Privacy policy

AVEL Wellness (“us”, “we” or “AVEL”) is the author and publisher of the internet resource avelwellness.in (“Website”) as well as the software, services and applications provided by AVEL Wellness, including online doctor search, consultation booking, video and audio consultations, Private Care, prescriptions and consultation summaries, and follow-up care (together with the Website, the “Services”). This privacy policy (“Privacy Policy”) explains how we collect, use, share, disclose and protect personal data about the users of the Services, including patients (“Patients”), healthcare professionals (“Healthcare Professionals”) and visitors to the Website (jointly and severally referred to as “you” or “Users” in this Privacy Policy). We created this Privacy Policy to demonstrate our commitment to the protection of your privacy and your personal data. Your use of and access to the Services is subject to this Privacy Policy and our Terms & Conditions. Any capitalised term used but not defined in this Privacy Policy has the meaning given to it in our Terms & Conditions. BY CREATING AN ACCOUNT, BOOKING A CONSULTATION OR OTHERWISE GIVING US YOUR PERSONAL DATA, YOU CONFIRM THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. WHERE THE LAW REQUIRES YOUR CONSENT, WE WILL ASK FOR IT SEPARATELY AND CLEARLY, FOR EACH PURPOSE. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES. IF YOU USE THE SERVICES ON BEHALF OF SOMEONE ELSE (SUCH AS YOUR CHILD OR A DEPENDANT), YOU CONFIRM THAT YOU ARE AUTHORISED TO DO SO AND TO GIVE CONSENT ON THEIR BEHALF.

• We collect only the information needed to run your account, bookings, payments and care.
• Before every booking you choose between a Normal Consultation and Private Care. A Normal Consultation shares your full profile with the doctor. Private Care shares only a reference code, your email, your age and what you write about your symptoms.
• Private Care is an educational and guidance session only. The doctor explains your condition to you. No prescription is issued and no medicine or drug is prescribed.
• Private Care limits what the doctor sees. It does not make the consultation anonymous. AVEL still holds your account, payment and security records.
• We do not sell your personal data and we do not use your health information for advertising.
• You have the right to access, correct or erase your data, withdraw consent and raise a grievance (Section 12).
• AVEL is not for emergencies. If you may be in danger, call 112 or go to the nearest hospital.

• 1.1 This Privacy Policy is published in compliance with, inter alia:

• the Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”);
• Section 43A of the Information Technology Act, 2000;
• Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”); and
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

• 1.2 This Privacy Policy states the following:

• the types of personal data we collect from Users, including health-related data;
• the purpose, means and modes of collection, use, processing, retention and destruction of that data;
• how and to whom we disclose that data; and
• your rights and how to exercise them.

• 2.1 In this Privacy Policy:

• “Personal Data” means any data about an individual who is identifiable by or in relation to that data.
• “Health Data” means Personal Data about your physical, physiological or mental health, including symptoms, medical history, prescriptions and consultation summaries. We treat Health Data with the highest level of care, whether or not the law classes it as sensitive.
• “Normal Consultation” means a consultation in which the doctor can see your full profile, as described in Section 4, and in which the doctor may provide a prescription where appropriate.
• “Private Care” means an educational and guidance consultation, held by call or chat, in which the doctor receives only the limited information described in Section 4 and does not provide a prescription or prescribe any medicine or drug.
• “Data Fiduciary” means the person who decides the purpose and means of processing. For the data described here, that is AVEL.
• “Data Principal” means the individual to whom the Personal Data relates. That is you, or your parent or lawful guardian if you are a child.
• “Data Processor” means a third party that processes Personal Data on our behalf and on our instructions.
• “Board” means the Data Protection Board of India.

• 3.1 Some of the Services require us to know who you are so that we can best meet your needs. When you use the Services, or contact us by email, phone or support request, we may ask you to voluntarily provide certain information. The information we collect may include (but is not limited to) the following:

• account data: your email address and sign-in details, and your language preference (English or Hindi);
• profile data: your name, photo, phone number, age, gender and emergency contact details, where you choose to provide them;
• booking data: the doctor and speciality you choose, the consultation type (Normal or Private Care), the date and time, and the concern you describe;
• Health Data: the symptoms and context you write, messages you send during a consultation, any documents you choose to share, and the information your doctor records;
• care outcome data: prescriptions (in Normal Consultations only), consultation summaries and follow-up information published to your account;
• payment data: the consultation fee, payment status, transaction reference and billing details;
• support data: messages and attachments you send when you raise a support request; and
• consultation history: which doctors you booked and when.

• 3.2 We also collect some data automatically when you use the Services:

• technical data such as your IP address, device and browser type, operating system, language settings and pages visited;
• security records such as sign-in events, session data and logs of who accessed which information; and
• consultation room data such as connection status and quality, which is needed to run video and audio consultations.

