Privacy, Security & Consent Policy

This policy applies to MedZoa (medex.base44.app) — the personal health assistant platform for patients, families, and healthcare providers — and to this public website.

MedZoa is operated in India by Zoa Zone Services Pvt Ltd, 376, G3, Road No 82, Film Nagar, Jubilee Hills, Hyderabad, Telangana 500096, India. Global operations for customers outside India are handled by Zoa Zone Services LLC, 1770 Grand Concourse 12A, Bronx, NY 10457, USA. The data controller for your account is the entity you contracted with at sign-up (see our Terms & Conditions).

This policy applies to all visitors, registered users, and business account holders who interact with MedZoa. By creating an account or using the service, you agree to this policy.

We collect the minimum data necessary to operate our services. Here's what we collect and why:

2.1 Account & Identity Data

2.2 Platform Usage Data

2.3 Communications Data

2.4 Health Data (MedZoa only)

⚕️ Health-related data processed through MedZoa is treated as PHI (Protected Health Information) under HIPAA. See Section 10 for full details.

3.1 How We Collect Consent

• ✓At account registration, via clearly labeled checkboxes for each communication channel (SMS, WhatsApp, Email).
• ✓Consent is not pre-checked and is not a condition of using core services.
• ✓Transactional messages (OTPs, billing alerts, security notices) require consent as part of service enrollment.
• ✓Marketing messages require separate, explicit opt-in.
• ✓We log the timestamp, IP address, and method of consent for every user.

3.2 Types of Messages We Send

3.3 How to Opt Out

You may also manage all notification preferences in your account Settings → Notifications, or by emailing care@zoazoneservices.com.

MedZoa sends application-to-person (A2P) SMS messages through registered US carriers in compliance with A2P 10DLC (10-Digit Long Code) regulations enforced by The Campaign Registry (TCR) and US wireless carriers.

4.1 Our A2P Commitments

• ✓ All SMS campaigns are registered with The Campaign Registry (TCR) with declared use cases.
• ✓ We identify our brand name clearly in every message (e.g., 'MedZoa:').
• ✓ Message content is pre-approved and consistent with the registered campaign use case.
• ✓ We maintain a valid opt-out mechanism in EVERY message we send.
• ✓ We do not send messages between 9:00 PM and 8:00 AM local recipient time.
• ✓ We maintain consent records for a minimum of 5 years.
• ✓ We do not share or sell phone numbers to third-party marketers.

4.2 TCPA Compliance

Under the Telephone Consumer Protection Act (TCPA):

• ✓ We obtain prior express written consent before sending marketing SMS messages.
• ✓ We honor STOP requests immediately and keep suppression lists indefinitely.
• ✓ Our AI phone agents identify themselves as automated systems at the start of every call.
• ✓ We do not use auto-dialers to contact individuals who have not consented to receive calls.
• ✓ For healthcare-related calls via MedZoa, we follow additional FCC exemptions and HIPAA guidelines.

4.3 For Business Operators Using MedZoa

MedZoa sends WhatsApp messages through the official WhatsApp Business API (Meta) and complies with WhatsApp's Business Messaging Policy and Commerce Policy.

5.1 WhatsApp Consent Rules

• ✓ You must explicitly opt in to receive WhatsApp messages from MedZoa.
• ✓ Opt-in is collected through our registration form or account settings — never assumed.
• ✓ We clearly state the types of messages you will receive at the time of opt-in.
• ✓ We include our business name in every WhatsApp message.
• ✓ You may opt out at any time by messaging 'STOP' or through your account settings.
• ✓ We do not send promotional WhatsApp messages without a prior opt-in.
• ✓ We only use approved WhatsApp Message Templates for regulated message categories.

5.2 WhatsApp Message Types We Use

MedZoa does not use WhatsApp for spam, bulk cold outreach, or sharing user data with Meta beyond what is required for message delivery.

All email communications from MedZoa comply with CAN-SPAM Act (US), CASL (Canada), GDPR (EU), and applicable international email marketing laws.

