Privacy Policy

Last updated: 2026-11-07

This Privacy Policy explains how Shazygo Private Limited (“MedZyGo”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you use the MedZyGo mobile application, the MedZyGo web app at app.medzygo.com, and this website (together, the “Platform”). We act as a Data Fiduciary and process personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable law. Registered address: D. No. 2-16, B C Colony, Shettur, Ananthapur, Andhra Pradesh 515767, India. Contact: help@medzygo.com.

By using the Platform you acknowledge this Policy. Where the law requires consent, we will ask for it and you may withdraw it at any time (see Section 9).

Health-related information can be sensitive. We collect only what we need to help you discover care, we do not sell your data, and you control the symptom and location information you choose to share.

1. Scope

This Policy applies to personal data we process about Users and Providers through the Platform. It does not apply to the practices of Providers or other third parties whose services you discover or use through the Platform; their handling of your data is governed by their own policies.

2. Information we collect

You provide:

Health / symptom input: descriptions you choose to type or speak to find relevant care (see Section 4).
Contact and profile details: such as name, phone number, or email when you contact us, create an account, or register as a Provider.
Ratings, reviews and reports: the rating and review text you post about a Provider, published with the name you gave after a moderator approves it; and, if you report a review, the reason you pick and any note you add.
Provider information: establishment details, licences, and listing content submitted by Providers.
Coupon claims: when you claim a discount code, the phone number and email you give at the time of the claim. (This feature is currently switched off in the app.)

Collected automatically or with your permission:

Location: with your device permission, your phone’s location (GPS), so we can show nearby services. You can instead type a city, area or pincode. The location (from GPS or typed) is sent with each search to list nearby Providers and is not stored with your account.
Microphone (voice search): the app asks for the microphone only when you tap the microphone button. Your phone’s own speech recognition service (Google’s on most Android phones) turns your speech into text. MedZyGo receives only the text, never the audio, and stores no audio.
First-launch consent record: before the app can be used, you must accept the Terms and this Policy. When you do, the app sends a random identifier created for that installation, together with the app version, Android version, phone model and language; our server also records the IP address and user agent of that request. This record proves that consent was given and is not linked to your account.
Device and usage data (website): such as device type, browser, language and pages viewed, through cookies and similar technologies (see Section 7).
Log data: such as IP address, timestamps and the requests made, for security and diagnostics.
Sign-in records: sign-in attempts and one-time sign-in codes, to protect accounts against misuse.

We do not require you to create an account simply to browse and discover services. Posting a rating, reporting a review and deleting an account require signing in.

3. How we use your information

We use personal data to:

operate the Platform and show you relevant, nearby healthcare options;
process symptom text through an AI model to suggest relevant specialities or services (see Section 4);
publish approved ratings and reviews, and let moderators review reported reviews;
enable Provider listings, advertisements, health camps, and discount/tracking codes (including recording coupon claims);
respond to your enquiries, grievances, and support requests;
maintain safety and security, detect and prevent fraud or abuse;
analyse and improve the Platform; and
comply with legal obligations.

4. How AI processing works

Symptom text you enter (or speak, after your phone converts it to text) is sent to an AI language model, Meta Llama run on Amazon Bedrock (Amazon Web Services, United States), to suggest relevant specialists or services. The text is not stored in the MedZyGo database. To answer repeated questions quickly, the suggestion is kept in server memory for up to one hour, indexed by a one-way hash of the text, and then discarded. The output is informational only and is not medical advice (see our Terms & Conditions). We do not use this to make any solely automated decision that produces a legal or similarly significant effect on you.

We process personal data on the basis of your consent and, where applicable, for legitimate uses permitted under the DPDP Act (such as responding to your request, security, and legal compliance). Before or at the time of collecting personal data on the basis of consent, we provide notice of the data sought and the purpose. You may withdraw consent at any time; withdrawal does not affect processing already carried out and may limit features that depend on that data.

We do not sell your personal data. We may share personal data:

with service providers / data processors acting on our instructions, bound to use it only to provide their service:
- Amazon Web Services (Mumbai, India region): hosting, database, file storage and server logs;
- Amazon Bedrock (Amazon Web Services, United States): the AI model that reads symptom text (Section 4);
- Twilio SendGrid (United States): sending account and service emails;
- Google Places (Google): location search. When you type a place, the app sends the typed text and place identifiers from your phone to Google. The Google Places SDK in the Android app also sends Google crash data, diagnostics, device and request metadata, your IP address and an SDK identifier;
- Android Geocoder (Google Play services on your phone): receives your GPS position or pincode to name the place;
- Google Maps (Google): the maps in the Android app. When a map is shown, the Google Maps SDK sends Google the map area, your current position when the map shows it, your IP address, crash data, diagnostics and an SDK identifier;
- OpenStreetMap tile servers: where Google Maps is not available, the map loads map images directly from OpenStreetMap, which receives your IP address and the map area shown (an approximate location);
with a Provider you choose to contact, to the extent needed to facilitate your request;
where required by law, legal process, or a governmental authority, or to protect rights, safety, and security; and
in connection with a business transfer (merger, acquisition, or reorganisation), subject to this Policy.

