SecondMedic™ is a registered trademark and product of Remote Healthcare Technologies Private Limited. Registered Address: Office No 320, Plot No 17-18, Platinum Techno Park, Palm Beach Road, Vashi, Navi Mumbai, Thane, Maharashtra, India - 400703. Website: www.secondmedic.com
SecondMedic™ ("we", "us" or "our") is committed to protecting the privacy of individuals who use our healthcare platform and services. This Privacy Policy explains how SecondMedic™ collects, uses, shares, and safeguards digital personal data of all users, including patients, doctors, internal employees, and third-party vendors, in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and its 2025 implementation rules. We recognize the rights of individuals ("Data Principals") under the DPDP Act and implement measures to meet our obligations as a responsible Data Fiduciary. This Policy is written in clear and plain language, following recognized best practices in India, and is suitable for publication on our website and use in compliance audits.
Please read this Privacy Policy carefully. By using SecondMedic™'s website, mobile app, or services, you consent to the practices described herein. If you do not agree with any part of this Policy, you should refrain from using our services.
This Privacy Policy applies to all personal data (in digital form) that we collect and process in India in connection with SecondMedic™'s services. It covers personal data of the following categories of individuals under a unified framework: patients, doctors, SecondMedic™ employees, and third-party vendors/partners. The Policy is intended for Data Principals who are within the territory of India; our services are designed and offered for users in India, and we apply this Policy only to personal data of individuals in India. If you are accessing our services from outside India, please note that our data practices are aligned primarily with Indian law.
Children: Our services are generally intended for adults. We do not knowingly collect or process personal data of children under 18 years of age without verifiable parental consent. If you are under 18, you should use SecondMedic™ services only with the involvement and consent of your parent or legal guardian. We also do not engage in any tracking or targeted advertising directed at children. Parents or guardians who become aware that a child has provided us personal data without consent can contact us to have such data deleted.
SecondMedic™ collects only that personal data which is necessary for specified lawful purposes. We provide a notice at the time of data collection describing the personal data being collected and the purpose of processing, in compliance with DPDP Act requirements. The types of personal data we collect, and the purposes for which we use them, are outlined below:
Individuals using SecondMedic™ as patients provide personal data needed for healthcare services. This may include:
Medical practitioners who register on SecondMedic™'s platform or provide services through it share certain personal and professional data with us. This includes:
Patient health information that a doctor accesses or inputs during a consultation is handled with strict confidentiality and in compliance with medical ethics and data protection law.
We may also collect and use doctors' data for legal compliance and employment purposes in certain cases (for example, if a doctor is engaged as an employee or contractor, we may process their data for taxation, statutory reporting, or regulatory audits under deemed consent provisions).
If you are an employee of SecondMedic™, we collect personal data necessary for human resource management and to fulfill our obligations as an employer. This may include:
This employee data is used strictly for internal purposes: payroll and benefits administration, performance management, statutory compliance (Provident Fund, tax, labor laws), and workplace security.
Processing of employee data is generally based on deemed consent and legal obligation – by accepting employment with SecondMedic™, an individual is understood to consent to the processing of their data for legitimate HR purposes, and we also process certain data to comply with laws (such as maintaining employment records or furnishing returns to government). We ensure employee data is accessed only by authorized HR personnel or management on a need-to-know basis, and it is not disclosed outside SecondMedic™ except as required by law or with the employee's consent.
If you are a vendor, service provider, or business partner to SecondMedic™ (for example, a laboratory, pharmacy, payment gateway, IT service provider, etc.), we may collect limited personal data about your representatives or personnel as needed for our business engagement. This typically includes:
We process vendor personal data under deemed consent (as it is provided in the context of contracting and is necessary for our legitimate business interests) and in some cases to comply with legal requirements (e.g., maintaining records for audits or taxation). We do not use vendor personal data for any purpose other than managing our commercial relationship and fulfilling mutual obligations.
We do not collect any personal data that is not required for the stated purposes. In particular, we do not collect information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, or sexual orientation, as these are not relevant to our services. In any case, we treat all personal data with high standards of security and confidentiality. If we ever need to process any additional categories of personal data, we will do so only with appropriate notice and consent.
We use cookies and similar tracking technologies on our website and app to enhance user experience, analyze traffic, and support our services. A cookie is a small text file stored on your device that helps remember your preferences and activity. SecondMedic™ uses cookies in the following manner:
These are necessary for our site's core functionality – for example, to keep you logged in during a session, to remember items in your cart, or to enable navigation. Without these cookies, certain services or features may not be available. These cookies do not collect personal data beyond what is needed for service operation, and they are generally session-based(temporary). By using our site, you implicitly consent to essential cookies as they are required for service delivery.
