“IT Act”);

ii. Regulation 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “Privacy Rules”);

iii. Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

iv. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, to the extent notified and in force from time to time.

In the event of any conflict or inconsistency between the IT Act, the Privacy Rules and the DPDP Act (or the rules made thereunder) in relation to the processing of your Personal Information or Sensitive Personal Data or Information, the provisions of the DPDP Act and the rules made thereunder shall prevail to the extent of such conflict or inconsistency.

i. The type of information collected from the Users, including Personal Information and Sensitive Personal Data or Information (as defined in the Privacy Rules) relating to a User;

ii. The purpose, means and modes of collection, usage, processing, retention and destruction of such information;

iii. How and to whom Orange Health will disclose such information.

We will collect and process the following information about you:

i. Create or update your Orange Health user account, which may include your name, gender, address (including pin code), date of birth, email id, phone number, photograph, national identification proof, login name and password; if you are an End User, we will also collect information about your medical history (drug allergies, chronic conditions), health habits, health indicators (BMI, weight, height), diagnostics reports, prescriptions, or any pictures/ photos/ files or other content shared by you. If you are an RMP, we will collect information that includes your practice details and specialty, years of experience, proofs of educational / technical qualifications, proofs of certifications and affiliations, registration details with the National Medical Council, State Medical Council or such similar authorities/bodies.

ii. Use our Services, we may collect and store information about you to process your requests and automatically complete forms for future transactions, including (but not limited to) your phone number, address, email, RMPs consulted in the past, diagnostic reports, billing information and credit or payment card information.

iii. Correspond with Orange Health for customer support;

iv. Enable features that require Orange Health’s access to any content (e.g.- photo gallery, contact details etc.) stored in or any feature or functionality (e.g. – camera, calendar, location etc.) of the device that you use to access the Application.

v. Report problems for troubleshooting.

By using the Application, you acknowledge and consent to use features or functionality that requires collection and processing of the following user data:

1. Location: Our application may access your device’s location information to provide location-based services such as personalised diagnostics or recommendations. This data helps us offer a better user experience by tailoring our services to your specific location.

2. Camera: With your explicit permission, our application may access your device’s camera functionality. This access enables features such as capturing prescriptions for diagnostic purposes or visual data input during teleconsultations.

3. Contacts: Our application may request access to your device’s contacts to facilitate features such as appointment scheduling or sharing diagnostics reports with contacts of your choice. We do not store your contacts’ information on our servers unless explicitly authorized by you.

4. Files, Images, Video and Audio: To provide a comprehensive diagnostic service, our application may require access to files, images, video and audio stored on your device. This access allows you to upload and share relevant files such as medical reports or images with healthcare professionals for analysis and consultation purposes.

5. Audio: Our application may access your device’s audio features for functionalities such as voice input during consultations or to capture audio recordings related to your health condition. This data helps us in providing accurate diagnostics and personalized recommendations.

6. Wi-Fi Information: Includes details about the Wi-Fi networks you’re connected to. This can help us understand your connectivity status and optimize our app’s performance.

i. Communications: When you communicate with us (via email, text, phone, through the Application or otherwise), we may maintain a record of your communication;

ii. Location information: Depending on the Services that you use, and your app settings or device permissions, we may collect your real time information, or approximate location information as determined through data such as GPS, IP address;

iii. Transaction Information: We collect transaction details related to your use of our Services, the Users (i.e. End User or RMP) that you interact with by use of our Application, and information about your activity on the Services, including the full Uniform Resource Locators (URL), the type of Services you requested or provided, comments, domain names, search results selected, number of clicks, information and pages viewed and searched for, the order of those pages, length of your visit to our Services, the date and time you used the Services, amount charged, methods used to browse away from the page and any phone number used to call our customer service number and other related transaction details;

iv. Record stored on the Application: Any diagnostic report, prescriptions or such other record or file that is rendered through the Application and/or is uploaded on to the Application by you.

i. identity and contact information furnished by you for walk-in registration, appointment scheduling or verification purposes, including government-issued identification proof where required for sample collection or billing;

ii. payment information processed at the point of sale at our retail collection centres;

iii. anonymized and aggregated footfall, movement and cohort analytics generated through closed-circuit television (“CCTV”) deployed at our retail collection centres, as further described in Section 10 (In-Store Data Collection, Video Surveillance and Footfall Analytics) below; and

iv. details of the referring medical practitioner and any prescription or test requisition furnished by you or the practitioner at sample collection points situated within a doctor’s clinic or other practitioner premises.