7. Cookies and similar technologies

On the website we use necessary cookies and similar technologies to operate it, remember preferences (such as language), and understand usage. You can control cookies through your browser or device settings; disabling some may affect functionality. The MedZyGo Android app contains no analytics or advertising SDK and shows no ads.

8. Data retention

We keep personal data only as long as needed for the purposes in this Policy or as the law requires, and then delete or anonymise it in accordance with the DPDP Act:

Account details (name, email, phone): until you delete your account (Section 9).
Ratings and reviews: while published. If you delete your account, they stay published without your name, shown as “Anonymous”.
Review reports: until a moderator resolves them, and then for up to 1 year. If you delete your account, the link between you and your reports is removed.
First-launch consent records: up to 1 year, or longer only where needed to prove consent in a legal claim.
Coupon claims: up to 1 year after the claim.
Symptom text: not stored; kept in server memory for up to one hour (Section 4).
Location: not stored with your account.
Sign-in attempt records: 30 days. One-time sign-in codes expire within minutes and are then deleted.
Server logs: 14 days. Database backups: 7 days.
Other personal data (for example support emails): up to 1 year after the purpose ends, unless the law requires us to keep it longer.

9. Your rights as a Data Principal

Subject to the DPDP Act, you have the right to:

access a summary of the personal data we process about you and the processing activities;
correction, completion, and updating of your personal data;
erasure of your personal data where it is no longer necessary;
withdraw consent at any time;
nominate another individual to exercise your rights in case of death or incapacity; and
grievance redressal (see Section 13).

Deleting your account. You can delete your account yourself at any time:

in the app: Profile > Delete account;
on the web: your account page at app.medzygo.com;
or from the public page app.medzygo.com/delete-account, which explains both routes. If you cannot sign in, email help@medzygo.com from the address on your account and we will delete it for you.

Deletion is immediate and permanent. We delete your account, email, phone number, sign-in sessions, sign-in attempt and one-time-code records, and your activity history. What stays: your reviews, without your name (shown as “Anonymous”); review reports, without the link to you; consent records, which never carry a link to your account; and coupon claims, which keep the phone and email given at claim time until their retention period ends (Section 8).

To exercise any other right, contact our Grievance Officer at help@medzygo.com. We may need to verify your identity before acting on a request.

10. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will follow the notification requirements under applicable law.

11. Children and persons with a guardian

The Platform is not directed at children. We do not knowingly process the personal data of a child (under 18) or of a person with a lawful guardian without obtaining verifiable consent of the parent or lawful guardian as required by the DPDP Act, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

12. International transfers

We store data in India (Amazon Web Services, Mumbai region). Some processing happens outside India: symptom text is processed by Amazon Bedrock in the United States (Section 4), emails are sent through Twilio SendGrid in the United States, and Google services (Places, Maps, Geocoder) may process data outside India. We use these only in countries not restricted under the DPDP Act, and require them to handle data consistently with this Policy and applicable law.

13. Grievance redressal

If you have a question, concern, or complaint about how we handle your personal data, contact our Grievance Officer:

Grievance Officer: Raghavendra Reddy Ramireddygari
Email: help@medzygo.com
Address: Shazygo Private Limited, D. No. 2-16, B C Colony, Shettur, Ananthapur, Andhra Pradesh 515767, India

We will acknowledge and respond within the timelines required by applicable law. If you are not satisfied, you may have the right to escalate to the Data Protection Board of India under the DPDP Act.

14. Third-party links

The Platform may link to third-party sites and services (Providers, maps, app stores). We are not responsible for their content or privacy practices. Please review their policies before sharing information with them.

15. Changes to this Policy

We may update this Policy from time to time. We will revise the “last updated” date above and, where appropriate, notify you through the Platform. Your continued use after changes take effect indicates acceptance of the updated Policy.

16. Contact

For privacy questions or to exercise your rights: help@medzygo.com, Shazygo Private Limited, D. No. 2-16, B C Colony, Shettur, Ananthapur, Andhra Pradesh 515767, India.