Who we are

The registered operating entity and address for MedKhata are being finalised and will appear here shortly.

What we collect

Your account details: name, email address, username and a hashed password. For each family member you add (the product calls them a “member”): name, date of birth or age, gender, blood group, allergies, conditions, medicines and dose logs, vitals, vaccines, any documents you upload, and emergency contacts you enter for them.

We also keep basic technical data — sign-in sessions, and request logs used to keep the service secure and prevent abuse.

Why we collect it

To store and show your family’s health records to you and to anyone you choose to share them with, to send account emails (verification, password reset, sharing invitations), and to run the optional daily coin rewards.

Legal basis and consent

Health data is “sensitive personal data” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). We process it on the basis of your consent.

When you add a family member, adding them is itself your confirmation that you are authorised to keep and manage their records — there is no separate signed consent form for that step. For sharing a member’s records with a doctor, or creating an emergency or helper link, you take a separate, explicit action each time, and you can revoke that access at any point.

Sharing

We do not sell your data. It can leave your account only in these ways:

• Doctors. A doctor sees only what you approve, for a period you set when you invite them (up to seven days per invitation; you can send a new one or revoke access early). MedKhata does not verify a doctor’s registration number — see the medical disclaimer in our Terms of Use before relying on a shared record.
• Emergency link. An unlisted web link showing a minimal emergency card (name, photo, blood group, allergies, conditions, current medicines, emergency contacts). Anyone who has the link can view it. It does not expire on a timer — it stays live until you turn it off from the member’s emergency page.
• Helper links. A similar unlisted link that lets someone you trust (an attendant, a neighbour) mark today’s doses as taken for one member. You choose how long it stays active (up to 180 days) or revoke it any time.
• Service providers. We use third parties to run MedKhata — hosting and storage for your account and documents, and Brevo to send account emails. They process data only on our instructions, to provide the service to you.

Storage and security

Records are private by default — only you and the people you explicitly invite can see a member’s records. Passwords are stored hashed, sign-in sessions use hardened cookies, and document access is logged.

Retention and deletion

We keep your records for as long as your account is active. Deactivating your account from Settings signs you out everywhere immediately but does not delete anything — your family’s members, records and documents stay as they are, and signing back in within 30 days restores the account.

To have your data permanently deleted, write to the Grievance Officer below. Deletion requests are handled manually; MedKhata does not yet auto-purge data on any schedule.

Your rights

Under the DPDP Act, 2023, you can ask to access, correct or delete the personal data we hold about you or a member you manage, and you can withdraw consent, by writing to the Grievance Officer below. If you’re not satisfied with our response, you may also complain to the Data Protection Board of India through the process it prescribes.

Grievance Officer

Grievance Officer contact details are being finalised and will appear here shortly.

Children

MedKhata is meant for adults managing their own health records or a family member’s records on that family member’s or their own behalf. We don’t independently verify the age of account holders.

Changes to this policy

This is a draft policy that we will keep revising as MedKhata changes. We’ll update the date at the top of this page whenever we do.