Skip to main content
Medfolio
Compliance

Medfolio and the DPDP Act, 2023.

How Medfolio aligns with India's Digital Personal Data Protection Act, 2023 — what we do, what you can ask of us, and how to reach our grievance officer.

Last updated: 15 May 2026

01 · Consent

You consent to Medfolio collecting and processing your medical records when you sign up. Consent is granular — you can decline optional processing (like international AI processing) without losing access to the core service.

For sharing reports with anyone outside your account, you provide explicit consent for that specific share. Consent for sharing is per-recipient, scope-limited, and time-bound.

02 · Data Principal rights

You have the following rights as the Data Principal under the DPDP Act:

  • Right to access— view all data Medfolio holds about you, via Settings › Account & Data
  • Right to correct — edit or annotate any extracted value or profile detail
  • Right to erase — delete any report, any profile, or your entire account
  • Right to port — export your full timeline as a structured archive
  • Right to nominate — designate a family member or guardian to exercise rights on your behalf

03 · Data minimization

We collect only what we need to operate the service: phone number (for sign-in), name and date of birth (for profile labels), uploaded reports (the core service), and usage logs (for security and reliability). We do not collect: location, device contacts, microphone, or any data unrelated to operating Medfolio.

04 · Children

Medfolio is for users 18 and older. Children's health records can be managed by a parent or guardian as a profile under the parent's account. We do not allow under-18s to create their own Medfolio account.

05 · Significant Data Fiduciary

Medfolio is not currently designated as a Significant Data Fiduciary under the DPDP Act. If we are so designated, we will update this page and meet the additional obligations (DPIA, data auditor, etc.) within the prescribed timelines.

06 · Grievance officer

All complaints regarding your data are handled by Medfolio's grievance team and acknowledged within 7 days, with resolution within the timelines specified by the DPDP Act. Our named grievance officer will be published here once appointed.

  • Email: grievance@medfolio.co.in
  • Response timeline: within 7 days, resolution within 30 days
  • Named grievance officer: announcement pending appointment

07 · Cross-border data

All Medfolio data is stored in AWS Mumbai (ap-south-1). Routine operations do not transfer your data outside India. International processing (an optional setting) may briefly process data on servers outside India for OCR extraction — this is off by default and requires your explicit consent.