Privacy Policy

Last updated: 26 June 2026

On this page:
Who we are Data we collect How we use it Consent & legal basis Storage & security Sharing Retention Your rights Contact

MedFactory ("MedFactory", "we", "us") provides software that helps factory Occupational Health Centres (OHCs) and their medical, safety and HR staff maintain statutory occupational-health records under the Factories Act, 1948 and allied rules. This policy explains what personal data we process, why, and the rights available to you under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the SPDI Rules, 2011.

1. Who we are

MedFactory is an independent goodwill initiative for Factory Medical Officers, built and maintained by practising occupational-health doctors. For the personal data of workers and employees entered into the platform by an OHC, the employing factory/occupier is the Data Fiduciary and MedFactory acts as a Data Processor on its behalf. For your own account data, MedFactory is the Data Fiduciary.

2. Data we collect

Account data (about you, the app user)

Mobile number (used as your login identity and for OTP verification)
Name, professional role/designation, department and (optionally) profile photo
A securely hashed PIN, and an optional recovery email

Occupational-health & employee data (entered by OHC staff)

Worker identity details (name, ID, department, contractor)
Medical examination, fitness, investigation, injury, sickness and related clinical records — this is health data / sensitive personal data
Attendance, roster and OHC operational records

Technical data

Basic device/browser information and app logs needed to operate and secure the service. We do not use third-party advertising trackers.

3. How we use your data

To provide the OHC record-keeping service and statutory registers/forms you create
To authenticate you and keep your account and records secure
To meet the factory's legal obligations under the Factories Act and allied health/safety laws
To respond to your requests and grievances

We do not sell your personal data, and we do not use clinical records for advertising or profiling.

4. Consent & legal basis

You provide consent at first sign-in (recorded with a consent version) under S.6 of the DPDP Act. Worker health data is processed for the factory's legal compliance and on the basis of the worker's clinical consent recorded by the OHC. You may withdraw consent at any time (see Your rights); withdrawal does not affect processing already carried out, nor records the law independently requires us to retain.

5. Storage & security

Data is stored on servers located in Mumbai, India (ap-south-1), protected in transit by TLS and encrypted at rest by the cloud provider. Some data is cached on your own device to let the app work offline; it stays on that device. We apply reasonable security practices as required under S.8 of the DPDP Act and the SPDI Rules. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

With sub-processors that host and operate the service, bound by confidentiality and processing terms
Where required by law, court order, or a lawful request by a public authority
A worker's clinical records are not disclosed to the employer beyond what the OHC and statutory forms require, and not to third parties without lawful basis or consent

7. How long we keep data

Statutory medical and health records are retained for the period the law requires — under the Factories Act and allied rules this can be up to 30 years. Non-statutory personal data is deleted within 30 days of a valid erasure request or when no longer needed. Account data is kept while your account is active.

8. Your rights (DPDP Act, 2023)

Access (S.11): obtain a summary of the personal data we process about you
Correction & erasure (S.12): correct, complete, update or erase your personal data, subject to statutory retention
Grievance redressal (S.13): a readily available means to raise grievances (below)
Nominate (S.14): nominate another person to exercise your rights in the event of death or incapacity
Withdraw consent (S.6): withdraw consent as easily as it was given

You can exercise most rights inside the app under Settings → Privacy & Data, or by contacting the Grievance Officer below.

Factory records vs. your personal data. Employee and occupational-health records belong to the factory, which is their Data Fiduciary; MedFactory only digitises records the factory is legally required to keep. An individual user (such as an FMO or an employee) cannot delete factory records — their removal requires a request on the factory's letterhead together with an official email from the requester's reporting manager. You may, however, delete the personal data you added about yourself at any time.

9. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines) Rules, 2021:

Designation: Grievance Officer, MedFactory
Email: reach@medfactory.in
WhatsApp: +91 9811 222 496

We will acknowledge a grievance within 24 hours and endeavour to resolve it within 15 days of receipt.

10. Children

The platform is intended for use by OHC/medical, safety and HR professionals. We do not knowingly process the personal data of children (under 18) as app users without verifiable parental/guardian consent as required by S.9 of the DPDP Act.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email, and the "Last updated" date above will change.

12. Contact

Questions about this policy or your data? Email reach@medfactory.in or message us on WhatsApp at +91 9811 222 496.