Privacy Policy

This Privacy Policy explains how Onen Health (“Onen Health,” “we,” “us,” or “our”) collects, uses, stores, shares, transfers, and protects personal data when you access or use our website, applications, teleconsultation services, counselling or support services, care coordination services, and related offerings (collectively, the “Services”).

By accessing or using the Services, or by submitting information through our booking, intake, consultation, messaging, or support flows, you acknowledge that your personal data may be processed as described in this Privacy Policy and in accordance with applicable law.

1. Scope

This Privacy Policy applies to personal data we collect:

when you visit or use our website or app;
when you register, submit forms, book appointments, or communicate with us;
when you participate in teleconsultations, calls, follow-up communications, or programme-related interactions;
when you upload documents, prescriptions, reports, assessments, or other records;
when healthcare professionals, laboratories, pharmacies, or authorised service partners involved in your care or service delivery share information with us, where permitted by law.

2. About Our Services

Onen Health is a telehealth and care-coordination platform. Depending on the service you use, we may connect you with registered medical practitioners, psychologists, counsellors, coordinators, laboratories, pharmacies, and other authorised service providers.

Because of the nature of our Services, we may process personal information as well as health-related and other sensitive personal data or information that you provide to us, that is shared during teleconsultations or follow-up calls, or that is generated or documented during the course of service delivery.

3. Information We Collect

3.1 Information you provide directly

We may collect information such as your name, mobile number, email address, age or date of birth, gender, city, state, account credentials, responses to forms or assessments, and communications you send to us.

3.2 Health and care-related information

Depending on the Services you use, we may collect or document health-related and other sensitive information, including symptoms, medical history, alcohol-use or recovery-related information, behavioural or mental health information where relevant to the service, treatment history, medication details, allergies, adverse reactions, laboratory reports, scans, prescriptions, consultation notes, follow-up records, care plans, counselling or programme-progress information, and other clinically relevant information.

3.3 Teleconsultation and call information

A significant portion of health-related or sensitive information may be shared by you during teleconsultations, calls, follow-up calls, or care-coordination communications. Where clinically or operationally necessary, we may document information you share during such interactions in our internal systems for continuity of care, quality review, safety, programme delivery, support, and recordkeeping.

3.4 Consultation, coordination, and support information

We may collect appointment details, care coordination notes, support records, service history, referral information, follow-up actions, and communications with our doctors, psychologists, counsellors, coordinators, and support personnel.

3.5 Payment and transaction information

If you make payments through our Services, we may collect or receive billing-related information, payment status, transaction identifiers, and limited payment information made available to us by our payment partners. We do not intentionally store full card details except through compliant payment flows handled by authorised payment service providers.

3.6 Device, technical, and usage information

When you use our Services, we may automatically collect technical and usage information such as IP address, browser type, device identifiers, operating system, timestamps, crash data, app and website activity logs, approximate location inferred from IP, and cookie or similar technology data.

3.7 Analytics and product diagnostics information

We may use analytics, diagnostics, and session or interaction monitoring tools to understand how users interact with our platform, troubleshoot issues, improve performance, improve user experience, and strengthen service quality and reliability.

4. How We Collect Information

We collect information:

directly from you when you submit it through forms, intake flows, teleconsultations, calls, chats, uploads, or support interactions;
automatically through cookies, logs, analytics tools, and similar technologies when you use our Services;
from healthcare professionals, laboratories, pharmacies, coordinators, and authorised service providers involved in your care or service delivery;
from payment, communication, infrastructure, analytics, and security partners used to operate the Services.

5. How We Use Information

We may use your information for the following purposes:

5.1 To provide the Services

This includes creating and managing your account, booking and conducting consultations, coordinating care, allowing authorised professionals to review relevant records, generating prescriptions or care plans where applicable, facilitating follow-ups, and supporting programme delivery.

5.2 To operate and improve the platform

This includes maintaining the website and app, fixing bugs, improving workflows and functionality, analysing usage, improving reliability, and enhancing user experience.

5.3 For care quality, safety, and governance

This includes continuity of care, service quality review, internal audit, complaint handling, incident review, fraud prevention, abuse prevention, misuse detection, and platform security.

5.4 For legal, regulatory, and recordkeeping purposes

This includes maintaining records, complying with lawful requests and applicable legal obligations, responding to disputes or complaints, enforcing our terms and policies, and handling investigations or regulatory requirements.

5.5 For communication

This includes appointment reminders, service updates, account or billing communications, responses to queries, support messages, and other essential service communications.

5.6 For research, analytics, and AI or machine learning

We may use personal data and, where feasible, de-identified, anonymised, or aggregated data to develop, test, validate, improve, and monitor internal analytics systems, care-support tools, operational systems, and AI or machine learning systems connected with our Services, subject to applicable law, internal controls, and appropriate safeguards. AI-assisted tools used by us are intended to support service delivery and internal operations and are not intended to automatically replace qualified professional judgment where such judgment is required.

Where we collect Sensitive Personal Data or Information, including health and medical information, we obtain your consent by appropriate written or electronic means before or at the time of collection, in accordance with applicable law. This may include consent through digital forms, account flows, checkboxes, email, SMS, WhatsApp, or other electronic communications used in connection with the Services.

Where you share such information during a teleconsultation, call, or follow-up communication, such collection will be treated as occurring pursuant to the consent already provided through the relevant booking, intake, onboarding, consent, or consultation flow, or through other appropriate written or electronic means.

If you choose not to provide certain information that is necessary for a particular service, we may be unable to provide that service fully or at all.

