Privacy Policy

Medaffin Ecosystem Applications - Privacy Policy

Effective Date: May 1, 2025

Last Updated: September 30, 2026

1. Introduction

Arupa AI Private Limited ("we," "us," or "our"), a company incorporated in Hyderabad, Telangana, India, operates the Medaffin Ecosystem web applications (the "Service"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, store, and protect your information when you access or use the Medaffin platform, which is designed exclusively for healthcare professionals worldwide.

By using our Service, you agree to the collection and use of information by this Privacy Policy. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

2. Information We Collect

2.1 Personal Information

When you register for and use our Service, we may collect several types of information from and about you, including:

Account Information: When you create an account, we collect your name, email address, professional credentials, healthcare specialization, work location, and other information necessary to verify your status as a healthcare professional.
Profile Information: You may choose to provide additional information for your profile, such as your professional experience, education, certifications, areas of expertise, and professional interests.
Payment Information: When you purchase our Explorer Plan membership, we collect payment information including billing address and payment method details. However, we do not store complete credit card numbers or payment card details on our servers, as these are processed by our secure third-party payment processors.
Professional Verification Data: To maintain the exclusivity of our healthcare professional community, we may collect and verify professional licenses, certifications, employment information, and educational credentials.

2.2 Usage Information

We automatically collect certain information about your use of our Service, including:

Device Information: We collect information about the device you use to access our Service, including hardware model, operating system and version, unique device identifiers, mobile network information, and device settings.
Log Information: We collect log information when you use our Service, including your IP address, browser type and version, pages visited, time and date of visits, time spent on pages, and other diagnostic data.
Interaction Data: We collect information about your interactions with our Service, including features used, content accessed, search queries, career navigator tool usage, AI chatbot conversations, community feed engagement, and points earned through the Medaffin Attention Program.
Location Information: We may collect general location information based on your IP address to provide location-relevant content such as local healthcare news, events, and career opportunities.

2.3 Communication Data

We collect information related to your communications through our Service, including:

Community Interactions: Posts, comments, and interactions within the Pulse community feed, subject to our community moderation policies.
Support Communications: Records of your communications with our customer support team, including emails, chat logs, and support tickets.
AI Chatbot Conversations: Conversations with the Medaffin AI chatbot to improve our Service and provide personalized responses.

2.4 Cookies and Similar Technologies

We use cookies and similar tracking technologies to collect and use personal information about you. Our Cookie Policy, which is part of this Privacy Policy, provides detailed information about our use of cookies and how you can manage your cookie preferences.

3. How We Use Your Information

3.1 Service Provision

We use your information to provide, maintain, and improve our Service, including:

Account Management: Creating and managing your account, verifying your healthcare professional status, and providing customer support.
Personalized Experience: Customizing your experience based on your professional background, interests, and usage patterns to provide relevant career guidance, content recommendations, and networking opportunities.
AI-Powered Features: Powering our Career Navigator tool and AI chatbot to provide personalized career advice, answer professional queries, and deliver relevant healthcare information.
Community Features: Enabling participation in the Pulse community feed, facilitating professional networking, and providing location-relevant news and events.
Points and Rewards: Managing the Medaffin Attention Program, tracking points earned through platform engagement, and facilitating redemption of rewards and vouchers.

3.2 Communication

We use your information to communicate with you, including:

Service Communications: Sending important updates about your account, changes to our Service, security alerts, and administrative messages.
Marketing Communications: With your consent, sending promotional emails about new features, content, events, and opportunities that may be of interest to you as a healthcare professional.
Community Notifications: Notifying you about relevant community activities, networking opportunities, and professional events in your area.

3.3 Analytics and Improvement

We use your information to analyze and improve our Service, including:

Usage Analytics: Understanding how users interact with our Service to identify areas for improvement and develop new features.
Performance Monitoring: Monitoring the performance and reliability of our Service to ensure optimal user experience.
Research and Development: Researching to enhance our AI capabilities, improve career guidance algorithms, and develop new tools for healthcare professionals.