We use third-party analytics tools (such as Google Analytics) to collect information about how users interact with our platform. This includes data like your device type, browser, IP address, pages visited, time spent, and actions taken on our site. We use analytics cookies only with your opt-in consent, as indicated by our cookie consent banner when you first visit. The information gathered helps us understand user behavior and improve our website, features, and marketing strategies. For instance, Google Analytics cookies allow us to gauge which services are most popular, how users navigate our app, and how our marketing campaigns are performing. The data collected via analytics cookies is typically aggregated and pseudonymized. Google Analytics may assign you a unique identifier, but it does not reveal your identity to us. We have configured Google Analytics to respect data minimization and retention limits (user-level data is retained for 14 months by default in GA before automatic deletion).
Currently, SecondMedic™ does not use any third-party advertising or targeting cookies on our platform. We do not serve targeted advertisements based on user profiling, nor do we share your browsing behavior with advertising networks. If this changes in the future, we will update our Policy and seek any necessary consents. In any case, as noted, we do not engage in targeted advertising towards minors in compliance with the DPDP Act.
When you first access SecondMedic™'s website or app, you will see a cookie notice or banner requesting your consent for non-essential cookies (analytics). You have the choice to accept or reject these. If you opt out, we will not set those cookies and will respect your preference (though our site will still set any essential cookies needed for functionality). You can also control cookies through your browser settings – for example, you can delete existing cookies or block future cookies from being set. However, please note that disabling cookies might affect certain interactive features of our services. For mobile apps, you can typically control tracking via your device settings (such as resetting advertising IDs or limiting ad tracking, though again, we currently do not use ad trackers). By adjusting these settings, you can withdraw consent for cookie-based processing at any time, and we will cease collecting your data through those means.
For more information on how to manage cookies or to change your preferences with us, please refer to our Cookie Notice (if available on the site) or contact us for assistance. We strive to make our use of cookies transparent and in line with user expectations and legal requirements.
SecondMedic™ does not sell or rent your personal information to any third party. However, in order to operate our services and fulfill the purposes described above, we may share your personal data with third parties in certain situations. Any sharing of data is done in a limited, secure, and responsible manner, only as necessary and with adequate safeguards. The categories of third parties with whom we may share data include:
We employ trusted third-party companies to perform services on our behalf, such as:
Hosting and Infrastructure: e.g. cloud storage providers and data center services that host our databases and application on servers (our primary databases are hosted in India). These providers may incidentally have access to stored data for maintenance or backups, but only under strict confidentiality.
Communication Services: e.g. SMS or email gateways for sending OTPs (one-time passwords), notifications, or emails. For instance, when you register or reset a password, an OTP service API is used to send verification codes to your phone. Such providers get access only to the necessary contact information (phone/email) and message content for that transaction.
Payment Processors: e.g. our UPI/payment gateway partners who handle payment transactions. When you make a payment, we share the required transaction details with the payment processor (such as your order ID and payment amount). The processor in turn may interact with banks or UPI networks. These third parties are contractually bound to use the data only for processing the payment and complying with legal requirements (e.g. receipts, audits).
Analytics Providers: e.g. Google Analytics, as mentioned, which processes usage data on our behalf for analytics purposes. Google may process this data on its servers (which could be outside India – see Cross-Border section) but is contractually obligated not to use it for any other purposes without our instructions. We have configured our analytics to not collect more data than necessary and to respect Do-Not-Track signals where possible.
IT Support and Security: e.g. providers of security monitoring, anti-fraud services, or customer support software. If we use a cloud-based customer support ticket system, for example, the personal data you provide in support tickets (name, email, issue details) may be stored on their platform. We ensure any such provider implements industry-standard security measures and privacy controls.
All our service providers act on our instructions as data processors. We sign data processing agreements with them to ensure your data remains protected according to our standards and the DPDP Act's requirements. This includes obligations to maintain confidentiality, apply appropriate security measures (encryption, access control, etc.), and not to further share the data without authorization. If a data processor no longer needs the data or if you withdraw consent (in cases of consent-based processing), we ensure they delete or return the personal data as required. SecondMedic™ remains accountable for the protection of your data even when it is processed by third- party service providers.
With your consent and direction, we may share relevant personal data with third parties involved in your healthcare or wellness needs. For example:
Similarly, if we have tie-ups with hospitals, insurers, or wellness providers and you choose to engage with them through our platform, we will share your data only as needed and with your knowledge. Each such partner's use of your data will be governed by this Policy as well as any additional consent you give.
