Mobile Application Privacy Policy

1. Introduction & Legal Framework

Welcome to the Mission 100 Hospital Mobile Application ("App"). This Privacy Policy is a legally binding document between you ("User," "you," or "your") and Mission100Hospital ("Company," "we," "us," or "our"), a premier healthcare provider operating in India.

We are deeply committed to protecting the privacy, confidentiality, and integrity of your Personal Data and Sensitive Personal Data (including medical and health records). This policy is designed to formally declare our data handling practices in absolute compliance with the Google Play Developer Policy, the Google Play Data Safety Requirements, the Android User Data Policy, and the Digital Personal Data Protection Act (DPDPA), 2023 (India), alongside medical regulatory frameworks governing digital healthcare and telemedicine services in India.

By downloading, installing, registering, accessing, or using our App, you explicitly acknowledge that you have read, understood, and consented to the collection, storage, processing, and disclosure of your data as outlined in this Privacy Policy. If you do not agree with any terms herein, please immediately cease using the App and uninstall it from your device.

2. Information We Collect

To deliver comprehensive digital healthcare services, the App collects two distinct categories of information: information you actively provide to us, and information collected automatically by our application ecosystem.

2.1 Data Actively Provided by the User

• Account Registration & Identity Data: Full Name, Email Address, Mobile Number, Gender, Date of Birth, and Profile Picture. Passwords are captured exclusively in hashed format using secure, industry-standard cryptographic algorithms.
• Demographics & Contact Details: Full Postal Address, City, State, Pin Code, and Emergency Contact details (including name and relationship).
• Sensitive Medical & Health Records: Detailed Medical History, historical and current symptoms, known allergies, chronic conditions, uploaded physical physician prescriptions, uploaded diagnostic and lab test reports, and details regarding specific health packages purchased.
• Consultation & Appointment Logs: Audio/visual telemedicine consultation parameters, text-based symptoms communicated via chat interfaces, preferred doctor selections, and historical logs of booking dates.
• Billing & Financial Metadata: Historical purchase logs, subscription timelines for health packages, invoice references, and specific transaction statuses passed down by our processing network.

2.2 Data Collected Automatically

• Device Telemetry: Unique Device ID (including Android Advertising ID, where appropriate under Play Store rules), hardware model, operating system architecture, Android OS version, and App build versions.
• Network & Connection Properties: Internet Service Provider (ISP) names, network type (Wi-Fi, 4G, 5G), Internet Protocol (IP) address, and localized cellular region flags.
• Diagnostics & Analytics Logs: Anonymized usage statistics, screen view durations, feature interactions, system crash logs, memory footprints during application execution, and performance latency indicators.

3. Purpose of Data Processing

We collect and process your information strictly for lawful, specific, and legitimate medical and operational purposes, as defined under Section 6 of India's DPDPA, 2023. These purposes include:

4. Android Device Permissions

In accordance with the Android User Data Policy's principle of data minimization, our App requests device permissions exclusively when required to execute specific runtime functionalities.

• CAMERA Permission (Runtime)

  Why it is requested: To allow you to take real-time photographs of your physical medical prescriptions, historical laboratory receipts, or physical symptoms to share directly with doctors during virtual telemedicine consults.

  Optionality: Completely optional. You can deny this permission and manually input medical profiles instead.

• READ_EXTERNAL_STORAGE / READ_MEDIA_IMAGES (Storage Access)

  Why it is requested: To allow you to browse and upload existing PDF documents or image files containing lab reports and clinical histories directly into your user profile.

  Optionality: Optional. Only requested when triggering the document attachment module.

• POST_NOTIFICATIONS (Android 13+)

  Why it is requested: To deliver real-time push notices regarding upcoming doctor appointments, reminders for medical sample pickups, status changes for lab processing, and security/OTP alerts.

  Optionality: Optional. Can be disabled globally within your Android system settings at any time.

• INTERNET & ACCESS_NETWORK_STATE

  Why it is requested: Core permission required to link the mobile application to our secure cloud backend API networks, fetch updated doctor schedules, and process user inquiries.

  Optionality: Mandatory for base functionality; the app cannot perform remote requests without active network mapping.

5. Third-Party Services & APIs

To guarantee optimal stability, authentication speed, and real-time processing capabilities, the App integrates industry-standard third-party Software Development Kits (SDKs) and secure Application Programming Interfaces (APIs). Every integration operates under strict legal guidelines, and each third-party tool retains independent privacy governing terms.

