CIN: U73100WB2026PTC276243 | UDYAM: WB-13-0148760 | Effective Date: 20 May 2026 | Version 5.0
Last Updated: 02 September 2026
FlashMed™ is a product of Flashverse Labs Private Limited
Compliant with: Information Technology Act, 2000 | Digital Personal Data Protection Act, 2023 | Google Play Developer Policies
• FlashMed™ is a product and registered trademark of Flashverse Labs Private Limited, a company incorporated under the Companies Act, 2013, with CIN: U73100WB2026PTC276243 and UDYAM Registration No. WB-13-0148760. FlashMed™ operates exclusively as a technology aggregator and connector platform under Section 79 of the Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• FLASHMED™ IS NOT AN E-PHARMACY. FlashMed™ does not hold any drug licence. All medicines are sold, stocked, and dispensed exclusively by independent licensed Pharmacy Partners. FlashMed™ merely provides a technology platform for customers to discover and connect with such pharmacies.
• Registered Office: 12 Md Asfaque Akhtar, New Dakbanglow Bus Stand, Dhuliyan, Murshidabad, West Bengal — 742202, India.
• Contact for Privacy Matters: support@flashmed.in
• 2.1 Identity Data: Full name (collected at registration), date of birth, gender.
• 2.2 Contact Data: Mobile number (mandatory, used as your unique account identifier), email address (optional), delivery address, billing address.
• 2.3 Authentication Data: We use One-Time Password (OTP) verification via SMS for all login and registration. No passwords are created or stored by users. OTPs are temporary (valid 10 minutes), stored as bcrypt hashes, and immediately invalidated after use.
• 2.4 Health Data: Prescription images (uploaded solely for the Pharmacy Partner's verification), product order history, blood type (voluntary, for Blood SOS), known allergies (voluntary).
• 2.5 Location Data: Real‑time GPS with explicit consent, used only for delivery coordination and proximity‑based Blood SOS alerts. Approximate location (city name only) may be sent as anonymous context to Doczy AI. Precise GPS coordinates are never sent to any AI service.
• 2.6 Payment Data: Transaction references, UPI IDs, payment tokens. We NEVER store full card numbers, CVV, expiry, or banking passwords. All payment processing is handled by Cashfree Payments, an RBI‑authorised PCI‑DSS compliant aggregator.
• 2.7 Device Data: Device ID, OS version, app version, push notification token, crash logs – for technical support and performance improvement only.
• 2.8 AI Feature Data — Search (DeepSeek via FlashMed Backend): When you use the FlashMed Search feature, your typed or voice-converted search query text (maximum 200 characters) is sent to the FlashMed backend, which forwards it to the DeepSeek AI API to understand the intent of your query and expand search terms. Only the query text itself is sent. Your name, mobile number, address, account details, prescription images, medical history, and payment information are never sent to DeepSeek. The DeepSeek API key is held securely on the FlashMed backend server — it is never included in the app's code or binary.
• 2.9 AI Feature Data — Doczy (DeepSeek via FlashMed Backend):Doczy is FlashMed's AI health guide that helps you describe symptoms and find the right medical specialist. When you use Doczy, your typed message (maximum 500 characters), the last 12 messages of your conversation session, and optionally your approximate city name and selected medical specialty category are sent to the FlashMed backend, which forwards them to the DeepSeek AI API. Your name, mobile number, Aadhaar, date of birth, prescription images, order history, payment details, and any other personally identifiable information are never sent to DeepSeek. Doczy conversation sessions are stored only on your device for 24 hours and then automatically deleted. They are not stored on FlashMed servers.
• 2.10 We explicitly DO NOT collect: Aadhaar number, PAN, biometric data, user-chosen passwords, racial/ethnic origin, religious or political beliefs, sexual orientation, or any data unnecessary for the described services.
• What is DeepSeek? DeepSeek is a third-party Artificial Intelligence (AI) / Large Language Model (LLM) service provided by DeepSeek AI (deepseek.com). FlashMed™ uses the DeepSeek API exclusively through a secure server-side proxy at api.flashmed.in. The DeepSeek API key is stored only in Railway environment variables on the FlashMed backend server — it is never present in the app binary, source code, or client device, and cannot be extracted by decompiling the APK.
• Specific Use 1 — AI-Powered Search Intent (Search Feature):
• What DeepSeek receives: Only the raw text of your search query (max 200 characters). Nothing else.
• What DeepSeek does: Interprets natural language and multilingual queries (Hindi/Bengali/English), expands your query into related search terms, and identifies the most relevant medical service category.
• Example: A search for "khansee ki dawa" (cough medicine in Hindi) is understood and routed to pharmacy results.