In some cases, we may share limited personal data of one category of user with another category in a business context. For example:
We may disclose personal data to government authorities, regulatory bodies, law enforcement or other third parties if required to do so by law or legal process, or if we determine that such disclosure is necessary to:
When disclosing information for legal reasons, we will ensure the request is legitimate (for instance, we may demand a warrant or official letter where appropriate) and we will only provide the minimum data necessary. We may process the user’s personal data without consent for certain "legitimate uses" such as compliance with laws or court orders and in response to emergencies. We will rely on those provisions when making any such disclosures. Wherever feasible, we may notify the affected users about such disclosures, unless we are legally restrained from doing so.
If SecondMedic™ undergoes a business transaction like a merger, acquisition, restructuring, or sale of assets, personal data might be transferred to the successor or new owner as part of the transaction. In such cases, we will ensure that the new entity continues to be bound by privacy obligations at least as strict as those described in this Policy. A notice will be provided on our website or via email to inform you of any change in data controllership resulting from such a transaction, and your choices regarding your data will be preserved.
We do not share personal data with any third parties other than as described above. Specifically, we do not share your data with advertisers or social media companies for their own marketing purposes without your consent. We also do not allow any third-party to have access to your personal data for analytics or processing unless they are under a contract to provide a service for us and to act under our instructions. Your trust is important to us, and we take care to engage only reputed partners who adhere to data protection standards. If you have questions about a particular third party with whom your data may be shared, you may contact us for more information.
As a rule, SecondMedic™ stores and processes personal data on servers located in India whenever possible. However, some of our service providers or partners may be located in, or use infrastructure in, other countries. For example: our analytics provider (Google) may process data on servers in the
United States or European Union; our email or customer support systems might route communications globally. Therefore, your personal data may be transferred outside of India in certain circumstances.
We will ensure that any international transfer of data is made in compliance with applicable laws. This means: (a) we will not send your personal data to any country that is officially prohibited for data transfers by the Indian government (the government is expected to publish a list of restricted jurisdictions, if any); and (b) we continue to remain responsible for the security of your data even when it is processed outside India.
Whenever your data is transferred outside India, we take appropriate safeguards. Our contracts with data processors include clauses to protect your information regardless of where it is processed. We also consider industry best practices such as encryption of data in transit, and selecting vendors with strong security certifications, to protect cross-border data flows. By using our services or by providing your information, you consent to the transfer of such information abroad, subject to the safeguards described in this Policy.
If you would like to know more about where your data may be stored or transferred, or if you have concerns about a particular destination, please contact us. We will be happy to provide information on the cross-border practices relevant to your personal data. Currently, key instances of cross-border transfer in our operations include: Google Analytics data (transferred to Google's servers globally), and possibly email/support data if our email servers are hosted by a global provider. All such transfers are made in line with the applicable rules and with respect for your privacy.
SecondMedic™ takes data security very seriously. We implement reasonable and appropriate security safeguards to protect personal data from unauthorized access, loss, misuse, alteration, or destruction. Our security program is designed to adhere to industry standards and Indian legal requirements (such as the IT Act's "reasonable security practices" and the DPDP Act's expectations). Key measures we have in place include:
Despite our best efforts, please note that no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. However, we continuously review and update our security practices to react to new threats and vulnerabilities. You also play a role in keeping your data secure: please use a strong, unique password for your SecondMedic™ account, do not share your login credentials, and notify us immediately if you suspect any unauthorized access to your account or any security issue. We will support and guide you on additional steps to secure your account in such cases.
In the unfortunate event of a personal data breach (such as unauthorized access, theft, or leak of personal data), SecondMedic™ has a breach response plan in place. We will promptly contain and investigate the incident, mitigate any harm, and notify the affected Data Principals and the Data Protection Board of India as required. Our breach notices (if ever needed) will outline the nature of the breach, the data involved, steps we are taking to address it, and guidance on what you can do to protect yourself. We will endeavor to send such notice to you in a clear and concise manner and within the timeline prescribed by law. Protecting your data is our priority, and we will take all necessary measures to prevent and respond to security incidents.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. Once personal data has fulfilled its purpose and is no longer required, or upon your valid request for deletion, we will either delete it or anonymize it so that it can no longer be associated with you. Our retention practices are as follows:
laws, PF records). This retention is needed for any post-employment obligations (like employment verification requests, pension/benefit references, or legal disputes). After that, we archive or delete what is not needed. Some information, like payroll details, may be kept longer if mandated by tax laws.
