Effective date: 2 November 2026
This policy explains how Medulla Solutions ("we", "us") collects, uses, shares and protects personal data in Medulla®, our Ayushman Bharat Digital Mission (ABDM) integrated health records application, and on this website. It applies to doctors, hospital and clinic staff, partner laboratories and pharmacies who use Medulla®, and to patients whose records are kept in Medulla®. It is written to meet the Digital Personal Data Protection Act, 2023 and the ABDM Health Data Management Policy.
1. Our role
- User accounts: for the account details of people who sign up to Medulla®, we decide how the data is used and are responsible for it.
- Patient health records: records entered by a hospital, clinic, lab or pharmacy belong to that health facility. We store and process them only on the facility's instructions to provide the Medulla® service.
2. Data we collect
- Account data: name, email address, mobile number, organisation, role, medical registration or professional ID, and identity verification status.
- Patient data entered by a facility: demographic details, ABHA number and ABHA address, visits, prescriptions, diagnoses, admissions and discharge summaries, immunizations, wellness observations, lab and pharmacy orders, and uploaded health documents.
- ABDM data: consent requests and consent artefacts, and health records received from other facilities through ABDM after the patient's consent.
- Technical data: sign-in records, audit logs of who viewed or changed a record, IP address, browser and device information.
- Website enquiries: the name, email and message you send through our contact and data deletion forms.
3. Aadhaar
When an ABHA number is created or verified with Aadhaar, the Aadhaar number and one-time password are sent directly to the National Health Authority (NHA) through ABDM. Medulla® does not store Aadhaar numbers. We keep only the ABHA number, ABHA address and the demographic details that ABDM returns.
4. How we use data
- To provide Medulla® features to your organisation, including records, prescriptions and orders.
- To create and link ABHA, and to share and fetch health records through ABDM when the patient consents.
- To keep the service secure, detect misuse and keep audit trails.
- To answer support requests and send service notices.
- To meet legal and regulatory duties.
We do not sell personal data. We do not use health records for advertising, and we do not share them for marketing.
5. ABDM and patient consent
- Health records are shared through ABDM only after the patient approves a consent request, usually in their ABHA app.
- Records received from other facilities are used only for the purpose and time period the patient approved, and are removed when that consent expires or is revoked.
- Patients can see, approve, deny and revoke consents at any time in their ABHA app.
- Health data exchanged through ABDM is encrypted end to end.
6. Who we share data with
- ABDM / National Health Authority, for ABHA creation and verification and for consented record exchange.
- Partner laboratories and pharmacies that a doctor sends an order to, limited to what the order needs.
- Service providers who host and operate Medulla® for us, such as cloud hosting and email, under confidentiality obligations.
- Authorities, when required by law or a valid legal order.
7. Storage and security
- Data is stored on servers located in India.
- Data is encrypted in transit, and access is restricted by role within each organisation.
- Access to records is logged, and administrators can review activity.
8. How long we keep data
- Account data is kept while the account is active, and deleted or anonymised after a valid deletion request, subject to the points below.
- Patient health records are kept for as long as the health facility instructs, and for at least the period that medical record laws require.
- Audit logs and records we must keep for legal, tax or dispute purposes are kept for the legally required period.
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
- tell you what personal data we hold about you and how it is used;
- correct or update inaccurate data;
- erase your data, using our data deletion request page;
- withdraw consent you have given us;
- nominate another person to exercise your rights if you die or become incapacitated.
Patients who want their clinical records corrected or deleted should first contact the hospital or clinic that created them, because the facility owns those records. You may also write to us and we will pass your request to the facility.
10. Children
Records of patients under 18 are entered by health facilities with the consent of a parent or guardian. Medulla® user accounts are only for adults acting for a health organisation.
11. Cookies
This website and Medulla® use only the cookies and browser storage needed to keep you signed in and the service working. We do not use advertising cookies.
12. Changes to this policy
We may update this policy. The effective date at the top of this page shows when it last changed. For significant changes we will notify Medulla® users by email or in the application.
13. Grievance officer and contact
For questions, complaints or to exercise your rights, contact our Grievance Officer at support@medullasolutions.in or +91 97299-29399, or use our contact form. We will acknowledge your request within 7 days and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.