3.4 Legal and Security

We use your information for legal and security purposes, including:

Compliance: Ensuring compliance with applicable laws, regulations, and professional standards relevant to healthcare and data protection.
Security: Protecting against fraud, unauthorized access, and other security threats to maintain the integrity of our Service and protect user data.
Legal Obligations: Responding to legal requests, court orders, and regulatory requirements as necessary.

4. Information Sharing and Disclosure

4.1 General Principles

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this Privacy Policy.

4.2 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our Service, including:

Payment Processors: Secure third-party payment processors that handle membership payments and billing operations.
Cloud Infrastructure: Cloud service providers that host our Service and store data securely with appropriate safeguards.
Analytics Services: Analytics providers that help us understand user behavior and improve our Service, with data anonymized where possible.
Communication Services: Email service providers and communication platforms that help us deliver Service-related and marketing communications.

All service providers are contractually obligated to protect your information and use it only for the specific purposes for which it was shared.

4.3 Community Features

Certain information may be shared within our healthcare professional community:

Profile Information: Basic professional information in your profile may be visible to other verified healthcare professionals within the community to facilitate networking and professional connections.
Community Contributions: Posts, comments, and interactions within the Pulse community feed are visible to other community members, subject to our moderation policies.
Professional Networking: Information necessary for professional networking and collaboration within the healthcare community, always with appropriate privacy controls.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

Legal Process: Complying with court orders, subpoenas, or other legal processes.
Law Enforcement: Cooperating with law enforcement agencies when legally required or when we believe disclosure is necessary to protect rights, property, or safety.
Regulatory Compliance: Meeting regulatory requirements applicable to healthcare data and professional services.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity, subject to the same privacy protections outlined in this Privacy Policy.

5. Data Security

5.1 Security Measures

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption: Data encryption in transit and at rest using industry-standard encryption protocols.
Access Controls: Strict access controls and authentication mechanisms to ensure only authorized personnel can access personal information.
Regular Security Audits: Regular security assessments and audits to identify and address potential vulnerabilities.
Employee Training: Comprehensive privacy and security training for all employees who handle personal information.
Incident Response: Established procedures for detecting, responding to, and reporting security incidents.

5.2 Healthcare Data Protection

Given our focus on healthcare professionals, we implement additional security measures appropriate for healthcare-related information:

Professional Data Safeguards: Enhanced protection for professional credentials, licensing information, and healthcare-related communications.
Compliance Standards: Adherence to healthcare data protection standards and best practices applicable in various jurisdictions.
Secure Communication: Encrypted communication channels for sensitive professional discussions and consultations.

5.3 Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer need your information, we securely delete or anonymize it by our data retention policies.

6. Your Rights and Choices

6.1 Access and Portability

You have the right to access your personal information and request a copy of the data we hold about you. You may also request that we provide your data in a structured, commonly used, and machine-readable format for portability to another service.

6.2 Correction and Updates

You have the right to correct or update your personal information if it is inaccurate or incomplete. You can update most of your information directly through your account settings, or you may contact us for assistance.

6.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions such as legal obligations or legitimate business interests. We will respond to deletion requests by applicable law.

6.4 Restriction and Objection

You have the right to restrict or object to certain processing of your personal information, including:

Marketing Communications: You can opt out of marketing communications at any time by following the unsubscribe instructions in our emails or updating your communication preferences in your account settings.
Data Processing: You may object to certain types of data processing, subject to our legitimate business interests and legal obligations.

6.5 Consent Withdrawal

Where we process your information based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

6.6 Exercising Your Rights

To exercise any of these rights, please contact us using the contact information provided in this Privacy Policy. We will respond to your request within the timeframes required by applicable law.

7. International Data Transfers

7.1 Global Service

As Medaffin serves healthcare professionals worldwide, your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

7.2 Transfer Safeguards

When we transfer your information internationally, we implement appropriate safeguards to ensure your information receives adequate protection, including:

Adequacy Decisions: Transferring data to countries that have been deemed to provide adequate protection by relevant authorities.
Standard Contractual Clauses: Using standard contractual clauses approved by relevant data protection authorities.
Certification Programs: Participating in recognized certification programs that ensure appropriate data protection standards.

7.3 India-Based Operations

As a company incorporated in India, our primary data processing operations are based in India, which provides the legal framework for our data protection practices.

