1. Scope
This Policy applies to Personal Information we collect through the Platform and related services such as booking, home sample collection and report delivery.
The Platform may contain links to websites or plug-ins operated by third parties. This Policy does not apply to them. They may place their own cookies, collect data or ask for Personal Information, and we are not responsible for their privacy practices or content. Please read their policies.
Any summary of this Policy generated by third-party software has no legal effect and does not replace this Policy.
2. Information we collect
Information you give us
When you create an account, book a test or use the Services, we may collect:
- Name, phone number, email address, age, date of birth and gender
- Address and location details needed for sample collection
- Patient profile details for yourself and family members you add
- Medical prescriptions, uploaded reports and test history
- Health information you choose to share, such as medical conditions or medication
- Account details such as login credentials and preferences
- Booking, payment status and communication records with our support team
If you add another person’s details (for example a family member), you confirm that you are authorised to share them and to consent on their behalf. For a person under 18, the booking must be made by a parent or legal guardian.
Information collected automatically
When you use the Platform, we and our service providers may collect:
- Device information such as device type, operating system, language, time zone and unique device identifiers
- IP address and server log data
- Information about how you use the Platform, such as pages viewed, buttons clicked and session activity
- Mobile network information
Cookies and similar technologies
We use cookies, pixel tags and similar technologies to keep you logged in, remember preferences, understand usage and improve the Platform. We and our partners may also use them to measure the performance of advertisements.
You can set your browser or device to accept all cookies, block some, ask before placing them, or block all. Blocking all cookies may prevent some features of the Platform from working properly.
Mobile app permissions
If you use our mobile app, we ask for the following permissions only when needed, and you can change them at any time in your device settings:
- Location: to schedule and complete home sample collection and to show nearby laboratories and centres
- Camera and file or photo access: to upload prescriptions and reports
- Notifications: to send booking and report updates
- Phone or SMS (where applicable): to auto-read OTPs and verify your number
Information collected through these permissions may be stored on our servers or our service providers’ servers, as well as on your device. Declining a permission may limit the related feature.
Sign-in through third-party accounts
If you choose to sign in with Google, Apple or a similar service, we receive only basic details you allow, such as your name and email address, to authenticate you and manage your account. We do not access your emails, contacts, posts or other content on those services. Your use of those services is governed by their own terms and policies.
3. Payment information
OnHealth does not access, collect or store your card numbers, UPI PIN, net-banking credentials or other sensitive payment data. Payments are processed by third-party payment gateways under their own security standards and privacy policies. We receive only limited information such as the payment status and a transaction reference. We are not responsible for how those providers handle your payment information.
4. How we use your information
We use Personal Information to:
- Create and manage your account and verify your identity
- Confirm, schedule, reschedule and complete your bookings
- Arrange sample collection and pass the necessary details to partner laboratories
- Deliver reports and booking updates
- Provide customer support and respond to your requests and complaints
- Process payments and refunds and prevent fraud
- Improve, personalise and secure the Platform and our Services
- Send service messages and, with your consent, offers and promotions
- Comply with legal obligations and respond to lawful requests
We will not use your Personal Information for a purpose that is materially different from those above without informing you or, where required, seeking your consent.
5. Consent
By using the Platform and ticking the consent box (where shown), you give us your consent to collect, store, use and share your Personal Information as described in this Policy. You can choose not to provide certain information, but we may then be unable to provide some or all of the Services.
You may withdraw your consent at any time by writing to us at the contact details in Section 13. Withdrawal does not affect processing already done, and we may need to retain some information as required by law. If you withdraw consent that is needed to provide the Services, we may stop providing them.
6. Communications and marketing
We may contact you by SMS, email, phone call, WhatsApp and app notifications to:
- Send service messages such as OTPs, booking confirmations, reminders and report availability
- With your consent, tell you about offers, health packages and new services
Service messages are necessary for the Services and cannot be switched off while you have an active booking. You can opt out of promotional messages at any time through the unsubscribe option in the message, in your app settings, or by emailing us. We follow applicable telecom and commercial communication regulations. Consent to marketing is not a condition for any purchase.
7. Sharing of information
We do not sell or rent your Personal Information. We share it only as follows:
- Partner laboratories and collection staff: to perform tests, collect samples and issue reports. When you book a test, you consent to this sharing.
