HEALTH SETU | Accredited Diagnostic Testing & Home Collection (India)

1. Platform Nature & Scope

HealthSetu (operated by HealthSetu India Technologies Private Limited) operates as a digital healthcare aggregator and technology facilitator under Section 79 of the Information Technology Act, 2000. This Privacy Policy governs the collection, storage, processing, and disclosure of personal data and Sensitive Personal Data or Information (SPDI), including diagnostic records, blood test results, biomarker data, and doctor prescriptions.

2. Data We Collect

We collect only the minimum necessary information required to facilitate home phlebotomy and accredited diagnostic laboratory processing:

Identity & Demographics: Full Name, Age, Gender, Mobile Number, Email Address, and Family Member relationships.
Collection Logistics Data: Doorstep pickup address, Landmark, City, State, and 6-digit postal PIN code.
Sensitive Clinical Health Data: Doctor's prescription slips (uploaded images/PDFs), prescribed test names, diagnostic biomarkers (e.g. HbA1c, Lipid fractions, CBC counts), and pathologist-verified signed diagnostic reports.
Billing & Transaction Data: Total payment amounts, transaction IDs, payment method tokens (processed securely via PCI-DSS Level 1 Razorpay gateway; HealthSetu never stores raw credit/debit card numbers or UPI PINs).

3. Purpose of Processing (Lawful Grounds)

Under the DPDP Act 2023, data is processed strictly with explicit user consent for:

Doorstep Phlebotomy Dispatch:Routing certified phlebotomists to your GPS/PIN location with barcode-sealed bio-specimen tubes.

NABL Partner Lab Intake:Transmitting accessioning barcodes and patient age/gender to partner laboratories for accurate reference ranges.

Smart Report Delivery:Generating bilingual (Hindi/English) 3-zone visual risk dials and delivering tamper-evident signed PDF reports.

Doctor Teleconsultation:Sharing report parameters with consulting MD Physicians for post-diagnostic explanation.

4. Technical & Organizational Security Measures

We implement stringent healthcare-grade cybersecurity controls:

Cryptographic Encryption: All diagnostic reports and data are encrypted in transit via TLS 1.3 and at rest via AES-256.

Short-Lived Presigned Access: Medical report PDF download URLs expire automatically within 15 minutes (900 seconds) to prevent unauthorized sharing.

Zero Third-Party Advertising Sale: HealthSetu strictly does NOT sell, rent, or trade your personal or clinical medical records to insurance brokers, pharmaceutical advertisers, or data syndicators.

5. Retention & Data Erasure (Right to be Forgotten)

In compliance with Clinical Establishments rules and National Medical Commission guidelines, diagnostic test reports are retained securely for a period of up to 7 years to facilitate historical medical tracking. Patients may exercise their right to access, correct, or request deletion of their account profile and contact details by emailing our Grievance Officer.

6. Grievance Redressal Officer (IT Rules & DPDP Act)

In accordance with Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 12 of the DPDP Act 2023, the details of the designated Grievance Officer are:

Name: Rohit Manglam

Designation: Grievance Officer (IT Intermediary Rules)

Email: grievance@healthsetu.scalecraftind.in

Office Address: Connaught Place, Central Delhi, New Delhi 110001, India