Privacy Policy

Introduction

SHLDR is a healthcare technology platform operated by SHLDR Health Care Technologies Private Limited (hereinafter referred to as "SHLDR", "we", "us", or "our", which expression shall, unless repugnant to the context or meaning thereof, be deemed to mean and include its successors-in-interest and permitted assigns), having its registered office at Guntur, Andhra Pradesh, India. The Platform facilitates connection between Users and independent healthcare Service Providers, including ambulance operators, diagnostic laboratories, and blood banks.

This Privacy Policy ("Policy") sets out the manner in which SHLDR collects, uses, stores, protects, discloses, retains, and deletes information through the SHLDR website and mobile application (the "App"), and is framed with reference to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP Act"), the Information Technology Act, 2000, and other applicable Indian law.

By accessing or utilising the App, the User shall be deemed to have consented to the collection, processing, and use of information as set out in this Policy.

Information Collected

Account Information: Name, mobile telephone number, electronic mail address, account credentials, and profile particulars.

Booking and Service Information: Service type requested, Booking particulars and Booking Code, Booking history, service location, and communication relating to a Booking.

Health-Related Information: Such information as the User may furnish for the fulfilment of an ambulance, diagnostic laboratory, or blood bank request.

Location Information: Processed where requisite for the delivery of a service, subject to the permissions granted by the User through the App.

Payment Information: Collected through SHLDR's designated payment gateway partner, in compliance with the guidelines of the Reserve Bank of India. SHLDR does not store complete card particulars.

Use of Information

SHLDR utilises the information collected for the following purposes:

• Creation and administration of User accounts.
• Processing of Bookings and connection of Users with the relevant Service Provider.
• Generation of a Booking Code for the purpose of minimising disclosure of the User's identity.
• Customer support and grievance redressal.
• Transmission of service-related notifications.
• Processing of payments.
• Maintenance of platform security.
• Detection and prevention of fraud and unauthorised activity.
• Technical diagnostics and improvement of the Platform.
• Compliance with legal and regulatory requirements.

SHLDR does not, under any circumstance, sell User Personal Data to any third party.

Health & Sensitive Information

Health Data is utilised solely for the delivery of the service requested, the support of the User's healthcare interaction, the maintenance of security, or compliance with Applicable Law, and shall under no circumstance be utilised for advertising or profiling.

The User shall furnish only accurate and necessary information. SHLDR shall not be responsible for any consequence arising from inaccurate information furnished by the User.

Disclosure of Information

5.1 Booking Code in Lieu of Identity

Wherever operationally feasible, SHLDR shall disclose a system-generated Booking Code to the concerned Service Provider in lieu of the User's name, together with such minimum information as is necessary for the fulfilment of the Booking.

5.2 Circumstances of Fuller Disclosure

The User's name and identifying particulars shall be disclosed solely where unavoidable for the safe and effective delivery of the service, strictly limited to what such service requires.

5.3 Obligations of Service Providers

Every Service Provider empanelled upon the Platform is bound to: use User data solely for the fulfilment of the Booking; refrain from utilising the same for independent marketing or database compilation; refrain from disclosure to further third parties without authorisation; transmit and store such data solely through secure, approved channels; delete or return such data within a defined period following completion of the Booking, save where extended retention is legally mandated for its category; and notify SHLDR within six (6) hours of any suspected data breach.

Violation of the foregoing obligations may result in the suspension or termination of the Service Provider concerned, and referral to the appropriate regulator or law enforcement authority.

5.4 Data Furnished Directly by the User

Any information furnished by the User directly to a Service Provider, over and above that disclosed by SHLDR, is furnished at the User's own discretion, and SHLDR bears no responsibility for the manner in which such Service Provider handles such information.

5.5 Technology and Service Providers

SHLDR engages third-party providers for hosting, infrastructure, analytics, communications, payments, security, and support, each of which is bound to process data solely upon SHLDR's instructions.