• 3.3 We do not record the audio or video of your consultations.
• 3.4 We do not knowingly collect government ID numbers, biometric data or your precise location. If a feature later needs any of these, we will ask for your separate consent first.
• 3.5 All the information you provide to us is voluntary. However, some information is necessary for particular Services. For example, we cannot book a consultation without a time slot, a payment and enough information for the doctor to help you safely. If you choose not to provide necessary information, we may not be able to offer that Service.
• 3.6 You are responsible for keeping the information in your account accurate. You can ask us to correct your details by raising a support request from your account.

• 4.1 Before every booking, you choose the consultation type. Your choice applies to that consultation only, and you can choose differently next time.
• 4.2 In a Normal Consultation, your doctor can see:

• your full name, photo and profile;
• your age and gender;
• any other profile information you have provided, such as your phone number and emergency contact details;
• your consultation history; and
• the symptoms and context you write, and the messages you send during the consultation.

• 4.3 In a Private Care consultation, which is an educational and guidance session only, your doctor can see only:

• a consultation reference code;
• your email address and your age;
• the symptoms and context you write yourself; and
• the messages you send during the consultation.

• 4.4 In a Private Care consultation, your doctor cannot see your name, photo, phone number, profile, emergency contact details, other consultations or history, or anything else in your account.
• 4.5 What Private Care is. Private Care is an educational and guidance session, held by call or chat. The doctor explains the condition you are suffering from, answers your questions and helps you understand it. In Private Care:

• no prescription is issued;
• no medicine or drug is prescribed; and
• the doctor does not order any treatment. If you need a diagnosis, a prescription or treatment, please book a Normal Consultation or see a doctor in person.

• 4.6 How the privacy separation is enforced. The separation is built into the Platform’s database access rules. For a Private Care consultation, the doctor’s account is not permitted to read the rest of your identity. It is not merely hidden in the screen design.
• 4.7 What Private Care does not do. Please read this carefully:

• Private Care does not make the consultation anonymous. Your doctor still sees your email address, which may itself identify you.
• AVEL still holds your account, payment, consultation and security records. We need them to run a safe service, handle disputes, meet legal obligations and protect you if something goes wrong.
• Anything you type in your symptoms or messages is visible to the doctor. If you include your name or phone number there, the doctor will see it, so we recommend you do not.
• Because the doctor does not see your history, they may not know about earlier conditions, medicines or allergies unless you tell them. This can affect the guidance you receive, so please share what is medically relevant.
• Private Care does not include a prescription or any medicine. It is not a replacement for a Normal Consultation or for in-person care.
• In rare cases, safety or the law may require us to disclose more (see Sections 8 and 18).

• 4.8 A Normal Consultation is better for continuity of care, prescriptions and follow-ups. Private Care is better when privacy matters more and you want to understand your condition.

• 5.1 We use your Personal Data only for the following purposes:

• providing the Services: creating and securing your account, showing doctors and available slots, booking and confirming appointments, running consultation rooms, and delivering prescriptions (in Normal Consultations) and summaries;
• processing payments and issuing receipts;
• sending you service messages about your bookings, such as confirmations, reminders, changes, links to join and follow-up information;
• verifying the credentials of Healthcare Professionals before they are listed;
• keeping the Services safe: detecting fraud, abuse and unauthorised access, and keeping audit logs;
• responding to support requests and grievances;
• improving the Services, using usage data and error logs, in aggregated or de-identified form wherever possible;
• complying with legal obligations, including maintaining medical, tax and accounting records and responding to lawful requests; and
• sending optional updates or marketing, only if you opt in separately.

• 5.2 We will not:

• sell your Personal Data or Health Data;
• use your Health Data to profile you for advertising;
• use your Health Data to make decisions about insurance or employment; or
• use your Personal Data for a new purpose without telling you and, where the law requires, asking for your fresh consent.

• 6.1 Where the law requires your consent, we will ask for it in clear and plain language, in English or Hindi, and separately for each purpose. At a minimum, you will see separate choices for (a) creating your account and processing your Health Data to deliver care, (b) optional updates and marketing, and (c) any optional analytics that goes beyond what is strictly necessary.
• 6.2 You can withdraw your consent at any time by writing to us through the Support section (Section 20). Withdrawing consent is as easy as giving it. Withdrawal does not affect processing already done. If you withdraw consent that is essential for a Service, such as the Health Data needed for an upcoming consultation, we may not be able to provide that Service.
• 6.3 Marketing is off by default. We will not send promotional messages unless you opt in, and every such message will include a way to opt out. Booking, safety and legal messages will continue, because they are part of the Service.
• 6.4 The law allows processing without consent in limited situations, such as responding to a medical emergency involving a threat to life, complying with a court order, or meeting a legal obligation. We will use this only where the law permits.