SecondMedic™ is committed to honoring all the policies and user’s data rights and providing you with control over your information. Subject to verification of your identity and applicable laws, you have the following rights with respect to your personal data that we hold:
(for example, due to a legal retention obligation or an ongoing contract), we will inform you of that and isolate the data from active use. We will also delete data that is excessive or not required. Do note that deletion of some data (like health records) might limit our ability to provide you services in the future (for example, if you delete your consultation history, we cannot retrieve it later). Once we process an erasure request, the data will be removed from our active databases and we will also instruct our processors to delete the data. Residual copies might persist in backups for a short duration but will be removed as those backups cycle out.
regarding our processing of your personal data, and to have that grievance addressed in a timely manner. We have a dedicated grievance redressal mechanism (see Contact & Grievance Officer section below). You can reach out with your concerns – whether it's about a suspected misuse of data, a security incident, or an unresolved request regarding your rights. We will acknowledge your complaint and work to resolve it within the period prescribed by law. If you are not satisfied with our resolution, or if we fail to address your grievance within the prescribed time, you have the right to escalate the matter to the Data Protection Board, but before approaching the board – we are confident we will be able to resolve most issues amicably.
endeavor to keep you informed whenever we collect new data or use it for a new purpose. If we make any significant changes in how we process your data, we will notify you (via an updated policy and/or direct communication).
SecondMedic™ currently does not make any legally significant decisions about you purely by automated means. If in future we use automated algorithms for something that materially affects you, you will have rights related to such processing (like the right to seek human intervention or an explanation). We will update our Policy accordingly in that case.
You can exercise the above rights by contacting us through the channels provided in the Contact & Grievance Redressal section. To protect your privacy, we will need to verify your identity before fulfilling any requests (so we don't give your data to an imposter). For example, we may ask you to confirm some account details or use an OTP verification. For certain requests, if we have a self-service option (like an account settings page to download your data or update info), we will guide you to use that for faster resolution. Otherwise, upon receiving your request, we will respond as soon as possible and at most within the timeframe required by law. If we cannot fulfill your request (due to legal reasons or other specific grounds under law), we will provide an explanation. We will not discriminate against you for exercising your rights.
In general, we will handle your reasonable requests free of charge. However, if a request is manifestly unfounded or excessive (for example, repetitive requests without basis), the law allows us to either charge a reasonable fee (to cover administrative costs) or refuse the request. We will communicate any such decision clearly to you.
Your rights are very important and form the core of our consumer protection ethos. SecondMedic™ has established processes internally to ensure these rights are respected. If you need any assistance in understanding or exercising your rights, please let us know – we are here to help.
We may update or revise this Privacy Policy from time to time to reflect changes in our practices, to incorporate new services, to align with legal or regulatory developments, or for other legitimate purposes. When we do so, we will change the "Last Updated" date at the bottom of this Policy. If there are substantial changes to the Policy, we will provide a more prominent notice (such as a banner on our website or an email notification) so that you are made aware of the updates.
Significant changes might include (for example) adding new categories of personal data we collect, changing how we use data, or updating your rights or our obligations under new laws. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.
Your continued use of SecondMedic™'s services after any changes to this Privacy Policy constitutes acceptance of the updated terms (to the extent permitted by law). If required, we will seek fresh consent for new purposes of processing that are not covered by the original consent. We will also archive previous versions of this Policy and make them available for review, so you can see how our privacy commitments have evolved.
SecondMedic™ has appointed a Grievance Officer to address any questions, concerns, or complaints you may have regarding your personal data or this Privacy Policy. If you have any queries about how we handle your data, or if you wish to exercise your rights, or if you have a grievance to report, please do not hesitate to contact us:
Name: Sanjay Adtani
Email: dpo@secondmedic.com
Postal Address: Office No 320, Plot No 17-18, Platinum Techno Park, Palm Beach Road, Vashi, Navi Mumbai, Thane, Maharashtra 400703, India.
Phone: +91-8447748545 (Customer Support Helpline)
Note: The above contact information is provided for privacy-related concerns. For general customer service queries, you may also use [customer.support@secondmedic.com] or the support number. However, for any formal grievances under the DPDP Act, please direct them to the Grievance Officer contact.
The Grievance Officer is responsible for redressing your complaints in a timely manner, as mandated by law. When you contact us, please provide sufficient details of your issue, and any relevant information that would help us address it (for example, the email or phone associated with your account, specific interaction details, etc.). We will acknowledge your complaint and attempt to resolve it expeditiously. Our goal is to settle all grievances within 30 days or the period prescribed by Govt. regulations. If we need more time (for instance, if a thorough investigation is required), we will inform you of the delay and the reason.
If you are not satisfied with our response, or if your grievance is not resolved within the prescribed time, you have the right to file a complaint with the Data Protection Board (DPB). However, we are
committed to resolving issues directly and fairly, and we value the opportunity to fix any problems and improve our processes.
---
Last Updated: May 27, 2025. This Privacy Policy is effective as of this date and supersedes any prior privacy policy of SecondMedic™.