• Razorpay Payment Gateway: Handles financial checkout workflows securely. No critical raw credit instruments are handled by our application level.
• Firebase Authentication & Cloud Messaging (Google LLC): Facilitates highly responsive user login sessions and manages target distribution structures for informational push alerts.
• Firebase Analytics & Crashlytics: Used to track performance stability metrics, map code exceptions during software execution, and capture generalized device layout analytics.
• MongoDB Atlas: Serves as our enterprise-tier cloud data repository, offering end-to-end data encryptions and structured partitioning frameworks for your historical health assets.
• Google Play Services: Fundamental platform utilities that support baseline application rendering, security checks, and platform stability inside the Android OS ecosystem.

6. Secure Payment Processing

All financial transactions within the App are systematically isolated from standard system access layers. We partner exclusively with **Razorpay**, a payment infrastructure provider certified to the highest security standard, PCI-DSS Level 1 Compliance.

Absolute Data Shielding Guarantee: Under no circumstances does Mission 100 Hospital capture, store, log, or inspect raw credit/debit card numbers, card expiration dates, Card Verification Values (CVV), Unified Payments Interface (UPI) PIN strings, or internet banking security credentials. All input operations occur through isolated, tokens-based software containers maintained securely by Razorpay.

We retain strictly high-level tracking indicators including transaction referencing IDs, corresponding date stamps, exact billing values, and explicit success/failure notification alerts to manage refunds, process accounting ledgers, and maintain transparent purchase histories.

7. Data Security & Architecture

We employ robust administrative, operational, logical, and physical security measures to safeguard your personal health assets against unauthorized access, destruction, alterations, or accidental exposure.

• Encryption in Transit: All communications between the mobile application client layer and our target REST APIs utilize secure Hypertext Transfer Protocol Secure (HTTPS) frameworks wrapped inside Transport Layer Security (TLS 1.3) wrapping profiles.
• Data Encryption at Rest: Cloud records residing on MongoDB Atlas databases use AES-256 block-level schemas to secure raw clinical data points, file repositories, and user profiles.
• Network Firewalls & Intrusion Monitoring: Access controls utilize automated distributed denial-of-service (DDoS) shield arrays, network isolation rules, and continuous security pattern analysis.
• Strict Access Control: Internal system configurations follow the principle of least-privilege access. Only authorized medical staff involved in your care are permitted to view sensitive medical logs.

8. Data Sharing & Disclosure

Core Principle: Mission 100 Hospital does not sell, rent, monetize, or lease your Personal Data or Medical Records to any third-party marketing entities, data aggregators, or advertising agencies.

Your information is shared strictly with the following entities for designated purposes:

1. Authorized Medical Practitioners & Hospitals: Designated consultants, diagnostic specialists, and internal medical teams responsible for providing your healthcare services.
2. Partner Diagnostic Laboratories: Field agents and laboratory medical technical specialists assigned to fulfill your specific lab test bookings.
3. Legal Compliance and Law Enforcement: Government or judicial authorities if required by law, court order, or formal regulatory declarations under the Digital Personal Data Protection Act, 2023.

9. Data Retention & Deletion

We retain your personal and health records only for as long as your application account remains active, or as necessary to fulfill the primary clinical and administrative purposes outlined in this policy.

Please note that certain health metrics and prescription histories must be archived for extended periods under Indian medical regulations governing clinical data retention. Once these regulatory timelines expire, or upon a verified account erasure request, your records are deleted or permanently anonymized.

10. User Rights & DPDPA Compliance

Under the Digital Personal Data Protection Act (DPDPA), 2023 (India), you hold extensive legal entitlements over your personal data. We provide intuitive mechanisms within the application configuration dashboard to exercise these rights:

• Right to Summary Information: Review real-time lists detailing what specific personal data points are processed along with the summary logs of third-party exposures.
• Right to Correction & Update: Modify outdated elements, correct misspelled entries, or supplement missing profile parameters.
• Right to Withdraw Consent: Revoke authorization for specific features (such as push alerts or device storage permissions) at any time.
• Right to Grievance Redressal: Register complaints with our dedicated Data Protection Officer regarding any perceived data handling discrepancies.

11. Account & Data Deletion Process

To comply with the Google Play Developer Policy regarding mandatory account deletion pathways, we provide straightforward data removal options.

12. Children's Privacy

Our application services are not designed for independent use by individuals under the age of 18 (or under 13 under global child safety frameworks). We do not knowingly capture information from unverified minors. If you are a parent or legal guardian and discover your child has created an account without authorization, please contact us immediately to arrange for data erasure.

13. Cross-Border Data Transfers

Your data is stored and processed on secure cloud instances located in India. If any analytical infrastructure requires secure routing through global nodes, we implement appropriate safeguards to ensure your data receives a level of protection equivalent to that required under applicable Indian laws.

14. Changes to This Policy

We may update this App Privacy Policy periodically to adapt to changing application features, technical updates, or evolving legal frameworks. When updates occur, the updated policy will be published at this location, and the "Last Updated" timestamp will be modified accordingly. For significant changes, we will notify you through an in-app alert or via your registered email address.