Privacy Policy | MediKarya

In brief: MediKarya collects account details, learning activity, messages you submit, and basic device and service logs to provide and secure its medical education platform. We do not sell personal data. Optional analytics run only if you accept them in the cookie controls. This notice explains our handling of information, including sensitive personal data where applicable under Indian law.

Who is responsible for your data?

MEDIKARYA TECHNOLOGIES PRIVATE LIMITED (CIN U58202HR2026PTC146060), the company operating MediKarya ("MediKarya", "we", "us"), is responsible for personal data described here. Registered office: V-214, Second Floor, Gandhi Colony, Faridabad, Haryana 121001, India. Website: medikarya.in. Grievance Officer: Abhishek Singh, Founder, abhishek@medikarya.in · +91 97116 38511. Privacy and data requests: privacy@medikarya.in. Consumer complaints: contact@medikarya.in or +91 87965 02901.

What we collect, and why

Account and profile: name, email address, account identifier, profile details you provide, and a record of the legal notice version and your acceptance time. Clerk processes sign-in and account security (including passwords, which we do not receive in readable form); we use account information to create and operate your account, provide support, and associate your learning records with you. Sign-up acceptance metadata is held with your Clerk account; first-case notice acceptance is saved in your browser.
Learning and simulation: case starts, case identifiers, your questions and conversation history for the current AI interaction, selections, investigation orders, submitted answers, scores, feedback, quiz results, and progress. We use these to run the simulation, generate feedback and quizzes, show your learning history, and maintain service integrity. Conversation history is sent to Google Gemini to generate responses; the chat API does not persist the conversation on our servers, but in-progress chat and case actions are stored in your browser so you can resume. Your submitted answers and learning results may be saved to your account. Guest attempts use a random browser identifier and may store attempt results so we can provide the case and its debrief.
Payments and plans: plan, subscription and transaction references, payment status, and billing period. Razorpay receives checkout details (including the email and name prefilled from your account) and processes payment credentials; we receive payment and subscription status and identifiers. We do not store full card or UPI credentials.
Messages and contributions: name, email, institution, designation, specialty, phone/WhatsApp number, message, feedback, case reports, and case or review content you submit through our forms or Case Studio, along with form-consent records. Contact forms are delivered by Formspree. Do not submit identifiable patient information or other people’s sensitive data.
Attribution and certificates: if you contribute or review a case, or receive a certificate, your chosen/public display name, attribution, certificate identifier, title, issue date and verification status may appear on the public site so the work or credential can be credited and verified. We show a reviewer’s name only where the reviewer has chosen to be named.
Technical and security data: IP address and request metadata used for rate limits and abuse prevention, essential authentication/session cookies, and basic server logs. If you accept analytics, Microsoft Clarity may collect interaction/session analytics and Vercel Speed Insights may collect performance metrics. If you use voice input, your browser’s speech-recognition service processes the audio or transcript under that provider’s terms.
Device preferences: theme, tutorial progress, first-case notice acceptance and other interface preferences may be stored in your browser’s local storage. In-progress simulation chat and case actions are also stored there so you can resume; clear the site’s browser storage to remove them.

Purposes and legal basis

We process data to provide the service you request, operate accounts and subscriptions, personalise learning, respond to support requests, protect the service, meet legal obligations, and improve the platform. Optional analytics are processed only after you choose “Accept analytics”; you can withdraw that choice using Cookie settings. Where consent is required by applicable law, we will seek it before the relevant processing and provide a way to withdraw it. You can still use the core service if you decline optional analytics.

AI processing

When you use AI patient conversations, evaluations or generated quizzes, the relevant message, conversation context, case content, submitted answers and/or learning feedback are sent to Google Gemini through its API to generate the requested educational response. We may use Google Gemini or Anthropic Claude for internal case drafting and conversion by authorised staff. Do not enter real patient identifiers, clinical records, or confidential information in the product or contributions. AI outputs can be inaccurate and are for education only. We do not use your personal account data to train our own general-purpose AI models.

Who receives data

We use service providers to host and operate the platform: Clerk (authentication), Supabase (database), Google (AI generation), Anthropic (internal AI-assisted case work), Razorpay (payments), Formspree (contact forms), Vercel (hosting and, if enabled, performance analytics), and Microsoft (Clarity analytics, only when accepted). Razorpay checkout and links you choose to open, such as WhatsApp, connect your browser to those providers. They process information for the relevant service purpose under their own terms and privacy practices. We may also disclose information where required by law, to protect users or the service, or as part of a business reorganisation. We do not sell personal data or share it with third parties for their own advertising.

