Privacy Policy

Pomegranate Health India LLP is a technology-enabled wellness and telehealth facilitation platform that connects users with qualified, independent Registered Medical Practitioners (“RMPs”), wellness experts and allied service providers.

Pomegranate Health India LLP is not a healthcare provider and does not itself practise medicine. Medical consultations, clinical assessments, diagnoses, and prescriptions are solely made by independent RMPs duly registered under the National Medical Commission Act, 2020 and applicable State Medical Council regulations. The Platform merely facilitates access to such professionals.

Pomegranate Health India LLP does not manufacture, stock, dispense, advertise or directly sell prescription drugs or medicines to consumers. Any medicines dispensed pursuant to RMP prescriptions are fulfilled through duly licensed third-party pharmacies and distributors under the Drugs and Cosmetics Act, 1940.

We may collect the following categories of information when you use the Platform:

a) Personal Information

• Full name
• Age and gender
• Phone number and email address
• Residential address and PIN code
• Government-issued identification, only if required by law or for identity verification, and only after we tell you

b) Health & Wellness Information (Sensitive Personal Data)

The following constitutes Sensitive Personal Data or Information (“SPDI”) under the IT Rules, 2011 and Digital Personal Data under the DPDPA, 2023, and is collected and processed only with your explicit written or digital consent:

• Medical history, existing conditions and current medications
• Lifestyle information, dietary habits and wellness goals
• Height, weight, BMI and fitness-related data
• Consultation records and clinical notes generated by empanelled RMPs
• Diagnostic test reports, laboratory results and imaging reports
• Prescriptions issued by RMPs through the Platform
• Responses to health assessments and wellness questionnaires
• Data from integrated devices such as smart scales, continuous glucose monitors or wearables, only where you have authorised such integration

c) Technical Information

• IP address and geographic location (city/state level only, not precise GPS)
• Browser type and version
• Device type, operating system and device identifier
• Cookies and session tokens needed to keep you logged in
• Basic usage logs needed to run and secure the Platform

d) Payment Information

Payments are processed through third-party RBI-regulated payment aggregators or payment gateways. Pomegranate Health India LLP does not store complete card details, net banking credentials, UPI PINs, or other financial authentication information on its servers. Only transaction reference identifiers are retained for reconciliation and grievance purposes.

e) Communication Records

Records of your communications with the Platform's support team via email, WhatsApp Business, or in-app messaging may be retained for service delivery, grievance resolution, and quality assurance purposes.

f) RMP-Specific Information

For Registered Medical Practitioners empanelled on the Platform, we additionally collect:

• NMC / State Medical Council registration number and certificate
• Qualification and specialisation details
• Bank account details for disbursement of consultation fees
• Professional identity verification documents

Your information is collected and used solely for the following purposes, each of which constitutes a lawful processing purpose under applicable Indian law. We obtain consent separately for core service purposes and optional purposes (such as marketing), as described in Section 4.

• Facilitating teleconsultations between users and independent RMPs in compliance with the Telemedicine Practice Guidelines, 2020;
• Scheduling and managing appointments, consultations and follow-up sessions;
• Enabling generation, storage and retrieval of prescriptions and consultation records as required under TPG 2020;
• Routing prescriptions to licensed third-party pharmacies for medicine fulfilment, where the user has consented;
• Processing subscription fees, consultation charges and wellness programme payments;
• Improving Platform user experience, functionality and service delivery;
• Compliance with applicable Indian laws, medical regulations, and directions from regulatory authorities;
• Customer support, grievance handling and dispute resolution;
• Fraud prevention, platform security and abuse monitoring;
• Running and improving the Platform (using de-identified data where we can); and
• With your separate and explicit opt-in consent only: communication of promotional content, wellness initiatives or new service offerings via SMS, email, WhatsApp or in-app notification.

