Privacy Notice
Last updated 15 September 2026
Privacy notice version 2026-09-15
This notice explains what personal data India Medical Cart collects through this website, why we collect it, who sees it, how long we keep it, and how you can use your rights.
In short
- We use your details to reply to your enquiry by phone, WhatsApp or email.
- Your treatment area is health information, so we treat it with extra care.
- We share your details with a hospital only when you ask us for a quote.
- We do not sell your data. This website has no advertising pixels, analytics or third-party scripts.
- Our enquiry records never store your IP address itself, only a scrambled (hashed) form of it.
- You can ask to see, correct or delete your details, or withdraw your consent, at any time. If you ask us to delete them, we delete the whole record; our own 24-month rule anonymises a closed enquiry instead of deleting it, so we can still report on outcomes.
Who is responsible for your data
India Medical Cart is a product of Mount Talent Consulting Private Limited, Telferk India Private Limited and Talent4Assure Assessment Services Private Limited. Mount Talent Consulting Private Limited decides how and why your personal data is used. Under India's Digital Personal Data Protection Act 2023, this makes it the "Data Fiduciary".
India Medical Cart is a medical travel facilitator, not a hospital or a doctor. This notice covers the details you give us through this website. When you later send medical reports through the secure way we give you, we will tell you how those reports are handled before you send them.
What we collect when you send an enquiry
These are the details you type or choose in the "Get a Quote" form.
| Detail | Required? | Why we need it |
|---|---|---|
| Your name | Required | To know who we are talking to. |
| Country you live in | Required | To know where you are travelling from and to call you at a sensible time. We also record the usual time zone of that country. |
| Phone or WhatsApp number | Required | To call or message you about your enquiry. |
| Email address | Optional | To send you a confirmation with your reference, and to write to you if you prefer email. |
| Treatment area (for example, heart care) | Required | To pass your enquiry to a coordinator who knows that kind of treatment. This is health information. |
| Preferred time to call | Required (it starts as "Any time") | To call you when it suits you. |
| Your message | Optional | To understand what you need. Please do not put medical reports or a detailed medical history here. |
| Your consent, the time you gave it and the version of this notice | Required | To show what you agreed to, and when. |
If you leave out a required detail, the form will not send, and we cannot reply to you. You can still read everything on this website without giving us any details.
What the form records automatically
| Detail | Why we record it |
|---|---|
| The treatment or hospital page you came from, if you used a "Get a quote" button on that page | So we know which treatment or hospital you are asking about. |
| The address of the page where you opened the form | To see which pages help people reach us. |
| Campaign tags in the web address (such as utm_source), if the link you followed had them | To know which of our campaigns bring enquiries. |
| The other website that sent you to us, if your browser tells us | To know how people find us. |
| A hashed (scrambled) form of your IP address | To stop spam and abuse, and to limit how many forms one connection can send in an hour. Our enquiry records never store your IP address itself, only this hashed form. The hashed form can still be linked to a connection, so we treat it as personal data. |
| Your browser user agent (a short text your browser sends, describing the browser and device type) | To help us spot automated spam. |
| The result of our spam checks, for example if the form was sent too quickly for a person to fill in | To check suspicious enquiries before we call. |
| Your enquiry reference (for example IMC-7K3Q) | So you and we can find your enquiry quickly. |
| The status of your enquiry, the team member handling it and notes our team adds | To keep track of our work on your enquiry. |
Security logs
When you visit any page, security logs kept by us or by the service providers that host our website may record your IP address, the time and the page requested. We use these logs only to keep the website secure, for example to find and stop attacks. They are kept for at least 180 days, as India's CERT-In Directions of 28 April 2022 require.
If you are asking for someone else, please make sure you have their permission, or that you are their parent or lawful guardian.
Please do not send photos (including photos of your face), genetic test results or medical reports through our forms.
What we collect from hospitals and doctors
Hospital partnership enquiries
The "For hospitals" form collects: hospital name, your name, your role (optional), work email, phone number, city (optional) and message (optional). It also records your consent with its time and notice version, a hashed form of your IP address, your browser user agent, the result of our spam checks and a reference such as IMP-7K3Q. We use these details only to reply to the partnership enquiry.