The Application uses temporary cookies to store certain information (that is not sensitive personal data or information) that is used by Orange Health and its service providers for the technical administration of the Application, research and development, and for User administration. In the course of serving advertisements or optimizing services (such as recording User preferences) to its Users, Orange Health may allow authorized third parties to place or recognize a unique cookie on the User’s browser. The cookies, however, do not store any personal information of the User. You may adjust your internet browser to disable cookies. If cookies are disabled you may still use the Application, but the Application may be limited in the use of some of the features. Cookies that are strictly necessary for the functioning of the Application are used without additional consent; all other cookies, including analytics and advertising cookies, are deployed only pursuant to a cookie consent banner through which you may grant or decline your consent by category, and which you may revisit at any time to modify your preferences.

i. To provide the Services that you choose to receive through or by use of the Application and to fulfil any obligations inuring upon us therefrom;

ii. To communicate with you in relation to your use of the Services, including to provide customer support services, to send reminders etc.

iii. To provide, personalize, maintain and improve the features and functionalities of the Application and the Services;

iv. To administer and enhance the security of our Application and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

v. To provide you with information about Services we consider similar to those that you are already using, or have enquired about, or may interest you. If you are a registered user, we will contact you by electronic means (e-mail or SMS or whatsapp or telephone) with information about these services;

vi. To generate and review reports and data about, and to conduct research on, our user base and Service usage patterns;

vii. To allow you to participate in interactive features of our Services, including receiving any feedback; or

viii. To use the information on an aggregated basis (which would be de-identified if it is Personal Information or Sensitive Personal Data or Information) for research, statistical analysis or business intelligence purposes whether for internal operations or other commercial purpose.

ix. To analyse anonymized and aggregated customer footfall, movement patterns and cohort trends at our retail collection centres for business planning, staffing, marketing effectiveness and store layout optimisation, as further described in Section 10 (In-Store Data Collection, Video Surveillance and Footfall Analytics) below.

b) We may combine the information that we receive from third parties with the information you give to us and information we collect about you for the purposes set out above. Further, we may anonymize and/or de-identify information collected from you through the Services or via other means, including via the use of third-party web analytic tools. As a result, our use and disclosure of aggregated and/or de-identified information is not restricted by this Policy, and it may be used and disclosed to others without limitation.

c) By agreeing to this policy you hereby consent to receive promotional and marketing calls and SMS from Orange Health on your registered mobile number, even if it is registered on DND (Do Not Disturb). You may withdraw this consent and opt out of promotional communications at any time by writing to our Grievance Officer / Data Protection Officer, using the unsubscribe mechanism provided in the relevant communication, or through the applicable preferences under the Telecom Commercial Communications Customer Preference Regulations; such withdrawal shall not affect transactional or service-related communications necessary for the provision of the Services.

a) With Service Providers: We may share your information with our vendors, consultants, marketing partners, research firms and other service providers or business partners, to the extent it is necessary to (i) render Services to you (ii) enable the features and functionalities of the Application. Illustratively, if you are an End User, your Personal Information and Sensitive Personal Data and Information will be shared with our business partners for providing diagnostic services or with the RMPs to provide consultation to you or with a Pharmacy to deliver the medicines ordered through the Application. We may also share your information with a third party vendor to carry out any of the purposes for which such information was collected that are illustrated in clause 5(a) of this Policy. Such service providers and business partners include, without limitation, diagnostic and pathology laboratories, logistics and last-mile delivery partners engaged for home sample collection, payment gateways and payment processors, cloud and information technology infrastructure providers, and analytics service providers engaged for the purpose of In-Store Analytics described in Section 10 (In-Store Data Collection, Video Surveillance and Footfall Analytics) below.

i. Obligated under the applicable laws or in good faith to respond to directions from legal/statutory authorities including police officials, courts etc. or

ii. Responding to claims that an advertisement, posting or other content violates the intellectual property rights of a third party;

iii. Under a duty to disclose or share your personal data in order to enforce our Terms of Use and other agreements, policies or to protect the rights, property, or safety of the Company, our customers, or others, or in the event of a claim or dispute relating to your use of our Services. This includes exchanging information with other companies and organizations for the purposes of fraud detection and credit risk reduction.

c) For Internal Use: We may share your information with any present or future member of our “Group” (as defined below) or affiliates for our internal business purposes. The term “Group” means, with respect to any person, any entity that is controlled by such person, or any entity that controls such person, or any entity that is under common control with such person, whether directly or indirectly, or, in the case of a natural person, any Relative (as such term is defined in the Companies Act, 1956 and Companies Act, 2013 to the extent applicable) of such person.