8. Children's Privacy

8.1 Age Restrictions

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us.

8.2 Discovery of Child Data

If we become aware that we have collected personal information from children under 18 without verification of parental consent, we will take steps to remove that information from our servers.

9. Regional Privacy Rights

9.1 European Union (GDPR)

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR), including:

Legal Basis: We process your information based on legitimate interests, contract performance, consent, or legal obligations as applicable.
Data Protection Officer: You may contact our Data Protection Officer for GDPR-related inquiries.
Supervisory Authority: You have the right to complain with your local supervisory authority.

9.2 California (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

Right to Know: The right to know what personal information we collect, use, disclose, and sell.
Right to Delete: The right to request deletion of your personal information.
Right to Opt-Out: The right to opt out of the sale of personal information (note: we do not sell personal information).
Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

9.3 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate and will update this Privacy Policy as necessary to reflect changes in legal requirements.

10. Cookies and Tracking Technologies

10.1 Types of Cookies

We use several types of cookies and similar technologies:

Essential Cookies: Necessary for the operation of our Service, including authentication and security functions.
Performance Cookies: Help us understand how users interact with our Service to improve performance and user experience.
Functional Cookies: Enable enhanced functionality and personalization based on your preferences and usage patterns.
Analytics Cookies: Provide insights into user behavior and Service usage to help us improve our offerings.

10.2 Cookie Management

You can control cookies through your browser settings and our cookie preference center. However, disabling certain cookies may affect the functionality of our Service.

10.3 Third-Party Cookies

We may use third-party cookies for analytics, advertising, and other purposes. These third parties have their own privacy policies governing their use of your information.

11. Updates to This Privacy Policy

11.1 Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

11.2 Notification Methods

For significant changes, we may provide additional notice through:

Email Notifications: Sending notice to the email address associated with your account.
Service Notifications: Displaying prominent notices within our Service.
Website Announcements: Posting announcements on our website.

11.3 Continued Use

Your continued use of our Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

12. Contact Information

12.1 Privacy Inquiries

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Arupa AI Private Limited

Privacy Officer

Hyderabad, Telangana, India

Email: info@arupa.ai

Website: www.arupa.ai

12.2 Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer at:

Email: dpo@arupa.ai

12.3 Response Time

We will respond to privacy-related inquiries within the timeframes required by applicable law, typically within 30 days of receipt.

13. Indian Data Protection Laws and Compliance

13.1 Digital Personal Data Protection Act, 2023 (DPDPA)

As an Indian company, we comply with the Digital Personal Data Protection Act, 2023, which establishes comprehensive data protection rights for Indian citizens and residents. Under the DPDPA, we ensure:

Lawful Processing: We process personal data only for lawful purposes with appropriate legal basis, including consent, legitimate interests, or compliance with legal obligations as defined under the DPDPA.
Data Minimization: We collect and process only such personal data as is necessary for the specified purpose and retain it only for as long as necessary to fulfill that purpose.
Purpose Limitation: Personal data is processed only for the purpose for which it was collected, and any additional processing is done only with fresh consent or under other lawful grounds specified in the DPDPA.
Data Quality: We ensure that personal data is accurate, complete, and kept up-to-date. Users can request correction of inaccurate data through their account settings or by contacting our Data Protection Officer.
Transparency: We provide clear and easily understandable information about our data processing activities through this Privacy Policy and other communications.

13.2 Rights Under DPDPA

Indian data principals (users) have the following rights under the DPDPA:

Right to Information: You have the right to obtain information about the personal data we hold about you, including the purposes of processing, categories of data, and retention periods.
Right to Correction and Erasure: You can request correction of inaccurate personal data and erasure of personal data where it is no longer necessary for the original purpose or where consent has been withdrawn.
Right to Grievance Redressal: You have the right to file complaints with our Grievance Officer and subsequently with the Data Protection Board of India if your concerns are not adequately addressed.
Right to Nominate: You may nominate another person to exercise your rights under the DPDPA in the event of death or incapacity.

