Privacy Policy

OM CARE processes information required to provide healthcare platform services, maintain user accounts, support bookings, process payments and provide authorized access to platform features.

Information We May Process

Depending on the service used, information may include account details, contact information, healthcare service booking details, provider information, payment references and information submitted by users as part of healthcare workflows.

Google OAuth and Gmail

OM CARE uses Google OAuth to authorize access needed for its email-based authentication workflow. The Google permissions used by this workflow are limited to the user's Google account email address and permission to send email through the Gmail API.

OM CARE uses this access to identify the authorized Google email account and to send OM CARE authentication and one-time-password (OTP) emails. OM CARE does not use this authorization to read a user's Gmail messages.

OAuth authorization information, including refresh-token information where required for continued authorized email sending, may be stored securely by OM CARE for this functionality. Google user data obtained through Google APIs is not sold or used for advertising. It is not shared with third parties except where required to provide the authorized service, maintain security, comply with law, or with the user's direction or consent.

Users may revoke OM CARE's Google account access through their Google Account permissions. Revoking access may prevent OM CARE from using the affected Google authorization to send authentication emails until authorization is granted again.

Payment Information

Payments may be processed through third-party payment service providers. OM CARE does not require users to provide raw card, UPI PIN or banking authentication credentials directly to OM CARE. Payment providers may process information according to their own security and privacy requirements.

Health and Report Information

Healthcare reports and related information are handled only for authorized platform workflows. Access may depend on the role of the user, the relevant healthcare relationship and applicable consent or authorization.

Data Protection and Security

OM CARE protects personal and sensitive information, including account information, healthcare information and Google OAuth authorization data, using the following controls:

• Encrypted OAuth token storage: Gmail OAuth refresh tokens are encrypted using AES-256-GCM before being stored in the database. The encryption key is supplied through server configuration separately from the stored token records. Tokens are decrypted on the server only when needed for authorized email sending.
• Authentication and access control: Protected management operations require authenticated access and server-side role and account-status checks. Sensitive operations are restricted according to the user's authorized role. Expired or revoked sessions are rejected.
• PIN protection: Management login PINs are stored as salted PBKDF2-SHA256 hashes rather than plaintext. Failed verification attempts are limited using lock or cooldown controls.
• Limited Google access: The email workflow requests Google account email identification and Gmail sending permission. It does not request permission to read the user's inbox. Google authorization is used to send OM CARE authentication emails from the authorized sending account; receiving an OTP does not itself authorize access to the recipient's Gmail account.

These measures reduce the risk of unauthorized access, use, alteration or disclosure. No system can guarantee absolute security. Encryption of OAuth refresh tokens does not mean that every database field or backup is encrypted.

Account Deletion Authority and Retained Records

Within the management console, administrative account deletion is restricted to the Founder. Ordinary management staff cannot use the Founder's account-deletion operation. This restriction does not prevent permitted profile changes or a user from contacting OM CARE about their own information.

The current administrative account-deletion process disables the account and marks it as deleted; it does not physically erase every related database record. Booking, prescription, financial and audit records associated with that account may remain. Account deactivation, Google access revocation and permanent data erasure are different actions.

Backup copies may also contain retained records. OM CARE does not represent administrative account deletion as immediate removal from every backup. For requests concerning access, correction, deletion or retained information, contact OM CARE through the Contact page. The request will be reviewed, and any retained information and applicable service or legal reasons will be explained.

Changes

This policy may be updated as OM CARE services, legal requirements or platform capabilities change.

Last updated: 11 October 2026