7. Disclosure of Sensitive Personal Data or Information

We do not disclose your Sensitive Personal Data or Information to third parties without your prior permission, unless:

such disclosure is agreed in a contract with you;
such disclosure is necessary to provide the Services you requested through authorised professionals, laboratories, pharmacies, payment partners, infrastructure providers, or other service providers acting on our behalf;
such disclosure is necessary to comply with a legal obligation; or
disclosure is made to government agencies or authorities that are lawfully authorised to seek such information for purposes permitted by law, subject to applicable legal requirements.

Any third party receiving Sensitive Personal Data or Information from us shall use it only for the purpose for which it was disclosed and shall not disclose it further except as permitted by law.

We do not sell your personal data as part of a standalone data brokerage business.

On a need-to-know basis and subject to applicable law, we may share information with:

authorised internal personnel involved in service delivery, support, security, quality review, audit, or administration;
registered medical practitioners, psychologists, counsellors, and other authorised professionals involved in your care or programme delivery;
laboratories, pharmacies, referral partners, and fulfilment partners involved in the Services you request;
service providers who help us operate the Services, such as cloud hosting, storage, communications, analytics, payment processing, customer support, diagnostics, and security vendors;
legal, regulatory, governmental, or law-enforcement authorities where required or permitted by law;
parties involved in a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

9. Transfer of Information, Including Outside India

We may transfer personal information, including Sensitive Personal Data or Information, to service providers or partners in India or outside India only where such recipient ensures the same level of data protection that we maintain under applicable law, and only where such transfer is necessary for the performance of a lawful contract with you or where you have consented to such transfer.

10. Cookies, Analytics, and Similar Technologies

We and our service providers may use cookies, SDKs, pixels, local storage, logs, and similar technologies to keep you signed in, remember preferences, understand user behaviour, improve platform functionality, monitor performance, detect bugs or abuse, and enhance security and user experience.

You may be able to manage certain tracking preferences through your browser or device settings, though disabling some technologies may affect functionality.

11. Data Retention

We retain personal information and Sensitive Personal Data or Information only for as long as required for the purposes for which it was collected or as required under applicable law. When the information is no longer required for lawful purposes, we may delete, anonymise, or securely archive it in accordance with our retention practices and legal obligations.

12. Reasonable Security Practices and Procedures

We maintain reasonable security practices and procedures designed to protect personal information and Sensitive Personal Data or Information from unauthorised access, use, disclosure, alteration, or destruction. Our security measures may include managerial, technical, operational, and physical safeguards, such as access controls, authentication measures, encryption in transit and where appropriate at rest, audit logging, backup controls, vendor due diligence, and internal security policies.

We seek to maintain a documented information security programme proportionate to the nature of the information and our business operations. However, no system of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Access, Review, Correction, and User Choices

Subject to applicable law and reasonable verification, you may request correction or amendment of personal information or Sensitive Personal Data or Information you have provided to us where such information is inaccurate or deficient. We may require verification before acting on such requests and may retain information where required by law.

You may also choose not to provide certain personal information or Sensitive Personal Data or Information prior to collection. You may withdraw consent previously given to us by written or electronic request, subject to applicable law and operational requirements. If you do not provide required information, or if you withdraw consent for information necessary to provide the Services, we may be unable to provide some or all of the Services to you.

We do not provide unrestricted access to our internal systems, internal clinical notes, internal assessments, proprietary care workflows, internal operational logic, internal quality-review materials, audit trails, security information, or other internal records, except to the extent required by applicable law. We also do not currently offer a self-serve portal or automatic export facility for all underlying records associated with our internal workflows.

14. Disclosure to Government Authorities

We may disclose personal information or Sensitive Personal Data or Information to government agencies or other authorised authorities where required by applicable law, including pursuant to lawful written requests, investigations, regulatory obligations, cyber-incident responses, or other legally permitted processes. We will do so only to the extent legally required or permitted.

15. Children’s Privacy

Our Services are generally intended for adults unless a service is lawfully used through a parent, guardian, or authorised representative. We do not knowingly permit unlawful collection of children’s personal data. If you believe that information relating to a child has been provided to us improperly, please contact us so that we can review and take appropriate action.

16. Marketing and Service Communications

We may send essential service-related communications, including appointment reminders, support messages, billing messages, safety messages, teleconsultation callbacks, care-coordination calls, follow-up calls, and other account or service notifications.

Subject to applicable law and telecom regulations, your registration on a Do Not Disturb (DND) or National Customer Preference Register (NCPR) list may not prevent us from sending or placing certain non-promotional service-related or transactional communications connected with your existing relationship with us, including appointment scheduling or rescheduling, teleconsultation callbacks, care coordination, safety follow-ups, payment confirmations, account security, or other essential service updates. We will not rely on any such exception to send promotional calls or messages where consent or another lawful basis is required.

Where permitted by law, we may also send promotional, educational, or informational communications. You may opt out of non-essential promotional communications using the unsubscribe mechanism provided or by contacting us. Opting out of promotional communications will not affect essential service-related communications.

17. Third-Party Services and Links

Our Services may contain links to third-party websites, payment pages, laboratory services, pharmacy services, or other platforms. Their privacy practices are governed by their own terms and policies, except where they act as processors or service providers on our behalf.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or service offerings. If we make material changes, we may revise the “Last updated” date and take other steps where appropriate to notify users.

19. Contact and Grievance Officer

For general privacy, support, or policy-related queries, you may contact us at:

Email: hello@onen.in

For grievances relating to personal data or Sensitive Personal Data or Information, you may contact:

Grievance Officer: Zia Email: zia@onen.in

We will review and address grievances in a time-bound manner in accordance with applicable law.

20. Acknowledgement

By using the Services, submitting information, participating in teleconsultations or calls, booking consultations, communicating with us, or otherwise interacting with Onen Health, you acknowledge that your personal data may be collected, used, stored, shared, transferred, and otherwise processed as described in this Privacy Policy and as permitted by applicable law.