• When it runs: Only for search queries of 4 or more characters. Results are cached on your device for 24 hours and on the FlashMed backend (Redis) for 24 hours — so the same query is never sent to DeepSeek twice within 24 hours.
• Fallback: If DeepSeek is unavailable or slow (over 5 seconds), search works normally without AI.
• Specific Use 2 — Doczy AI Health Guide (Doctor Booking Feature):
• What DeepSeek receives: Your typed message (max 500 chars), up to 12 prior messages from the current session, and optionally your city name and medical specialty you are browsing.
• What Doczy does: Understands your described symptoms and responds with guidance on which type of medical specialist to consult. It then triggers an in-app search to show you available doctors.
• What Doczy does NOT do: Diagnose conditions, prescribe medicines, or provide treatment instructions. FlashMed's backend actively scans every Doczy response and removes any content containing diagnoses, prescriptions, or medicine names before showing it to you.
• Rate limits: Maximum 10 Doczy messages per hour and 30 per day per user account, enforced both on your device and on the FlashMed server (Redis-backed). This prevents abuse and controls AI costs.
• Session data: Doczy conversation history is stored only on your device for 24 hours, then auto-deleted. It is not saved on FlashMed servers or shared with anyone.
• Security Architecture — DeepSeek Integration:
• The DeepSeek API key is NEVER in the app — zero risk from APK decompilation.
• All calls to DeepSeek pass through api.flashmed.in (FlashMed's backend), which authenticates each request with the user's JWT token.
• Each AI request carries a unique X-Request-ID for server-side tracing — supporting accountability even at millions of concurrent users.
• Your personal data (name, phone, address, prescriptions) is stripped before any data is forwarded to DeepSeek.
• Exponential backoff with jitter is used for retries — preventing thundering herd under load.
• CRITICAL DISCLAIMER — DeepSeek / Doczy AI IS NOT A DOCTOR: All responses from Doczy are for general informational purposes only and help guide you to the right type of medical specialist. They do NOT constitute medical advice, diagnosis, treatment recommendations, or prescription guidance of any kind. Always consult a qualified, licensed medical professional before making any healthcare or medication decision. FlashMed™ and DeepSeek AI expressly disclaim all liability for any harm arising from reliance on AI-generated content.
• No Automated Medical Decisions: Neither Doczy nor the AI-powered search make any automated final decisions about your healthcare, access to medicines, or your legal rights. All such decisions require a licensed human professional (doctor or pharmacist).
• Your Control Over AI Features:
(a) You may choose not to use the Search AI or Doczy — all core Platform services function fully without AI.
(b) To request deletion of AI session data from your device, clear app data from your device settings.
(c) To report any harmful or incorrect Doczy response, email support@flashmed.in with subject "Doczy Report — [Your Phone Number]".
• Children and AI: AI-powered features (Search AI and Doczy) are strictly not available to users under 18 years of age. We do not use AI to process data of minors.
• DeepSeek's Own Privacy Policy:Data forwarded to DeepSeek is subject to DeepSeek AI's privacy policy (available at deepseek.com). FlashMed™ does not share your personally identifiable information with DeepSeek. Only anonymised query text and conversation context, as described above, is forwarded.
• 3.1 Order Fulfillment: To transmit your order and prescription to licensed Pharmacy Partners, coordinate delivery, and process payments.
• 3.2 Blood SOS Alerts: To send time‑bound alerts to voluntary donors within a 5‑km radius. Location data is used only during the SOS event and not retained beyond its duration.
• 3.3 Customer Support: To resolve grievances, process refunds, and investigate disputes.
• 3.4 Safety & Compliance: To prevent fraud, detect fake prescriptions, comply with legal obligations (including lawful government requests under the Code of Criminal Procedure, 1973), and enforce our Terms.
• 3.5 AI Feature Delivery — Search: To forward your search query text to DeepSeek AI (via our secure backend proxy) to expand search results and improve search relevance. Your identity is never forwarded.
• 3.6 AI Feature Delivery — Doczy: To forward your Doczy message and anonymous session context to DeepSeek AI (via our secure backend proxy) to generate a response guiding you to the right medical specialist. Your identity is never forwarded.
• 3.7 ABSOLUTE PROHIBITION ON SALE OF DATA: We will never sell, rent, trade, or monetise your personal data or AI interaction data to any third party for any commercial purpose.
• 4.1 All personal datais stored exclusively on servers located within India, in compliance with the DPDP Act, 2023, and RBI's data localisation directives.