Doctor profiles on this website
Some doctor profiles are compiled by India Medical Cart from public sources. These include hospital profile pages, the doctor's own website, news reports and the National Medical Commission register. A profile shows the doctor's name, role, places of practice, qualifications, experience and, once checked, registration details. Each profile names its sources and the date we checked them. Other profiles are supplied and approved by the hospital. A doctor or hospital can ask us to correct or remove a profile by writing to care@indiamedicalcart.com. Read our editorial policy.
Medical reports you send us
When a hospital needs your medical reports, we ask for them through a private link - never through this website's forms, WhatsApp or email. The link expires seven days after we create it, and we can revoke it sooner if we need to. The files you send are stored where the public internet cannot reach them. Only the staff handling your enquiry can open them, and every time a file is opened, we record it in our audit log. We delete these files when your enquiry is anonymised 24 months after its last activity, or sooner if you ask us to delete your enquiry record outright. Read Sending your medical reports safely for the full flow.
Your consent and the laws that apply
We use your enquiry details because you agree to it. Before you send a form, you tick a box to give your consent. The box is never ticked for you. The box says that you agree to India Medical Cart using your details to reply to your enquiry by phone, WhatsApp or email, and to share them with hospitals only when you ask for a quote. We do not ask for, and do not use your details for, marketing.
Sending the form does not by itself send your details to any hospital. Before we ask hospitals for quotes, we tell you which hospitals we will ask. We share only what they need to review your case.
The Indian laws that apply to this notice are:
- the Information Technology Act 2000 and its Sensitive Personal Data or Information Rules 2011, which apply now; and
- the Digital Personal Data Protection Act 2023 and its Rules 2025. Most of its duties, including the rights below, start on 13 May 2027. We offer these rights to you now.
The emails we send
- To you: if you give an email address, we send a confirmation with your reference and what happens next. We do not send it when our spam checks flag the form.
- To our team: an alert with your reference, your country and a link to open the enquiry in our admin system. The subject line shows only the reference, your country and whether our spam checks flagged the form, not your treatment area. The email never includes your name, phone number, email address, treatment area or message.
- For hospital enquiries: our team receives an alert with the hospital name and a link to open the enquiry in our admin system. It never includes the contact's name, phone number, email address or message.
Who can see your details
- Our team: only the people who handle enquiries.
- Service providers that host our website and send our emails: they store and carry your details for us, including the email alert to our team described above.
- Phone and messaging services: when we call you or message you on WhatsApp, those services carry the call or message. WhatsApp's own privacy policy also applies to a WhatsApp chat.
- Hospitals: only when you ask us for a quote. Before we ask hospitals for quotes, we tell you which hospitals we will ask, and we share only what they need to review your case. Each hospital then handles your details under its own privacy policy.
- Authorities: only when Indian law requires it, for example a court order.
We do not sell your personal data, and we do not share it with advertisers.
If you live outside India
India Medical Cart is based in India, and our team handles your enquiry in India. This means your details leave your country and are processed in India. The service providers that host our website and send our emails may also store or process them in other countries. Indian law applies to how we handle your details, whatever your nationality.
We protect your details in the same way wherever you live, using the safeguards in the "How we protect your details" section below.
If you live in Kenya
Kenya's Data Protection Act 2019 treats health information as sensitive. Section 49 allows it to be processed outside Kenya only with your consent and with suitable safeguards. This notice tells you, before you send the form, that your details are processed in India and how we protect them. If you do not want your details processed in India, please do not send the form. You also have rights under Kenyan law, and you can complain to the Office of the Data Protection Commissioner (checked on 15 September 2026).
Other countries
The law of your own country may give you further rights. Write to privacy@indiamedicalcart.com and we will help.