• 7.1 You can see your full account, bookings, prescriptions and summaries.
• 7.2 Your doctor can see only the information described in Section 4, and only for the consultations assigned to that doctor. A doctor cannot browse other Patients on the Platform.
• 7.3 AVEL staff can access only what their role requires, and their access to Health Data is logged. All AVEL employees and Data Processors who handle Personal Data are bound by confidentiality obligations.
• 7.4 Healthcare Professionals are independent professionals. They are responsible for their own clinical decisions and for their professional duty of confidentiality. Once a doctor holds information to treat or guide you, they must handle it in line with medical ethics and applicable law.

• 8.1 We do not sell your Personal Data. We share it only in the situations below.
• 8.2 Service providers (Data Processors). We use companies that help us run the Services, such as cloud hosting, payment processing, video and audio consultation infrastructure, email and SMS delivery, error monitoring and customer support tools. They may process your data only on our written instructions and must protect it. Our payment partner is Razorpay. We will keep the list of our other providers up to date and provide it on request.
• 8.3 Payment providers. Our payment gateway, Razorpay, handles your payment details directly. We receive only the payment status and transaction reference, not your full card or bank details.
• 8.4 Legal and safety reasons. We may disclose Personal Data where required by law, court order or a lawful request from a government authority, or where necessary to prevent a serious and imminent threat to someone’s life or health. We will share only what is required and, where the law allows, we will tell you.
• 8.5 Business changes. If AVEL merges, is acquired or sells its business, your data may be transferred to the new owner, who must honour this Privacy Policy. We will notify you before your data becomes subject to a materially different policy.
• 8.6 At your instruction. For example, when you ask us to send a prescription or summary to a person you name.
• 8.7 Aggregated or de-identified statistics that cannot reasonably identify you may be used internally or published, for example usage trends. We will not try to re-identify such data.

• 9.1 After a Normal Consultation, your doctor may publish a prescription or a consultation summary to your account. You can view these at any time, and you can book a follow-up with the same doctor whenever you wish.
• 9.2 Private Care is an educational and guidance session, so no prescription is issued and no medicine or drug is prescribed in a Private Care consultation. Where a doctor shares a written note after a Private Care session, it contains educational information only. The doctor does not receive your name or contact details. If you need a prescription, please book a Normal Consultation.

• 10.1 We keep Personal Data only for as long as needed for the purpose it was collected. Our current approach is to delete or irreversibly de-identify your Personal Data within about 30 days after your account is closed or the purpose for which it was collected has ended.
• 10.2 We may keep some records for longer where the law requires it, for example medical, tax and accounting records, or while a dispute or legal proceeding is pending. We may change our retention periods as our Services develop, and we will tell you about changes as described in Section 19.

• 11.1 We use reasonable technical and organisational safeguards to protect your data from unauthorised access, improper use or disclosure, unauthorised modification, and unlawful destruction or accidental loss. These include:

• encryption of your data;
• database-level access rules that restrict each user to only the data they are permitted to see, which is also what enforces Private Care;
• role-based access for staff, with logging of access to Health Data;
• secure, private consultation rooms for video and audio sessions;
• credential review of Healthcare Professionals before listing; and
• ongoing review of our security measures.

• 11.2 Please keep your sign-in details private, sign out on shared devices, and join consultations from a private place. If you suspect unauthorised use of your account, tell us immediately through the Support section.
• 11.3 No online service is perfectly secure. We take responsibility for the safeguards we control. We are not responsible for loss caused by events outside our reasonable control, such as unauthorised access to your own device, or actions of third parties that we could not reasonably have prevented.
• 11.4 If a personal data breach affects you, we will notify you and the Board as the law requires. Our notice will describe what happened, what data was involved, what we are doing about it and what you can do to protect yourself.

• 12.1 Under the DPDP Act you have the following rights:

• right to access: to get a summary of the Personal Data we hold about you, what we do with it and who we have shared it with;
• right to correction and completion: to fix inaccurate or incomplete data;
• right to erasure: to ask us to delete your Personal Data. We will do so unless we must keep it for a legal reason, and we will tell you what we kept and why;
• right to withdraw consent: at any time, as described in Section 6;
• right of grievance redressal: to complain to us first (Section 20);
• right to nominate: to name a person who can exercise your rights if you die or become incapable; and
• right to escalate: if you are not satisfied with our response, you may complain to the Board.