In accordance with the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025, and the IT (SPDI) Rules, 2011, we rely on your free, informed, specific, and unambiguous consent as the primary basis for collection and processing of your personal data and sensitive personal data.

4.1 How Consent is Obtained

Consent is obtained through the Platform at registration and when you use a Service. Consent requests are presented in English, in plain language. Each consent mechanism will:

• Be presented in plain language;
• Explain the main categories of data being collected and why;
• Identify the main third parties with whom data may be shared;
• Distinguish between core service use and optional marketing; and
• Inform you that you may withdraw consent by writing to info@joinpomegranate.in.

4.2 Withdrawal of Consent

You may withdraw your consent at any time by writing to:

• Email: info@joinpomegranate.in

Withdrawal of consent does not affect processing already carried out. If you withdraw consent for health data, we may not be able to continue providing consultation services. Some data may be kept where required by law, medical record-keeping rules, or to resolve a dispute.

We do not sell, rent, trade or otherwise transfer your personal data to third parties for commercial purposes. We may share your information only in the following circumstances and only to the extent necessary:

5.1 With Independent RMPs

Health and wellness information relevant to your consultation will be shared with the RMP conducting your session. All RMPs empanelled on the Platform are bound by professional confidentiality obligations under the NMC Code of Ethics and by written data confidentiality obligations with Pomegranate Health India LLP.

5.2 With Diagnostic Laboratories

Where an RMP orders diagnostic tests, your relevant details will be shared with the user-selected or Platform-partnered licensed diagnostic laboratory solely for the purpose of conducting such tests and returning results.

5.3 With Licensed Pharmacies and Distributors

Where you consent to medicine fulfilment, your prescription and delivery address will be shared with a duly licensed pharmacy or authorised distributor under the Drugs and Cosmetics Act, 1940. No health history beyond the prescription itself will be shared.

5.4 With Technology Service Providers

We engage third-party technology vendors (including cloud hosting providers, analytics platforms, and the Platform's electronic health record system) to support our operations. Such vendors may access personal data only to the extent necessary to perform services on our behalf and are bound by written Data Processing Agreements that prohibit independent use or further disclosure.

5.5 With Payment Gateways

Transaction data is shared with RBI-authorised payment aggregators solely for processing your payments. Such entities are governed by RBI Payment Aggregator guidelines and their own applicable privacy frameworks.

5.6 With Pomegranate Health LLC (USA) — Technology Platform Licensor

The Platform technology and digital infrastructure is operated under a technology and trademark licence from Pomegranate Health LLC, USA. We do not sell your personal data. We share only what is needed to run the Platform, as described in this Policy, and in line with applicable Indian law.

5.7 With Legal and Regulatory Authorities

We may disclose your information to courts, law enforcement agencies, regulatory bodies, or government authorities when required by applicable Indian law, court order, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Pomegranate Health India LLP, its users, or the public.

We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, misuse, loss, alteration, or unlawful disclosure. These measures include:

• Encryption of data in transit;
• Access controls so only authorised staff can see user data;
• Authentication for staff and RMP accounts;
• Monitoring of Platform access; and
• Contractual obligations on vendors who process data for us.

Notwithstanding the above, no digital platform can guarantee absolute security. In the event of a personal data breach that is likely to result in harm to users, we shall notify the Data Protection Board of India and affected users without undue delay and in the manner prescribed under the DPDPA, 2023 and DPDP Rules, 2025, including the nature of the breach, its scope, potential risks, and remedial steps taken.

The telemedicine consultation services facilitated through the Platform comply with all applicable Indian laws and guidelines, including:

• Telemedicine Practice Guidelines, 2020 issued by the National Medical Commission (“TPG 2020”);
• The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002;
• The Information Technology Act, 2000 and associated rules;
• The Drugs and Cosmetics Act, 1940 and the Drugs and Cosmetics Rules, 1945 (including Schedule H, H1 and X for prescription-only medications);
• The Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954; and
• The Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.

