Privacy Policy

1. Who We Are & Scope

EbiHealth360 Solutions ("we", "us", "our") operates the EbiHealth360 Solutions telehealth platform available at ebihealth360.com and via our mobile applications. This Privacy Policy explains how we collect, use, store, share, and protect your personal and health information when you use our services.

This policy applies to all users including patients, registered doctors, medical tourism clients, and website visitors.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, consultation duration, click patterns
• Location Data: General geographic location based on IP (not precise GPS tracking)
• Cookies: Session cookies for authentication, preference cookies for settings
• Log Data: Server logs including access times, errors, and security events

2.3 Information from Third Parties

• Public medical council registers (to check a doctor's registration)
• Payment processors (transaction status only — we never store full card details)

3. How We Use Your Information

4. How We Share Your Information

We share your information only in the following limited circumstances:

• With your treating doctor: Relevant health information is shared with the doctor you are consulting with for the purpose of providing medical care.
• Doctor–patient messages: Messages, photos and files you exchange with your doctor in the app or on the website are confidential. Besides you and your doctor, only authorised members of the EbiHealth360 safety team can read them, and only when needed — for example to handle a complaint, a patient-safety concern or a legal request. Every such access is recorded.
• With partner hospitals: For medical tourism clients, relevant medical records are shared with your chosen hospital with your explicit consent.
• With payment processors: Payment information is processed by our secure payment partners. We receive only transaction status.
• Doctor checks: Doctors' licences and documents are checked by our own team before approval.
• With legal authorities: We may disclose information when required by law, court order, or to protect patient safety.
• With our service providers: The companies that run our hosting, email, calls and AI features process only the data they need to provide their service (listed in section 10).
• In a business transfer: If EbiHealth360 Solutions is acquired or merged, your data may be transferred with appropriate protections.

5. Data Security

• Encryption in transit: The website, app and our servers only talk over HTTPS (TLS). Video calls are encrypted by the browser/app (WebRTC).
• Encryption at rest: Your data is stored with our cloud providers — the database on Render and uploaded medical files (reports, prescriptions) in a private Cloudflare R2 bucket. Both providers encrypt stored data (AES-256).
• Private files: Medical files are never public. They open only through short-lived, signed links for the patient, their doctor and our care team.
• Access controls: Accounts have roles (patient, doctor, admin). Doctors can see records only for their own patients; doctors appear on the platform only after an admin approves them.
• Passwords and sign-in: Passwords are stored only as one-way hashes (bcrypt). Repeated wrong passwords temporarily lock sign-in, and request limits protect against automated attacks.
• Admin activity log: Actions taken by administrators (for example approving, suspending or editing accounts) are recorded.
• If something goes wrong: If a personal data breach affects you, we will tell you and India's Data Protection Board as required by the Digital Personal Data Protection Act, 2023 and its Rules, and take steps to limit the harm.
• No system is perfectly secure. We keep improving our security as we grow. If you find a security problem, please email info@ebihealth360.com.

6. Data Retention

7. Your Privacy Rights

You have the following rights regarding your personal data:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Portability: Receive your data in a machine-readable format
• Right to Restrict Processing: Request we limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing at any time
• Right to Lodge a Complaint: File a complaint with the relevant data protection authority

Deleting your account

You can delete your account at any time in the app (Settings → Delete my account; doctors: Profile → Delete my account) or at ebihealth360.com/account/delete. Deletion happens straight away: your name, email, phone number, photo, date of birth, location, password, health tracker data (vitals and medicines) and device notification tokens are removed, and upcoming bookings are cancelled. Records of past consultations, prescriptions and payments are kept without your name or contact details for the retention periods above, because the law requires it. If you never had a consultation, your account is removed completely. If you can't sign in, email info@ebihealth360.com from your account's email address and we will delete it within 7 days.

8. Cookies & Tracking

We use essential cookies required for platform functionality (authentication, security). We use analytics cookies to understand how the platform is used and improve our services. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

9. Children's Privacy

EbiHealth360 Solutions does not knowingly collect personal information from children under 18 without verifiable parental consent. If you believe a child has provided us with personal information without appropriate consent, please contact us immediately at info@ebihealth360.com and we will delete such information promptly.

10. International Data Transfers

Our servers are run by cloud providers (Render for the website and database, Cloudflare for file storage and video-call relays), whose data centres may be outside India. Other service providers process limited data only to provide their service: Resend (sending emails), Twilio (SMS/phone where used), Anthropic (AI features — the text you type into AI tools such as the symptom checker is sent to it to produce an answer) and Google (maps and website analytics, only with your consent). For medical tourism, the details needed for your treatment are shared with the partner hospital you choose in India. We share only what each provider needs and they are not allowed to use it for their own marketing.

11. AI & Automated Processing

Our platform uses AI tools including symptom analysis, appointment routing, and clinical decision support. Important safeguards:

• AI tools provide assistance to licensed doctors and do not make independent medical decisions
• All AI-assisted recommendations are reviewed by qualified healthcare professionals
• You have the right to request human review of any automated decision that affects you
• AI training uses only anonymized, aggregated data — never identifiable patient records without explicit consent

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email and a prominent notice on our platform at least 14 days before changes take effect. We encourage you to review this policy periodically.

13. Contact Our Privacy Team

© 2026 EbiHealth360 Solutions. All rights reserved. · Version 2.0