Privacy Policy

1. Introduction and Commitment to Your Privacy

NamNalam Health Tech Private Limited (trading as FettleMed) ("we," "us," "our," or "FettleMed") is committed to building India's digital health backbone while placing your health data ownership at the absolute center of everything we do. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal and health information in connection with our integrated digital health platform, including our Patient App, Doctor Clinical Portal, Clinic Management System, and related services (collectively, the "Services").

Our core principle is Patient Data Sovereignty. You own your health data, and we are committed to transparency, trust, and security in how we handle it. We believe that empowering patients with complete control over their health information is not just ethically right-it is essential to building a more equitable and efficient healthcare ecosystem in India. Please read this Policy carefully to understand our privacy practices and your rights.

2. Our Privacy Principles

At FettleMed, we are guided by the following fundamental privacy principles that inform every decision we make:

• Patient-Centricity: You are at the core of everything we do. Your rights, preferences, and well-being drive our product development and operational decisions.
• Ownership: We recognize your fundamental right to own and control your personal health data. Your health information is yours, and you have the final say on who can access it.
• Trust & Transparency: We operate with complete transparency about how we collect, use, and protect your information. We build trust through our actions, not just our words.
• Security: The security and privacy of your health information are paramount. We employ the most robust technical and organizational measures to protect your data.
• Simplicity & Accessibility: Privacy should not be complex. We design clear, intuitive controls that empower you to manage your privacy without technical expertise.
• Education: We believe in empowering you with knowledge about your rights, our practices, and how to protect your health information. An informed patient is an empowered patient.

3. Information We Collect

3.1 Health Information You Provide

• Medical Records: Prescriptions, consultation notes, test reports, diagnostic records, vaccination certificates, and other clinical documents
• Health History: Chronic conditions, past diagnoses, surgical history, allergies, medications, and family medical history
• Lifestyle Information: Diet, exercise habits, stress levels, sleep patterns, and other wellness-related data
• Consent Records: Your explicit permissions regarding how your health data can be accessed and shared

3.2 Personal Information You Provide

• Account Information: Name, email address, phone number, date of birth, gender, and address
• Profile Information: Emergency contacts, insurance details, preferred language, and communication preferences
• Family Information: Details about family members for whom you manage health records
• Communication Data: Messages, inquiries, feedback, and support requests

3.3 Information Collected Automatically

• Device Information: Device type, operating system, browser type, mobile device identifier, and device settings
• Usage Information: Features accessed, pages viewed, time spent on the platform, search queries, and interaction patterns
• IP Address and Location: IP address and approximate geographic location based on IP address (not precise GPS location without your consent)
• Cookies and Analytics: We use Google Analytics (a service provided by Google LLC) to collect anonymised usage information including pages visited, time spent, and device type. Google Analytics uses cookies and may transfer data to Google servers. No personal health data is included in analytics. You can decline analytics tracking via our cookie consent banner, or opt out via Google's opt-out tool.

3.4 Information from Healthcare Providers

• Doctor and Clinic Data: When your doctor or clinic uploads your records to FettleMed with your consent
• Lab Reports: Digital submission of test results from diagnostic centers

3.5 Information from Third Parties

• Social Media: Information if you choose to connect your social media accounts to your FettleMed profile
• Service Providers: Information from our partners who provide specific services to enhance the platform, under data processing agreements that limit their use of your information to the services they provide us

4. How We Use Your Information

4.1 To Deliver and Improve Our Services

• Consolidate and organize your health records into a unified Personal Health Record
• Provide access to your health information through our Patient App, Doctor Portal, and related Services
• Send appointment and medication reminders to help you stay on top of your care
• Continuously improve the functionality and user experience of our platform

4.2 To Support Clinical Care

• Share your health information with healthcare providers based on your explicit consent
• Organise and present your health history to the healthcare providers you authorise
• Facilitate continuity of care across multiple healthcare providers

4.3 To Communicate with You

• Send appointment reminders, medication alerts, and follow-up communications
• Notify you of record access and consent activity on your account
• Respond to your inquiries and provide customer support