13.3 Information Technology Act, 2000 and Rules

We comply with the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

Sensitive Personal Data Protection: We implement reasonable security practices for protecting sensitive personal data including passwords, financial information, health data, and biometric information.
Security Practices: We maintain comprehensive information security programs including physical, technical, and administrative safeguards as required under the IT Rules.
Data Breach Notification: We follow prescribed procedures for reporting data breaches to relevant authorities and affected individuals as required under Indian law.
Cross-Border Transfer: We ensure that any transfer of sensitive personal data outside India complies with the requirements under the IT Rules, including obtaining consent and ensuring adequate data protection standards.

13.4 Healthcare-Specific Indian Regulations

Given our focus on healthcare professionals, we comply with healthcare-specific Indian regulations:

Clinical Establishments Act: We respect the regulatory framework governing clinical establishments and healthcare service providers in India.
Medical Council of India Guidelines: We adhere to professional guidelines issued by medical councils regarding professional conduct and patient confidentiality.
Telemedicine Practice Guidelines: For any telemedicine-related features, we comply with the Telemedicine Practice Guidelines issued by the Ministry of Health and Family Welfare.
Drugs and Cosmetics Act: We ensure compliance with regulations regarding the promotion and discussion of pharmaceutical products and medical devices.

13.5 Grievance Redressal Mechanism

By Indian law, we have established a grievance redressal mechanism:

Grievance Officer: We have appointed a Grievance Officer to address complaints and concerns related to data protection and privacy.
Contact Information:
- Name: Rahul Reddy Pol
- Email: grievance@arupa.ai
- Address: Arupa AI Private Limited, Hyderabad, Telangana, India
- Response Time: We will acknowledge complaints within 24 hours and resolve them within 30 days
Escalation: If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is established.

13.6 Data Localization and Storage

We comply with Indian data localization requirements:

Critical Personal Data: Any data classified as critical personal data under Indian law will be processed only within India.
Sensitive Personal Data: We ensure that sensitive personal data of Indian users is stored within India, with limited exceptions for processing outside India under prescribed conditions.
Data Centers: Our primary data processing and storage infrastructure for Indian users is located within India to ensure compliance with localization requirements.

13.7 Consent Management

We implement robust consent management practices by Indian law:

Free and Informed Consent: We obtain free, informed, specific, clear, and unambiguous consent for processing personal data.
Consent Withdrawal: Users can withdraw consent at any time through their account settings or by contacting our Grievance Officer.
Consent Records: We maintain detailed records of consent given by users, including the time, manner, and scope of consent.
Parental Consent: For users under 18 years of age, we obtain verifiable parental consent before processing their personal data.

13.8 Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) as required under Indian law:

High-Risk Processing: We perform DPIAs for processing activities that pose high risks to the rights and freedoms of data principals.
New Technologies: DPIAs are conducted when implementing new technologies or processing methods that may impact privacy.
Regular Reviews: We regularly review and update our DPIAs to ensure ongoing compliance with Indian data protection requirements.

13.9 Cross-Border Data Transfers

For international data transfers involving Indian personal data:

Adequacy Assessment: We transfer data only to countries or organizations that provide adequate level of protection as determined by the Indian government.
Standard Contractual Clauses: We use approved standard contractual clauses for transfers to countries without adequacy decisions.
Consent-Based Transfers: Where required, we obtain explicit consent from users for specific international transfers.
Transfer Records: We maintain detailed records of all cross-border data transfers including safeguards implemented.

13.10 Compliance Monitoring and Auditing

We maintain ongoing compliance with Indian data protection laws through:

Regular Audits: Internal and external audits of our data processing activities and security measures.
Legal Updates: Continuous monitoring of changes in Indian data protection laws and regulations.
Staff Training: Regular training for all employees on Indian data protection requirements and best practices.
Documentation: Comprehensive documentation of our compliance measures and procedures.

13.11 Cooperation with Indian Authorities

We cooperate fully with Indian regulatory authorities:

Data Protection Board: We will comply with directions and orders from the Data Protection Board of India once established.
Law Enforcement: We cooperate with Indian law enforcement agencies by applicable laws and legal processes.
Regulatory Inquiries: We respond promptly to inquiries from relevant Indian regulatory authorities.
Reporting Obligations: We fulfill all reporting obligations under Indian data protection and cybersecurity laws.