- Service providers: such as payment gateways, SMS, email and WhatsApp providers, cloud hosting and analytics providers, who act on our instructions and are required to keep your information secure.
- Legal and regulatory reasons: where required by law, court order or a lawful request from a government authority, or to investigate fraud, protect our rights or prevent harm.
- Business transfers: if OnHealth is involved in a merger, acquisition or sale of assets, your information may be transferred to the successor, which will be bound to protect it in line with this Policy.
- Aggregated or anonymised data: we may share statistics that do not identify you.
We will seek your consent before sharing your Personal Information in any other way.
8. Data security
We take reasonable security measures to protect Personal Information from unauthorised access, loss, misuse, alteration or disclosure. These include access controls limited to people who need the data, encryption of data in transit and, where appropriate, at rest, secure hosting, and regular review of our security practices.
No system is completely secure, and we cannot guarantee absolute security. Please help protect your account:
- Keep your OTP and login details private and never share them with anyone, including people claiming to be from OnHealth
- Log out when using a shared device
- Be careful of phishing messages or calls. If you receive a suspicious message claiming to be from OnHealth, do not respond and report it to our Grievance Officer
If a personal data breach affects you, we will notify you and the relevant authorities as required by law.
9. Data retention and deletion
We keep Personal Information only for as long as needed for the purposes in this Policy, to provide the Services, or as required by law (for example for accounting, tax, dispute resolution or medical-record rules), whichever is longer. After that we delete or anonymise it.
You can ask us to delete your account and Personal Information by writing to us. We will do so unless we are required or permitted by law to keep it, such as for legal claims, fraud prevention or regulatory compliance. We may retain a limited copy for those purposes.
10. Your rights
Subject to applicable law, you may:
- Ask to access the Personal Information we hold about you
- Ask us to correct inaccurate or incomplete information and keep it up to date
- Ask us to erase your Personal Information
- Withdraw your consent
- Ask for a summary of how your information is processed and shared
- Nominate another person to exercise your rights if you die or become incapacitated
- Raise a grievance with us and, if it is unresolved, complain to the Data Protection Board of India or another competent authority
To protect your privacy, we will take reasonable steps to verify your identity before acting on a request. We aim to respond within a reasonable time, and in any case within the period required by law.
11. Children’s information
The Platform is intended for adults. A person under 18 may use it only through a parent or legal guardian, who is responsible for the information provided and for giving consent. We do not knowingly collect a child’s Personal Information without verifiable parental consent. If you believe a child’s information was provided without consent, contact us and we will take steps to delete it.
12. Prohibited use of the Platform
In line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you must not use the Platform to host, upload, share or transmit any information that:
- Belongs to another person and which you have no right to share
- Is defamatory, obscene, harassing, hateful, invasive of another’s privacy or otherwise unlawful
- Harms minors in any way
- Infringes any patent, trademark, copyright or other proprietary right
- Impersonates another person or misleads about its origin
- Contains viruses or code designed to disrupt or damage any system
- Threatens the unity, integrity, security or sovereignty of India, public order or public health
- Violates any law in force
You also must not attempt to breach the security of the Platform, use bots or scrapers, reverse engineer any part of it, copy or frame our content, or knowingly submit false or inaccurate information. We may remove such content and suspend accounts that violate these rules.
13. Grievance Officer and contact
For questions about this Policy, to exercise your rights, or to make a complaint about how your Personal Information is handled, please contact:
- Email: [email protected]
- Website: https://onhealth.in
We will acknowledge your complaint promptly and try to resolve it within the period required by law.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date and will take effect once posted. Where a change is significant, we will take reasonable steps to inform you. Continued use of the Platform after an update means you accept the updated Policy.
15. Governing law and disputes
This Privacy Policy is governed by the laws of India. Any dispute will first be addressed through the grievance process above. If it cannot be resolved, it will be referred to arbitration by a sole arbitrator mutually appointed by the parties under the Arbitration and Conciliation Act, 1996, as amended. The seat of arbitration will be Jhansi, Uttar Pradesh, and the language will be English. Subject to this, the courts at Jhansi, Uttar Pradesh will have exclusive jurisdiction.
A printed copy of this Policy and of any notice given in electronic form is admissible in legal proceedings to the same extent as other business records originally generated in printed form.