4.4 For Analytics and Improvement

• Analyze usage patterns to improve platform functionality (using de-identified or aggregated data)
• Conduct internal analysis using aggregated, de-identified data to understand how the platform is used and where it can be improved
• Understand how doctors and patients interact with our platform to enhance features

4.5 For Security and Compliance

• Detect, prevent, and address fraud, security breaches, and technical issues
• Maintain audit logs and access records for security and regulatory compliance
• Comply with applicable laws, regulations, and legal processes (ABDM, DPDPA 2023, IT Act 2000, and applicable Indian data protection laws)

5. How We Share Your Information

We believe in transparent data sharing practices. Your health information is shared only with your explicit, documented consent and always for purposes that directly benefit your healthcare journey.

5.1 With Healthcare Providers (With Your Consent)

When you grant explicit consent through our platform, we securely share your health records with doctors, hospitals, and clinics you authorize. You maintain complete control over which providers can access which information and for how long.

5.2 With Service Providers

We may work with service providers (hosting providers, payment processors, security specialists, analytics providers) who help us deliver our Services. These providers are contractually bound to maintain strict confidentiality and use your information only as necessary to support our Services. We carefully vet all partners and implement data protection agreements.

5.3 With Family Members

You can manage health records for family members and grant them access to your records through explicit permission controls. All such sharing is managed through granular consent permissions that you control.

5.4 For Legal Compliance

We may disclose your information if required by law, court order, or government regulation. In such cases, we will notify you promptly (unless legally prohibited) and work to limit disclosure to only what is legally required. We will cooperate with your efforts to seek protective orders.

5.5 De-Identified Research (With Ethical Oversight)

We may use aggregated, de-identified health data for research that improves digital health in India. Such data cannot be used to identify you. You can opt out of contributing to aggregated analysis at any time by contacting us at dpo@namnalamhealth.com.

5.6 Business Transfers

If FettleMed is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. Any successor organization will be required to maintain the same commitments to your privacy and data sovereignty. We will notify you of any material changes.

6. Your Consent and Control: The Heart of Our Privacy Model

Patient Data Sovereignty is not just a concept at FettleMed-it is operational reality embedded in our platform architecture. You maintain granular, auditable control over your health information at all times.

6.1 Granular Consent Management

• Data Sharing Permissions: Control exactly which healthcare providers can access your health record
• Time-Bound Access: Set expiration dates for each consent so access is automatically revoked after a specified period
• Real-Time Consent Revocation: Withdraw consent at any time with immediate effect

6.2 Access Audit Trail

You can view a complete, auditable log of every time someone accesses your health information. This transparency lets you monitor exactly who has seen your data and when.

6.3 Data Access and Correction

You have the right to access, review, and correct your personal information at any time. You can update your account information directly through our app or by contacting us.

6.4 Communication Preferences

You control how we communicate with you. You can opt out of marketing communications, adjust notification preferences, and select your preferred language and contact method at any time.

6.5 Cookie and Analytics Choices

When you first visit FettleMed, a cookie consent banner allows you to accept or decline Google Analytics tracking. If you decline, no analytics data is collected. Your choice is stored in your browser and you can change it at any time by clearing your browser's local storage. You can also opt out of Google Analytics at any time using Google's browser opt-out tool.

7. Data Security and Protection

We implement comprehensive technical and organizational security measures appropriate for sensitive health information. Security is not an afterthought but is architected into every layer of our platform.

7.1 Technical Safeguards

• End-to-end encryption: Your health data is encrypted in transit using TLS 1.2+.
• Access Control: Role-based access control ensures employees and systems can access only the data necessary for their functions
• Audit Logging: All access to health data is logged and monitored for suspicious activity
• Firewalls and Intrusion Detection: Enterprise-grade firewalls and intrusion detection systems protect our infrastructure
• Regular Security Testing: We conduct regular penetration testing and vulnerability assessments

7.2 Organizational Safeguards

• Strict Confidentiality Agreements: Employees and contractors sign comprehensive confidentiality and non-disclosure agreements
• Data Minimization: We collect and retain only the health information necessary to serve your needs
• Access Restrictions: Physical and administrative controls limit who can access our systems and facilities

7.3 Incident Response

In the unlikely event of a data breach, we have a comprehensive incident response plan. We will notify affected individuals and relevant authorities as required by law, typically within 72 hours of discovering the breach. We will also provide resources to help you protect yourself.