• 4.2 Primary storage: User data, order records, and transaction history are stored in encrypted PostgreSQL databases hosted on cloud infrastructure within India. Firebase (asia‑south1 / Mumbai region) is used for real-time communication, push notifications, and authentication only. Prescription images are stored on Cloudinary (India region). All data is encrypted at rest using AES‑256 and in transit using TLS 1.3.
Authentication Note: FlashMed uses SMS OTP-based authentication exclusively. No user-chosen passwords are created or stored. OTPs are hashed with bcrypt and invalidated immediately after use or after 10 minutes.
• 4.3 Data Retention Schedule:
• Order data: 7 years (statutory requirement)
• Account data: Until deletion request is processed
• OTP records: Invalidated and deleted within 10 minutes of issuance (or immediately upon use)
• Location data: Deleted within 24 hours of order completion/SOS closure
• Prescription images: Deleted 90 days after order completion, unless needed for dispute resolution
• Doczy conversation sessions: Stored on device only, auto-deleted after 24 hours
• Search AI query cache: Stored on device, expires after 24 hours; backend Redis cache expires after 24 hours
• Crash logs: 90 days
• 4.4 Cross‑border transfer — AI: Search query text and Doczy conversation context are forwarded to DeepSeek AI servers, which may be located outside India, solely to generate AI responses. This cross-border transfer involves only anonymised, non-personally-identifiable query text and conversation context. No personal data (name, phone, address, health records, prescriptions) is transferred cross-border. This transfer is necessary for the AI features to function and is conducted with appropriate contractual safeguards.
• 5.1 Pharmacy Partners: Name, delivery address, prescription image, contact number – solely for order fulfilment. They are contractually bound to use this data only for that purpose.
• 5.2 Delivery Partners: Name, address, contact number – only for the specific delivery. They are prohibited from retaining or reusing this data.
• 5.3 Lab Partners: Name, contact, address (for home collection), test requirements – for the booked service only.
• 5.4 Payment Processors (Cashfree): Only payment amount and transaction metadata; never prescription or health data.
• 5.5 DeepSeek AI (via FlashMed Backend Proxy): Only anonymised query text (Search) or conversation message text and anonymous context (Doczy), as described in Section 2A. No personally identifiable information — no name, no mobile number, no address, no prescription images, no health records — is shared with DeepSeek. The FlashMed backend acts as a strict data gatekeeper between your device and DeepSeek.
• 5.6 Government Authorities: Disclosure only when required by a legally valid order under Indian law.
• 5.7 No commercial disclosure: Prescriptions, health history, blood type, medical information, or AI interaction data will never be shared with third‑party marketers.
• As a data principal under the Digital Personal Data Protection Act, 2023, you have the right to:
• 6.1 Access – Obtain a copy of your personal data held by FlashMed™.
• 6.2 Correction – Correct inaccurate or misleading data.
• 6.3 Erasure – Request deletion of your personal data (subject to statutory retention requirements).
• 6.4 Grievance Redressal – File a complaint with our Grievance Officer.
• 6.5 Nomination – Nominate an individual to exercise rights on your behalf.
• 6.6 Opt-Out of AI Features – You may choose not to use the AI Search or Doczy features at any time. Core Platform services remain fully available without AI. To clear Doczy session data from your device, clear the app's storage from your device settings.
• 6.7 How to exercise: Email support@flashmed.in with subject "DPDP Rights Request – [Your Phone Number]". We will respond within 30 days.
• FlashMed services are not directed at persons under 18. If we inadvertently collect data from a minor, we will delete it within 72 hours of discovery. AI-powered features (Search AI and Doczy) are strictly not available to users under 18.
• Our app does not use traditional cookies. We use Firebase Analytics for anonymised, aggregated usage statistics — you can disable analytics tracking in your device settings. Doczy conversation sessions and Search AI query results are cached on your device using AsyncStorage (not cookies) and auto-expire within 24 hours.
• In case of a personal data breach, we will notify the Data Protection Board of India and all affected users within 72 hours, as required by Rule 9 of the DPDP Rules, 2025.
• Name: Nahid Hasan
• Designation: Director, Chairman & CEO, Flashverse Labs Private Limited
• Email: support@flashmed.in
• Phone: +91 9144150105
• Address: 12 Md Asfaque Akhtar, New Dakbanglow Bus Stand, Dhuliyan, Murshidabad, West Bengal — 742202
• Response Time: Acknowledgment within 24 hours; resolution aimed within 7 days.
• We may update this Privacy Policy from time to time. Material changes (including changes to how AI features process data, or changes in third-party AI providers such as DeepSeek) will be notified via in-app notification at least 7 days before they take effect. The latest version is always available at flashmed.in/privacy-policy.