FitScript takes your privacy seriously. We never sell your personal or medical data. This policy explains what we collect, why, and how we protect it.
DPDP Act 2023 — Your Role and Ours
FitScript Health Technologies Pvt. Ltd. is the Data Fiduciary under the Digital Personal Data Protection Act 2023 — meaning we determine the purpose and means of processing your personal data. You are the Data Principal — meaning you retain rights over your personal data at all times. This policy explains how we fulfil our obligations as your Data Fiduciary.
1. Information We Collect
We collect the following categories of information:
Identity data: Name, date of birth, gender
Contact data: Phone number, delivery address
Health data: Medical history, current medications, weight, height, health conditions disclosed during intake
Consultation data: Notes from your doctor consultation, prescription details
Payment data: Transaction reference numbers (we do not store card numbers or UPI credentials)
Usage data: How you interact with our website (pages visited, time spent)
2. How We Use Your Information
Your information is used to:
Connect you with an NMC-registered doctor for your consultation
Enable your doctor to prescribe appropriate treatment
Fulfil and deliver your prescription medication
Send you appointment reminders and follow-up communications
Improve our services and clinical outcomes
Comply with applicable laws and regulatory requirements
3. Who We Share Your Data With
We share your data only with:
Your assigned doctor: For the purpose of clinical assessment and prescription
Licensed pharmacies: To fulfil your prescription order
Delivery partners: Name and address only, for medication delivery
Payment processors: Transaction data only, under strict data agreements
We never sell your data to advertisers, data brokers, or third parties for marketing purposes.
4. Health Data Protection
Your medical information is treated as sensitive personal data under the Digital Personal Data Protection Act, 2023. It is stored encrypted, accessible only to your assigned doctor and authorised FitScript clinical staff, and is never used for advertising or profiling.
5. Data Retention
We retain your medical records for a minimum of 7 years as required by the Telemedicine Practice Guidelines 2020. You may request deletion of non-medical personal data at any time by contacting us.
6. Your Rights as a Data Principal
Under the Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal. To exercise any of these rights, contact our Data Protection Officer at dpo@fitscript.in. We will respond within 7 working days.
Right to access: You may request a summary of the personal data FitScript holds about you and the purposes for which it is being processed.
Right to correction: You may request correction of inaccurate or incomplete personal data we hold about you. Corrections will be made within 7 working days of a verified request.
Right to erasure: You may request deletion of your personal data. Requests will be processed within 30 days, subject to FitScript's legal obligation to retain health records for a minimum of 7 years under NMC Telemedicine Practice Guidelines 2020.
Right to withdraw consent: You may withdraw consent for non-essential data processing at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right to nominate: You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, by writing to dpo@fitscript.in.
Right to grievance: You may raise a complaint with FitScript's Grievance Officer at hello@fitscript.in. We will acknowledge within 24 hours and resolve within 7 working days.
Right to escalate: If you are unsatisfied with FitScript's response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDP Act 2023.
7. Cookies
We use essential cookies for session management and analytics cookies to understand how our website is used. We do not use advertising or tracking cookies. You can disable cookies in your browser settings.
8. Security
We use 256-bit SSL encryption for all data transmission, encrypted databases for health records, and strict access controls. We conduct regular security audits and penetration testing.
9. Data Storage and Cross-Border Transfers
Your personal and health data is stored on servers located in India (AWS Mumbai region — ap-south-1), ensuring Indian data residency in alignment with the spirit of the Digital Personal Data Protection Act 2023.
Where data is processed by third-party service providers (such as payment processors, WhatsApp communication platforms, and cloud infrastructure providers), we ensure each provider maintains data protection standards consistent with the DPDP Act 2023 through written Data Processing Agreements. A current list of our third-party data processors is available on request at dpo@fitscript.in.
We do not transfer your health data to any country that has been restricted by the Central Government under the DPDP Act 2023.