Information We Collect

We collect information necessary to provide you with medicine delivery, doctor consultations, health tips, and related services.

Information You Provide

• Phone number — collected at registration and verified via Firebase Phone Authentication (OTP)
• Full name — used to personalise your account and delivery communications
• Email address — optional; used for order confirmations and account recovery
• Delivery address — city, pincode, and full address for medicine delivery
• Prescription images — uploaded when ordering prescription-only medicines
• Family member details — name, age, and relationship if you add family members to your account

Information Collected Automatically

• Device information — device model, operating system version, and app version for diagnostics
• Usage data — features accessed, screens visited, and in-app actions to improve the user experience
• FCM token — Firebase Cloud Messaging token for push notifications (order updates, appointment reminders)

How We Use Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Sharing & Disclosure

We share your information only in the following circumstances:

• With licensed pharmacies and delivery personnel — your name, address, and order details are shared to fulfil your medicine orders.
• With doctors — your name and phone number are shared with the doctor you book a consultation with.
• With payment processors — your name and phone number are shared with Razorpay to process payments securely. We do not store your card or bank details.
• With technology service providers — we use Firebase (Google), AWS S3, Cloudinary, and Zego solely to operate the app's core features. They process data only on our behalf under strict data processing agreements.
• For legal compliance — if required by law, court order, or governmental authority, we may disclose your information.
• With your consent — for any other purpose, only with your explicit consent.

Health & Prescription Data

Prescription images and health-related information you share with us are treated as Sensitive Personal Data or Information (SPDI) under Indian law and are subject to the highest level of protection we apply.

• Prescription images are uploaded to secure cloud storage (AWS S3 / Cloudinary) with access restricted to authorised pharmacy and admin staff only.
• Prescription data is used exclusively to verify and fulfil your medicine orders and is not shared with any third party beyond the licensed pharmacy fulfilling the order.
• Health information shared during doctor consultations is governed by medical confidentiality obligations and is not disclosed to any party other than your treating doctor.
• You may request deletion of your health records at any time by contacting us at support@omeds.in.

Payment Information

All payment transactions in the Omeds app are processed by Razorpay Software Private Limited, a PCI-DSS compliant payment gateway authorised by the Reserve Bank of India.

• We do not collect, store, or have access to your credit card, debit card, UPI PIN, or net banking credentials.
• Payment links are generated securely and expire after a fixed period. Transaction records (order ID, amount, status) are stored to maintain your order history.
• Razorpay's handling of your payment data is governed by their own Privacy Policy.

Storage & Security

Your data is stored on servers located in India and the United States (AWS, Google Firebase). We implement the following security measures:

• All data in transit is encrypted using TLS 1.2 or higher.
• Prescription images and sensitive files are stored in private cloud buckets not accessible via public URLs.
• Authentication is handled via Firebase, which uses industry-standard phone number verification.
• Access to user data within our systems is role-based and restricted to authorised personnel only.
• We use JSON Web Tokens (JWT) with short expiry periods for API authentication.

While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure. We encourage you to use a secure device and keep your OTP confidential.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account data (name, phone, email) — retained while your account is active, or up to 3 years after the last transaction, whichever is later, to comply with tax and regulatory requirements.
• Order records — retained for 5 years to comply with accounting and pharmaceutical dispensing regulations.
• Prescription images — retained for 12 months from the date of the order, then permanently deleted.
• Doctor consultation records — retained for 24 months in accordance with medical records standards.
• Push notification tokens — deleted when you log out or uninstall the app.

You may request early deletion of your data by writing to us at support@omeds.in. We will process deletion requests within 30 days, subject to any legal retention obligations.

Your Rights

As a user of our services in India, you have the following rights regarding your personal data:

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may request correction of inaccurate or incomplete data via the Profile section in the app or by contacting us.
• Deletion — you may request deletion of your account and associated personal data, subject to legal retention requirements.
• Withdrawal of consent — you may withdraw consent for data processing at any time by deleting your account. This will not affect the lawfulness of processing done before withdrawal.
• Data portability — you may request your data in a machine-readable format.
• Grievance redressal — you may raise a grievance with our Grievance Officer (contact details below). We will acknowledge within 48 hours and resolve within 30 days.

To exercise any of these rights, write to us at support@omeds.in with the subject line "Data Rights Request".

Children's Privacy

The Omeds app is intended for use by individuals aged 18 years and above. We do not knowingly collect personal information from children under the age of 18. The family member feature within the app allows adults to manage health services on behalf of family members; however, the account holder must be an adult.

If we become aware that we have inadvertently collected personal information from a person under 18 without parental consent, we will take steps to delete that information promptly. Parents or guardians who believe we may have collected such information are requested to contact us at support@omeds.in.

Third-Party Services

The app integrates the following third-party services. Each has its own privacy policy that governs their data handling:

Links to their respective privacy policies are available on their official websites. We are not responsible for the privacy practices of these third-party services beyond the data processing agreements in place.

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this page.
• Notify you via a push notification or in-app banner when you next open the Omeds app.
• For significant changes affecting your rights, we will request your re-acknowledgment before you can continue using the service.

Continued use of the app after the effective date of a revised policy constitutes your acceptance of the updated terms.

Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Grievance Officer: