Privacy Notice

Privacy Notice · Version 1.0 · Prepared 10 September 2026 · Effective 1 September 2026. Oncology Mitra is operated by ZTS Global Ventures Private Limited (CIN U62090UP2026PTC247240 · GSTIN 09AADCZ0004D1ZU), E-1190, E Block, Rajajipuram, Lucknow, Uttar Pradesh 226017.

1. Who we are

ZTS Global Ventures Private Limited operates Oncology Mitra — this website and the OM app (together, the “Platform”). For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal information described in this Notice, and you are the Data Principal. We provide holistic, non-medical support alongside cancer care.

2. What this Notice covers

This Notice explains how we handle personal information through the Platform. It works alongside our Terms and Informed Consent. Acknowledging this Notice is not consent to every possible use of your information — specific consents are collected separately, as described below.

3. What we collect

We collect only what is needed for the purpose you have requested.

Account and profile

Your name, mobile number (verified by one-time passcode), email address, preferred language, and the profile details you choose to give us, such as your diagnosis and treatment stage so a Provider can prepare.

Bookings and payments

Booking references, programme and entitlement details, and payment references. Payments are processed by our payment provider; we never see or store your full card details.

Consultation information

Information you choose to share with your Provider during a session, and the proportionate professional records your Provider is required to keep. Health-related information is treated as sensitive and handled with strict confidentiality and restricted access.

Personal features

Journal entries and Mood Tracker records. These are private to you and are not shared with any Provider unless you choose to share them.

Community content

Posts, comments and your chosen display name in the OM Community. Public community content can be seen by other members and may be copied — please avoid posting confidential medical information there.

Technical information

Device type, app version, connection data needed to deliver audio and video sessions, and basic usage information needed to keep the Platform secure and working.

Communication preferences

Your separate choices for optional reminders and marketing by push notification, SMS or email. Each starts switched off.

4. Why we use it, and on what basis

• To provide the services you request — creating and operating your account, matching you with a Provider, delivering consultations, plans and features. Basis: your consent, given when you set up your account and before each consultation.
• To take payment and manage your programme or booking. Basis: consent, and performance of the agreement with you.
• To send necessary transaction and safety messages about a service you have requested — booking confirmations, session links, important safety information. These are not marketing and cannot be switched off while you use the service.
• Optional reminders and marketing — only if you have separately opted in, by the specific channel you chose. You can change each choice independently at any time.
• To keep the Platform safe — moderating the community, preventing fraud and abuse, and responding to security incidents.
• To meet legal obligations, respond to lawful requests, and establish or defend legal claims.

5. Health information and confidentiality

Your Provider will explain confidentiality and its limited lawful exceptions before your session — including disclosures required by law or justified by a genuine emergency. Any permitted disclosure is kept to the minimum necessary and is documented. Relatives and caregivers do not automatically receive access to your information. Administrative staff do not have blanket access to therapy notes; access to health information requires specific role approval and training.

6. Who we share information with

Your Provider

The Provider you book with receives the information needed to prepare for and deliver your session. Providers are bound by professional confidentiality and by written agreements with us covering data handling.

Technology providers

The Platform relies on a small number of service providers, each of which processes only what its function requires, under contract:

• Supabase — backend services and secure data storage
• Razorpay — payment processing
• VideoSDK — audio and video consultations
• Firebase — app notifications

We will keep this list current with the services actually in use.

Legal and safety

We may disclose information where required by law, by a court or competent authority, or where reasonably necessary to protect someone from serious harm — always limited to what is necessary.

What we never do

• We do not sell your personal information.
• We do not share it with advertisers or data brokers.
• We do not use your consultation content, journals or mood entries to train AI models.
• We do not disclose your information to your employer, or to relatives, without your consent or a lawful basis.

7. Recording

Consultations are not recorded. Any proposed recording, transcript or AI analysis would require a separately explained lawful process — identifying its purpose, recipients, retention and your choices — and your specific consent before it begins. Accepting this Notice or the Informed Consent does not authorise recording.

8. How long we keep information

We keep personal information only as long as needed for the purpose it was collected, or as required by law. In general:

• Account information — while your account is active, then deleted or anonymised within a defined period after closure.
• Professional records — for the period your Provider is legally or professionally required to retain them, held under restricted access.
• Payment records — for the period required by tax and accounting law.
• Journals and mood entries — until you delete them or close your account.
• Consent records — a proportionate record of what you were shown and accepted, kept to evidence your choices.

Closing your account does not automatically erase records we must retain for a lawful reason; we will explain any such limit when you ask. Backups are deleted on their normal cycle and are never restored for ordinary business use.

9. How we protect it

We use encryption in transit and at rest, role-based access with least privilege, individual credentials for all staff and Providers, and contractual data-handling obligations for everyone who processes information on our behalf. If we discover a security incident affecting your personal information, we will notify you and the relevant authority as required by law, without waiting for a complete investigation.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 and other applicable law, you may:

• Access a summary of the personal information we hold about you and how it has been used.
• Correct information that is inaccurate or incomplete.
• Erase information that is no longer needed for its purpose, subject to lawful retention.
• Withdraw consent at any time. Withdrawal is prospective and does not invalidate prior lawful processing; we will explain the effect on any service you have requested.
• Change your communication choices for each channel independently.
• Nominate a person to exercise these rights on your behalf in the event of death or incapacity.
• Raise a grievance with our Grievance Officer, and thereafter with the Data Protection Board of India.

To exercise any right, use the relevant control in the app or write to support@oncologymitra.com. We may need to verify your identity proportionately before acting.

11. Children

The Platform is for adults aged 18 or above. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us and we will delete it.

12. Website cookies and analytics

This website uses only the essential cookies needed for it to function, and privacy-respecting, aggregated analytics to understand how the site is used. We do not use advertising cookies or cross-site tracking.

13. Changes to this Notice

We may update this Notice from time to time. Changes are identified by version and date, apply prospectively, and material changes will be notified in the app or by email before they take effect. A materially changed service may require fresh consent.

14. Grievance Officer

If you have any concern about how your information has been handled, please contact our Grievance Officer. You may also complain to the Data Protection Board of India. Raising a grievance with us does not affect any other remedy available to you.