• 12.2 How to exercise your rights. Raise a support request from your account or contact us through the Support section (Section 20). We may need to verify your identity first. We will respond within the time the law allows.
• 12.3 There may be circumstances where we cannot correct or delete data, for example where it is part of a medical record we are legally required to keep, or where it is needed for a pending legal proceeding. We will explain this to you.

• 13.1 The Services are intended for adults. A person under 18 may use AVEL only through a parent or lawful guardian, who must create the account or give verifiable consent and who is responsible for the information provided.
• 13.2 We do not track or monitor the behaviour of children and we do not direct advertising at them.
• 13.3 Because Private Care shows the doctor an age, doctors can apply appropriate safeguards where the Patient is a minor.
• 13.4 If you believe a child’s data has been provided without proper consent, please contact us and we will act promptly.

• 14.1 We store Personal Data on secure servers provided by our cloud hosting service provider.
• 14.2 If any Data Processor handles data outside India, we will do so only where the law allows and with contractual protections no weaker than this Privacy Policy. We will list the countries involved on request.

• 15.1 If you sign in as a doctor or other Healthcare Professional, we also collect and use:

• professional details: your name, speciality, qualifications, registration number and credentials, which we review before you are listed;
• public profile details shown to Patients when they search for a doctor;
• availability: the calendar slots you offer;
• activity data: consultations delivered, messages in consultations, and prescriptions and summaries published, along with access logs; and
• payout and tax details, if the Platform pays you.

• 15.2 You must use Patient information only for the consultation it was shared for, keep it confidential, and not try to identify Patients who chose Private Care. In Private Care you must provide education and guidance only and must not issue a prescription or prescribe any medicine. Any attempt to bypass the Private Care protections may lead to removal from the Platform and legal action.
• 15.3 You have the same rights over your own data as described in Section 12.

• 16.1 At present we use only essential cookies and similar technologies. They keep you signed in, protect your account and remember your language choice. These cannot be switched off while you use the Services.
• 16.2 We do not currently use advertising, analytics or other tracking cookies, and we do not share data with advertising networks. If this changes, we will update this Privacy Policy and ask for your consent where the law requires.
• 16.3 You can manage cookies in your browser settings. If you block essential cookies, parts of the Services may stop working.

• 17.1 The Website may link to other websites, such as government health information or emergency resources. AVEL does not control these sites and is not responsible for their privacy practices. We encourage you to read their privacy policies before using them.

• 18.1 AVEL supports scheduled online consultations. It does not replace emergency medical care. The Emergency page offers guidance only. If you or someone else may be in danger, call 112 or go to the nearest hospital immediately. Do not wait for an appointment slot.
• 18.2 If you tell a doctor or our team about a serious and immediate risk to life, we may share the necessary information with emergency services or with a person who can help, even if you chose Private Care.

• 19.1 We may update this Privacy Policy when our Services, technology or the law change. We will post the updated version on the Website with a new “last updated” date.
• 19.2 If a change materially affects how we use your Health Data, we will notify you by email or in your account before it takes effect, and we will ask for fresh consent where the law requires. Earlier versions are available on request.

• 20.1 If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your Personal Data, please contact us through the Support section of your account or at avelwellness.in/support.
• 20.2 We will acknowledge your complaint promptly and aim to resolve it within the time the law allows. If you are not satisfied, you may approach the Data Protection Board of India.

Indicative list of information by nature of service

• 1. Visitors using the Website without an account. We may collect technical data such as your IP address, device and browser type, language and pages visited, and essential cookies. We do not collect Health Data from visitors who are only browsing.
• 2. Patients creating an account. You provide your email address and complete your profile (for example name, phone number, age, gender and emergency contact). This lets you book appointments, store your bookings and access prescriptions and summaries.
• 3. Patients booking a Normal Consultation. In addition to your account details, you provide the doctor, date and time, payment, and the symptoms and context you describe. The doctor can see your full profile, as described in Section 4.2.
• 4. Patients booking a Private Care consultation. You provide the doctor, date and time, payment, and the symptoms and context you describe. The doctor receives only a consultation reference code, your email address, your age, your symptoms and your messages, as described in Section 4.3. Private Care is an educational and guidance session, and no prescription is issued. AVEL continues to hold your account, payment and security records.
• 5. Patients attending a consultation. You join a private consultation room by video or audio (or, for Private Care, by call or chat) and may message your doctor from the appointment page. After a Normal Consultation, your doctor may publish a prescription or consultation summary to your account, and you can book follow-ups.
• 6. Patients contacting Support. You provide your contact details, the issue and any attachments you choose to send.
• 7. Healthcare Professionals. You provide your name, speciality, qualifications, registration details and credentials for review, your public profile details and your availability. We also record the consultations you deliver and the prescriptions and summaries you publish.