6.1 CAN-SPAM Compliance

• ✓ Every email clearly identifies Zoa Zone Services Pvt Ltd as the sender.
• ✓ Subject lines are never deceptive or misleading.
• ✓ Every marketing email includes a physical postal address.
• ✓ Every marketing email includes a clear, working unsubscribe link.
• ✓ Unsubscribe requests are honored within 10 business days.
• ✓ We do not use purchased email lists.

6.2 Transactional vs. Marketing Emails

Transactional emails (OTPs, billing receipts, security alerts, account notices) are sent based on your service enrollment. These cannot be fully opted out of while your account is active — they are essential to service delivery and account security.

Marketing emails require a separate opt-in and can be unsubscribed from at any time without affecting your account access.

We implement industry-standard security controls to protect your data:

7.1 Reporting a Security Issue

If you discover a security vulnerability, please report it responsibly to care@zoazoneservices.com. We commit to acknowledging your report within 48 hours and providing a remediation timeline within 7 business days. We do not pursue legal action against good-faith security researchers.

Depending on your location, you have the following rights regarding your personal data:

We respond to all verified requests within 30 days. Complex requests may be extended by an additional 60 days with notice. Identity verification may be required before processing sensitive requests.

8.1 California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We do not sell or share personal information for cross-context behavioral advertising. You may submit a request to know, delete, or correct your data by emailing care@zoazoneservices.com.

8.2 EU / UK Residents (GDPR / UK GDPR)

EU and UK residents may lodge a complaint with their local supervisory authority if they believe their data rights have been violated. Our Data Protection Officer can be contacted at care@zoazoneservices.com.

Upon account deletion, we anonymize or delete personal data within 30 days, except where retention is required by law. Anonymized, aggregated data may be retained indefinitely for platform analytics.

For users in India, we process personal data in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act):

• ✓ We collect personal data only for a lawful purpose, with your informed consent or notice, or where processing is necessary for the service you have asked for.
• ✓ We collect only the data that is necessary — data minimisation by design.
• ✓ You may access, correct, complete, or erase your personal data, withdraw consent, and nominate another individual to exercise your rights if you are unable to.
• ✓ We take reasonable security safeguards to prevent personal data breaches and will notify affected users and the Data Protection Board as required by law.
• ✓ We do not process personal data in a manner likely to cause harm to a child, except as permitted by the DPDP Act.
• ✓ Upon request or withdrawal of consent, we cease processing and erase your data unless retention is required by law (see Data Retention above).

Under the IT Rules, 2021, grievances of users in India are handled by our Grievance Officer:

Data-related requests under the DPDP Act 2023 are honoured through the same contact.

• ✓ MedZoa enters into a Business Associate Agreement (BAA) with all covered entities using MedZoa.
• ✓ PHI is encrypted at rest (AES-256) and in transit (TLS 1.3).
• ✓ Access to PHI is strictly role-based and logged in immutable audit trails.
• ✓ PHI is never used to train AI models without explicit authorization.
• ✓ Call recording PHI redaction is available and enabled by default for healthcare accounts.
• ✓ Transcript PHI redaction removes names, SSNs, dates of birth, and other identifiers.
• ✓ Data is retained for a minimum of 6 years per HIPAA requirements.
• ✓ Breach notification is provided within 60 days of discovery per HIPAA Breach Notification Rule.
• ✓ De-identification of health data follows the HIPAA Safe Harbor method.
• ✓ HIPAA training is completed by all staff with access to PHI systems.

MedZoa services are intended for use by businesses and individuals aged 18 and older. We do not knowingly collect personal information from individuals under 18 years of age. If you believe a minor has provided us with personal information, please contact care@zoazoneservices.com and we will delete it promptly.

We may update this policy periodically to reflect changes in our practices, technologies, or legal obligations. When we make material changes, we will:

• • Post the updated policy on this page with a new effective date.
• • Send an email notification to all registered account holders.
• • Display an in-app banner for 30 days after the update.
• • For material changes affecting messaging consent, we will re-collect your explicit consent.

Continued use of our services after the effective date of any updates constitutes acceptance of the revised policy.

We aim to respond to all inquiries within 5 business days. Data subject requests are handled within 30 days as required by applicable law.