a) Your Personal Information and Sensitive Personal Data and Information is maintained by Orange Health in electronic form on equipment and digital resources owned or controlled by it. This information may be converted to physical form as and when deemed necessary for any business purpose. Orange Health takes all reasonable precautions to protect your Personal Information and Sensitive Personal Data and Information both online and off-line, and implements reasonable security practices and measures including certain managerial, technical, operational and physical security control measures that are commensurate with respect to the information being collected and the nature of Orange Health’s business. Where information is anonymized or aggregated, including footfall data derived from In-Store Analytics, we implement technical and organisational measures designed to ensure that such information cannot reasonably be used to re-identify an individual.

b) Orange Health does not have access nor is aware of the passwords enabled by the Users to access their accounts maintained with Orange Health, whether in their capacity of an End User, RMP or any other category of User.

c) Orange Health makes all User information accessible to its employees, agents, vendors and third parties only on a need-to-know basis and binds them with confidentiality obligations.

d) Notwithstanding the above, Orange Health is not responsible for the confidentiality, security or distribution of your Personal Information or Sensitive Personal Data and Information by our service provider, vendors and third parties outside the scope of our agreement with such service provider, vendors and third parties. Further, Orange Health shall not be responsible for any breach of security or for any actions of any third parties or events that are beyond the reasonable control of Orange Health including but not limited to, acts of government, computer hacking, unauthorised access to computer data and storage device, computer crashes, breach of security and encryption, poor quality of Internet service or telephone service of the User etc.

The Application may contain links to other websites. Any personal information about you collected when you browse such websites is not governed by this Policy. Orange Health shall not be responsible for and has no control over the practices and content of any website accessed using the links contained on the Application. This Policy shall not apply to any information you may disclose to any of our service providers/service personnel which we do not require you to disclose to us or any of our service providers under this Policy.

We may occasionally update this Policy and such changes will be posted on this page. If we make any significant changes to this Policy we will endeavour to provide you with reasonable notice of such changes, such as via prominent notice on the Application or to your email address on record and where required by applicable law, we will obtain your consent. To the extent permitted under the applicable law, your continued use of our Services after we publish or send a notice about our changes to this Policy shall constitute your consent to the updated Policy.

a) Orange Health deploys closed-circuit television (“CCTV”) cameras at its retail collection centres and sample collection points for the purposes of (i) ensuring the safety and security of its customers, employees and premises, (ii) preventing and investigating theft, fraud or other unlawful activity, and (iii) analysing anonymized and aggregated customer footfall, movement patterns and cohort trends within such premises for the purpose of regularly improving the service levels (“In-Store Analytics”).

b) In-Store Analytics is conducted on an anonymized and aggregated basis. Orange Health does not use facial recognition, biometric identification or any technology that links footfall data to an identified or identifiable individual, and no Personal Information or Sensitive Personal Data or Information is generated, stored or derived from such analytics.

c) Raw CCTV footage is retained for a maximum period of thirty (30) days from the date of recording, save where such footage is required to be retained for a longer period pursuant to an ongoing investigation, legal proceeding, or a specific request from a law enforcement or regulatory authority, after which it is automatically and irretrievably deleted. Anonymized and aggregated footfall data derived from such footage does not permit re-identification and may be retained for longer periods for business analytics purposes.

d) Access to CCTV footage is restricted to authorised personnel on a need-to-know basis and is not shared with any third party except (i) our analytics service provider, strictly for the purpose of generating anonymized and aggregated footfall data, (ii) law enforcement or regulatory authorities pursuant to a lawful request, or (iii) as otherwise permitted under Section 6 (Disclosure and Distribution of Your Information) above.

e) Orange Health does not deploy CCTV or conduct In-Store Analytics at collection set-ups operated by us within the premises of clinics, hospitals or registered medical practitioners; any video surveillance at such premises is operated by the owner of those premises and is not governed by this Policy.

f) CCTV cameras are not installed in washrooms, sample collection rooms or cubicles, or any other areas of our premises where visitors have a heightened expectation of privacy, and our CCTV cameras do not capture or record audio.

a) obtain a summary of the Personal Information and Sensitive Personal Data or Information processed by us and of the processing activities undertaken with respect to such information;

b) request correction, completion, updating or erasure of your Personal Information and Sensitive Personal Data or Information, save where retention is required for a lawful purpose;

c) withdraw your consent at any time, in the manner described in Section 1 (Your Consent) above;

d) nominate, in the manner prescribed under applicable law, another individual to exercise your rights under this Policy in the event of your death or incapacity; and

e) grievance redressal in the manner described in Section 14 (Grievance Officer, Data Protection Officer and Application Security) below.