Retention

We retain account and learning records while your account is active and as needed to provide the service. Payment, tax, security, and dispute records may be retained for the periods required by law or to resolve claims. Messages are retained while needed to respond and maintain relevant business records. You may request erasure; some information may need to be retained where law requires it or for legitimate security and dispute purposes. Optional browser storage can be cleared through your browser settings.

Security and incidents

We use access controls and technical and organisational safeguards intended to protect personal data. No online service can promise absolute security. If a personal data breach affecting you occurs, we will take steps required by applicable law, including notifying affected people and authorities where required.

Your choices and requests

You may ask us to confirm whether we process your personal data, review or correct it, request erasure, withdraw consent where processing relies on consent, or raise a grievance. Email privacy@medikarya.in from your account email and describe your request; we may ask for reasonable information to verify your identity. Include “Privacy request” in the subject. You may request account closure and erasure through this same channel. We will address privacy grievances within one month and other requests within the time required by applicable law. You may nominate another person to exercise your rights where the law allows.

If you are not satisfied with our response, you may use the complaint route made available by the Data Protection Board of India under applicable law. This page and our contact details are the channels to exercise rights and raise a grievance.

Children

MediKarya is intended for adults aged 18 and above. We do not knowingly invite children to create accounts. If you believe a child has provided personal data, contact us so we can review and take appropriate action.

International processing

Our service providers may process or store information in locations outside your state or country. We use service providers to deliver the functions described above, and will apply the transfer and protection requirements that Indian law imposes on the information involved. Contact us if you need more information about a particular provider or transfer.

Changes and contact

We will post changes on this page and update the date above. Material changes will be communicated through the service or by email where appropriate. Questions or privacy requests: privacy@medikarya.in. See our Cookie Policy and controls.

Who is responsible for your data?

What we collect, and why

Account and profile: name, email address, account identifier, profile details you provide, and a record of the legal notice version and your acceptance time. Clerk processes sign-in and account security (including passwords, which we do not receive in readable form); we use account information to create and operate your account, provide support, and associate your learning records with you. Sign-up acceptance metadata is held with your Clerk account; first-case notice acceptance is saved in your browser.

Learning and simulation: case starts, case identifiers, your questions and conversation history for the current AI interaction, selections, investigation orders, submitted answers, scores, feedback, quiz results, and progress. We use these to run the simulation, generate feedback and quizzes, show your learning history, and maintain service integrity. Conversation history is sent to Google Gemini to generate responses; the chat API does not persist the conversation on our servers, but in-progress chat and case actions are stored in your browser so you can resume. Your submitted answers and learning results may be saved to your account. Guest attempts use a random browser identifier and may store attempt results so we can provide the case and its debrief.

Payments and plans: plan, subscription and transaction references, payment status, and billing period. Razorpay receives checkout details (including the email and name prefilled from your account) and processes payment credentials; we receive payment and subscription status and identifiers. We do not store full card or UPI credentials.

Messages and contributions: name, email, institution, designation, specialty, phone/WhatsApp number, message, feedback, case reports, and case or review content you submit through our forms or Case Studio, along with form-consent records. Contact forms are delivered by Formspree. Do not submit identifiable patient information or other people’s sensitive data.

Attribution and certificates: if you contribute or review a case, or receive a certificate, your chosen/public display name, attribution, certificate identifier, title, issue date and verification status may appear on the public site so the work or credential can be credited and verified. We show a reviewer’s name only where the reviewer has chosen to be named.

Technical and security data: IP address and request metadata used for rate limits and abuse prevention, essential authentication/session cookies, and basic server logs. If you accept analytics, Microsoft Clarity may collect interaction/session analytics and Vercel Speed Insights may collect performance metrics. If you use voice input, your browser’s speech-recognition service processes the audio or transcript under that provider’s terms.

Device preferences: theme, tutorial progress, first-case notice acceptance and other interface preferences may be stored in your browser’s local storage. In-progress simulation chat and case actions are also stored there so you can resume; clear the site’s browser storage to remove them.