5.6 Legal and Regulatory Disclosure

SHLDR may disclose information where required by law, legal process, or for the protection of the rights, safety, or security of SHLDR, Users, Service Providers, or the public.

SHLDR does not sell User Personal Data to any third party.

Data Protection & Security

SHLDR implements measures proportionate to the sensitivity of the data concerned, including:

• Encryption in transit and at rest.
• Access controls restricted on a need-to-know basis.
• Confidentiality undertakings executed by Service Provider personnel.
• Transmission solely through secure channels, and never through personal WhatsApp, Short Messaging Service, or personal electronic mail.
• Audit rights in respect of Service Providers.
• Breach-response procedures aligned with the DPDP Act.

No method of transmission or storage is entirely secure, and SHLDR makes no warranty of absolute security.

Data Retention

Data shall be retained in accordance with the following:

• Account information: retained during the subsistence of the User's active account, and for a limited period thereafter.
• Ambulance trip and location data: retained for a period not exceeding ninety (90) days following the trip, whereupon the same shall be deleted.
• Diagnostic reports and samples: digital copies held by the concerned Service Provider only until upload to SHLDR, not exceeding forty-eight (48) hours; physical records retained in accordance with applicable clinical law.
• Blood bank records: retained in accordance with statutory requirements of the applicable Blood Transfusion Council and the Drugs and Cosmetics Rules.
• Payment records: retained in accordance with statutory, taxation, and audit requirements.

Where a Service Provider is legally mandated to retain data for a period exceeding SHLDR's general retention period, such longer, legally mandated period shall apply.

Account & Data Deletion

The User may request deletion of the User's account and associated data. Such request shall be actioned within thirty (30) days, save in respect of: (a) data requisite for the completion of an active Booking; (b) data which SHLDR is legally mandated to retain; and (c) data requisite for the resolution of a subsisting dispute. SHLDR shall inform the User of any category of data retained and the basis therefor.

Privacy Rights of the User

Under the DPDP Act, the User possesses the following rights:

• Access — to obtain a summary of the Personal Data held by SHLDR.
• Correction — to seek correction or updating of inaccurate or incomplete Personal Data.
• Erasure — to seek erasure of Personal Data, subject to Article 8.
• Grievance Redressal — to raise a grievance in respect of the handling of the User's data.
• Nomination — to nominate another individual to exercise the aforesaid rights in the event of the User's death or incapacity.
• Withdrawal of Consent — to withdraw consent at any time, it being clarified that such withdrawal may limit SHLDR's ability to render service to the User.

The aforesaid rights may be exercised by addressing the Grievance Contact referred to in Section 15.

Cookies & Similar Technologies

SHLDR utilises essential session tokens and analytics scripts for the purpose of maintaining logins, verifying requests, and monitoring performance, and not for the compilation of advertising profiles.

User Responsibilities

The User shall be responsible for: maintaining the security of the User's credentials; furnishing accurate Booking information; sharing solely such information as is necessary directly with Service Providers; and promptly reporting any suspected unauthorised access to the User's account.

Disclaimer

SHLDR is a technology and facilitation platform, and does not furnish medical certifications, clinical opinions, diagnostic results, or treatment, responsibility for which rests solely with the licensed Service Provider concerned.

Children's Data

The App is intended for use by persons of eighteen (18) years of age and above. A Booking in respect of a minor or dependent shall be raised by a competent adult User, who shall bear responsibility for the accuracy of information furnished on behalf of such minor or dependent.

Amendment of This Policy

SHLDR may amend this Policy from time to time. Material amendments shall be notified to the User through the App prior to taking effect. Continued use of the App subsequent to such amendment shall constitute acknowledgment thereof.

Privacy Contact & Grievance Officer

For any inquiry, complaint, or request relating to data privacy — including the exercise of rights under Section 9 — the User may address the Grievance Contact below. SHLDR shall acknowledge such inquiry, complaint, or request within forty-eight (48) hours, and shall endeavour to resolve the same within thirty (30) days.