The following minimum compliance standards are implemented on the Platform in line with TPG 2020:

• Use of teleconsultation is subject to these Terms, the Disclaimer, and this Privacy Policy;
• The consulting RMP’s name and registration details should be available to you in connection with the consult and on prescriptions;
• Prescriptions should contain the fields required under TPG 2020; and
• Consultation records are retained as described in the Retention section.

We do not routinely record audio or video of teleconsultations. If recording is ever required by law or needed to handle a specific complaint, we will tell you before any recording starts.

The Platform uses cookies that are needed for login, session, and security. Blocking these cookies in your browser may stop the Platform from working. We do not operate a separate cookie consent manager.

The Platform may contain links to third-party websites, services, or content. Pomegranate Health India LLP is not responsible for the privacy practices, data handling, content or security of any external websites. We encourage you to review the privacy policies of any third-party sites you visit.

We retain personal data only for as long as necessary for the purposes set out in this Policy or as required by applicable law. The following minimum retention periods apply:

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the following rights with respect to your personal data. To exercise any of these rights, please write to info@joinpomegranate.in.

The Services are not directed at children below the age of 18 years. We do not knowingly collect personal data from minors without the involvement, supervision and explicit consent of a parent or lawful guardian. Where a parent or guardian registers on behalf of a minor, they represent that they have the legal authority to provide consent on the minor’s behalf and accept full responsibility for the minor’s use of the Platform.

In accordance with the DPDPA, 2023 and DPDP Rules, 2025, processing of personal data of children shall be subject to verifiable parental consent, and shall not include tracking, behavioural monitoring, or targeted advertising directed at children.

Where we process personal data relating to an individual who is a person with disability and has a lawful guardian under applicable Indian law (including, without limitation, the Rights of Persons with Disabilities Act, 2016), we will:

• Obtain verifiable consent from the lawful guardian in the manner prescribed under the DPDPA 2023 and DPDP Rules, 2025;
• Request supporting documentation evidencing the appointment of the lawful guardian (such as an order of a competent court, designated authority or local level committee); and
• Use such documentation solely for verifying authority and maintaining compliance records.

Such guardians accept full responsibility for the use of the Platform on behalf of the person with disability, and all rights available to a data principal under this Policy and the DPDPA 2023 may be exercised by the lawful guardian on their behalf.

Any communications sent to you regarding healthcare services, wellness programmes or related offerings will be strictly educational and informational in nature. In compliance with:

• The Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954;
• Rule 106 and Schedule J of the Drugs and Cosmetics Rules, 1945; and
• CDSCO guidelines and advisories,

our communications will not name, depict, or promote any specific prescription-only drug or medicine to consumers; will not represent pharmaceutical intervention as the necessary or primary solution for any scheduled condition; and will be clearly positioned as facilitating access to qualified medical care rather than promoting any specific treatment or product.

Marketing or promotional communications will only be sent where you have given a separate opt-in. You may opt out by writing to info@joinpomegranate.in.

For privacy questions, data rights requests, or complaints, contact Pomegranate Health India LLP at:

If we cannot resolve your complaint, you may escalate to the Data Protection Board of India (dpboard.gov.in).

Pomegranate Health India LLP reserves the right to update or modify this Privacy Policy at any time to reflect changes in applicable law, Platform functionality, or business practices. Updated versions shall become effective upon publication on the Platform.

For material changes — including changes to categories of data collected, purposes of processing, or third parties with whom data is shared — we will provide you with at least fifteen (15) days’ prior notice by email or prominent in-app notification before the updated Policy takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

This Privacy Policy is governed by and shall be construed in accordance with the laws of the Republic of India. Any dispute arising from or in connection with this Policy or our data processing practices shall be subject to the exclusive jurisdiction of the courts of Srinagar, J&K, India, subject to the arbitration and grievance mechanisms described herein.

This Privacy Policy is the current version and is effective from 24 October 2026.