You may exercise these rights by writing to our Grievance Officer / Data Protection Officer at the contact details provided in Section 14 below. We will endeavour to respond to your request within the timelines prescribed under applicable law.

a) diagnostic reports, prescriptions and medical records are retained for the period prescribed under applicable clinical establishment and medical council regulations, and in any event for not less than 8 years from the date of the last consultation or test, whichever is later;

b) account and transaction information is retained for the duration of your relationship with us and for 8 years thereafter, or for such longer period as required to comply with applicable tax, audit and regulatory requirements;

c) CCTV footage is retained in accordance with Section 10(c) (In-Store Data Collection, Video Surveillance and Footfall Analytics) above;

d) marketing and promotional data is retained until you withdraw your consent to receive such communications.

Upon expiry of the applicable retention period, we will delete or anonymize your information, save where retention is required under applicable law.

a) We engage third-party service providers, including diagnostic and pathology laboratories, logistics and last-mile delivery partners engaged for home sample collection, payment gateways, cloud and information technology infrastructure providers, and analytics service providers, to assist us in providing the Services. Such service providers are permitted to use your information only to the extent necessary to perform the services for which they are engaged and are bound by confidentiality and data protection obligations no less protective than this Policy.

b) The Application stores your data with the cloud platform of [Amazon Web Services] provided by [Amazon Web Services, Inc.], which may store this data on servers located outside India. Where your Personal Information or Sensitive Personal Data or Information is transferred outside India, we ensure that such transfer is undertaken in compliance with Section 16 of the DPDP Act and any rules, notifications or restrictions issued by the Central Government from time to time in relation to the transfer of personal data outside India.

c) Amazon Web Services has security measures in place to protect the loss, misuse and alteration of the information, details of which are available at [https://aws.amazon.com/]. The privacy policy adopted by Amazon Web Services is detailed at [https://aws.amazon.com/privacy]. In the event you have questions or concerns about the security measures adopted by Amazon Web Services, you may contact their data protection / privacy team.

If you have any queries relating to the processing or usage of information provided by you in connection with this Policy,
please email our Grievance Officer / Data Protection Officer at the contact details provided below:

For details regarding our third-party service providers and the cross-border transfer of your information, please see Section 13 (Third-Party Service Providers and Cross-Border Data Transfers) above.

a) Purpose Limitation – we collect and process your information only for the specified purposes set out in this Policy and do not process it in a manner incompatible with such purposes;

b) Data Minimisation – we collect only such information as is necessary and proportionate to the purposes for which it is processed;

c) Accuracy – we take reasonable steps to ensure that the information we hold about you is accurate and, where necessary, kept up to date;

d) Storage Limitation – we retain your information only for as long as necessary, in accordance with Section 12 (Data Retention) above;

e) Integrity and Confidentiality – we implement appropriate technical and organisational measures to protect your information against unauthorised or unlawful processing and against accidental loss, destruction or damage; and

f) Accountability – we are responsible for, and able to demonstrate compliance with, the principles set out in this Section 15.

In the event of a personal data breach, Orange Health shall, in accordance with the DPDP Act and the rules made thereunder, (a) take reasonable steps to contain and remediate such breach, (b) notify the Data Protection Board of India in the manner and within the timelines prescribed under applicable law, and (c) notify affected Data Principals of the breach, including the likely consequences and the measures taken or proposed to be taken to mitigate the risks arising therefrom, where such notification is required under applicable law.

Without prejudice to Section 1 (Your Consent) above, Orange Health does not undertake tracking, behavioural monitoring, or targeted advertising directed at children, being individuals below the age of eighteen (18) years, except where such processing is demonstrated by us to be clearly in the interest of the child and undertaken in the manner permitted under the DPDP Act and the rules made thereunder.

Diagnostic reports generated through the Application are prepared using laboratory equipment and, where applicable, software-assisted analysis; however, all reports and results are reviewed and released under the oversight of qualified laboratory personnel. Orange Health does not use your Personal Information or Sensitive Personal Data or Information to make any decision that produces a legal effect concerning you, or that similarly and significantly affects you, based solely on automated processing without human oversight.

a) Orange Health implements information security practices and procedures that are designed to align with recognised industry standards, including ISO/IEC 27001, and commensurate with the sensitivity of the information processed and the nature of our business.

b) Access to diagnostic reports, medical history and other health-related information is restricted on a role-based, need-to-know basis, and such information is encrypted both in transit and at rest, to the extent technically feasible.

c) Orange Health maintains backup and disaster recovery arrangements designed to ensure the continued availability and integrity of your information in the event of a system failure or other disruption.

If you are not satisfied with the manner in which your grievance has been addressed by our Grievance Officer / Data Protection Officer, you may escalate your grievance to the Data Protection Board of India, constituted under the DPDP Act, in the manner prescribed under applicable law.