How long we keep your details
| Record | How long we keep it |
|---|---|
| Patient enquiries we have closed, or found we could not take forward | Anonymised automatically 24 months after the last activity on the enquiry: we replace your name with "Removed" and clear your phone number, email address, message, browser details, hashed IP address and marketing attribution, but keep the reference, country, treatment area, status, dates and other non-identifying details, such as which page the enquiry came from, for our statistics. |
| Patient enquiries that are still new, being contacted or under review, and enquiries where you go ahead with treatment | Kept while we or a hospital may still need them. Once our team closes the enquiry, or marks it as one we could not take forward, the anonymisation rule above applies from your last activity. |
| Hospital partnership enquiries we have closed, or found we could not take forward | Anonymised automatically 24 months after the last activity on the enquiry: we replace the contact name with "Removed" and clear the role, phone number, email address, message, browser details and hashed IP address, but keep the reference, hospital name, city, status, dates and other non-identifying details for our statistics. |
| Patient and hospital enquiries that our spam checks marked as spam or suspected spam, with any notes on them | Deleted automatically after 90 days. |
| Hourly spam-limit counters (a hashed IP address, the hour and a count) | Each counter is needed for one hour only. Deleted automatically after 24 hours. |
| Copies of our emails about your enquiry | Our team deletes them by hand when the enquiry is deleted or anonymised. |
| Security logs kept by us or the service providers that host our website | At least 180 days, as India's CERT-In Directions of 28 April 2022 require. |
| The session cookie | Deleted when you close your browser. See our cookie policy. |
If you withdraw your consent or ask us to delete your details, we delete your enquiry record and its notes outright within 30 days, unless Indian law requires us to keep them.
How deletion works today: when you ask us to delete your details, an administrator deletes the enquiry record and its notes outright - nothing is kept, not even the reference. Separately, every day at 03:15 India time, the website automatically deletes spam and suspected spam enquiries older than 90 days, and spam-limit counters older than 24 hours, and anonymises (rather than deletes) patient and hospital partnership enquiries that our team has closed, or marked as ones we could not take forward, once 24 months have passed since the last activity on them, as described in the table above - so we can still report on outcomes. Enquiries that are still new, being contacted or under review are not anonymised automatically, even if old, until our team closes them. An administrator can also anonymise a single enquiry immediately, as an alternative to deleting it outright. The automatic job does not delete copies of our emails about an enquiry; our team deletes those by hand.
How we protect your details
- Our enquiry records never store your IP address itself, only a hashed form made with a secret key.
- Our forms are protected against forged submissions from other websites.
- The session cookie cannot be read by scripts on the page.
- When you follow a link from our website to another website, your browser tells that website only our website's address, not the page you were reading.
- This website loads no scripts, fonts or images from other companies, so no advertiser or analytics company sees your visit through us.
- Your message is never copied into emails.
- We do not accept medical reports through our forms, WhatsApp or email.
- Only team members who handle enquiries can see them.
No system can be made completely safe. If a data breach affects your details, we will tell you without delay, along with what we are doing about it.
Your rights
- Access: ask for a summary of the details we hold about you, and who we shared them with.
- Correction: ask us to correct, complete or update your details.
- Erasure: ask us to delete your enquiry record and its notes outright - not just anonymise them.
- Withdraw consent: tell us you no longer agree to us using your details.
- Nominate: name another person who can use these rights for you if you die or become unable to act.
- Complain: raise a grievance with us, and then with the Data Protection Board of India.
How to use your rights
Write to privacy@indiamedicalcart.com. Please include your name, your enquiry reference (for example IMC-7K3Q) and what you are asking for. If you do not have the reference, give the phone number or email address you used in the form. We may ask you to confirm that the enquiry is yours before we act, so that nobody else can see or change your details.
Withdrawing consent is as easy as giving it: one email is enough. Once you withdraw, we stop using your details for your enquiry and ask any hospital we shared them with to stop too. What we did before you withdrew stays lawful. We will no longer be able to help with your enquiry.
How quickly we respond
- We acknowledge your request within 48 hours.
- We resolve it within 30 days.
Complaints
If you are unhappy with how we handled your details, contact our Grievance Officer first. Once this part of the Digital Personal Data Protection Act is in force, it asks you to contact us before going to the Data Protection Board of India.
The Data Protection Board of India was set up on 13 November 2025. When we last checked, on 15 September 2026, it did not yet have a way for the public to send complaints. When it opens one, we will add the details here.
Children
This website is not meant for people under 18 to use on their own. A parent or lawful guardian can send an enquiry for a child. Before we handle a child's medical information, we will ask the parent or guardian to confirm who they are and to give consent. We do not direct any tracking or marketing at children.
Language
This notice is in English. If you need it in another language, such as Hindi or Bengali, write to privacy@indiamedicalcart.com and we will arrange it.
Changes to this notice
When we change this notice, we give it a new version and date. We store the version you saw with your enquiry. If a change affects how we use details you have already given us, we will tell you and, where needed, ask for your consent again.
This is version 2026-09-15, last updated 15 September 2026.