Note: While we employ robust security measures, no online system is 100% secure. We are transparent about this reality and continuously work to minimize risks. We recommend using strong passwords, enabling two-factor authentication, and not sharing your account credentials.

8. Data Retention

We retain your personal and health information for as long as necessary to provide our Services, comply with legal obligations, and resolve disputes. The retention period varies depending on the type of information and the context of processing:

• Health Records: Retained indefinitely at your direction. You own this data and can request deletion at any time
• Account Information: Retained while your account is active; you can delete your account at any time
• Audit Logs: Retained for 7 years to comply with regulatory requirements
• Research Data: Used for research only with your explicit consent. If you withdraw consent or request deletion, the related data is deleted
• Deleted Data: Securely destroyed using industry-standard methods that render data unrecoverable

9. International Data Transfers

FettleMed is headquartered in India. Patient health records are stored on infrastructure with the primary data centre in India. Certain backup or supporting services may operate in other regions under contractual data-protection obligations. Anonymised, non-identifiable usage analytics (Google Analytics) may be processed on Google's infrastructure outside India, but contain no personal or health data.

10. Children's Privacy

Our Services are not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from a child under 13, please contact us immediately at dpo@namnalamhealth.com. Parents and guardians can manage their children's health records through their own accounts with appropriate parental controls.

11. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, and services that are not operated by FettleMed. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services before providing your information or using those services. We are not liable for the privacy practices or content of third-party services.

12. Compliance with Data Protection Regulations

12.1 ABDM (Ayushman Bharat Digital Mission) Compliance

FettleMed is designed to align with the Ayushman Bharat Digital Mission (ABDM) framework established by the Government of India. We are building toward the consent and data exchange standards of ABDM, working to enable interoperability with the broader Indian healthcare ecosystem while maintaining your data sovereignty principles.

12.2 India Data Protection Laws

We comply with applicable Indian data protection laws, including provisions related to health data handling. We recognize the sensitive nature of health information and implement protections that exceed minimum legal requirements.

12.3 Additional Rights for Certain Jurisdictions

FettleMed primarily serves users in India. If you access our Services from another jurisdiction, you may have additional rights under your local data protection laws. Contact us at dpo@namnalamhealth.com to exercise those rights and we will respond in accordance with applicable law.

13. Your Rights and Choices

13.1 Right to Access

You have the right to request access to the personal and health information we hold about you. You can view most of your information directly through your FettleMed account. For comprehensive data export, contact our privacy team.

13.2 Right to Rectification

You have the right to correct inaccurate personal information. You can update most information directly through your account settings.

13.3 Right to Deletion

You have the right to request deletion of your account and associated information. We will delete your data subject to legal requirements (e.g., audit retention), regulatory obligations, and legitimate business needs. You can initiate account deletion through your account settings or by contacting us.

13.4 Right to Data Portability

You have the right to receive your health information in a structured, commonly used, machine-readable format (e.g., PDF, XML, HL7). This enables you to transfer your data to another healthcare platform if you choose. Contact our support team to request a data export.

13.5 Right to Object

You have the right to object to certain uses of your information, including marketing communications, profiling, or certain automated decision-making. You can update your preferences in your account settings at any time.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Policy on our website and through our app, or by sending you email notification if we have your email address. Your continued use of our Services after such notice constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, requests regarding this Privacy Policy, or if you wish to exercise any of your privacy rights, please contact us:

Response Timeline: We aim to respond to all privacy requests within 14 days. Complex requests may require additional time, and we will keep you informed of progress.