Privacy Policy

1.Who We Are

This Privacy Policy explains how Bizmorphic Research Private Limited, operating the Wisemelon.ai platform ("Wisemelon", "we", "us" or "our"), collects, uses, stores, discloses and otherwise processes personal data.

Wisemelon is an AI-enabled healthcare and business automation platform providing software, communication, workflow automation, customer engagement, patient engagement, integrations, analytics and related technology services.

This Privacy Policy applies to personal data processed through our websites, applications, APIs, dashboards, software platforms, communication channels, integrations and related services, including where Wisemelon processes information on behalf of hospitals, clinics, healthcare organisations, businesses or other customers.

2.Our Role: Data Fiduciary and Data Processor

2.1 Where Wisemelon acts as a Data Fiduciary

Wisemelon acts as a Data Fiduciary where it determines the purpose and means of processing personal data for its own purposes, including, as applicable:

• creation and administration of Wisemelon accounts;
• customer onboarding;
• billing and payment administration;
• customer support;
• website operation;
• security and fraud prevention;
• product and service administration;
• communications;
• marketing and promotional activities;
• legal and regulatory compliance;
• service analytics and improvement;
• management of business contacts and prospective customers.

2.2 Where Wisemelon acts as a Data Processor

Where a hospital, clinic, healthcare organisation, enterprise or other customer determines why and how patient, employee, customer or other personal data is processed through Wisemelon, the customer generally acts as the Data Fiduciary and Wisemelon acts as its Data Processor.

In such circumstances, Wisemelon processes personal data in accordance with the customer's documented instructions, applicable contractual terms and applicable law, except where processing is required by law or otherwise independently authorised by applicable law.

The customer remains responsible for determining appropriate purposes, obtaining required permissions or consents, providing required notices, determining retention requirements and responding to Data Principal requests concerning its own data, with Wisemelon providing reasonable assistance where contractually required.

3.Personal Data We May Process

3.1 Basic and contact information

• name;
• mobile telephone number;
• email address;
• postal or residential address;
• date of birth;
• age;
• gender;
• account or customer identifiers;
• profile information;
• organisation, employment or professional information.

3.2 Healthcare and patient information

Where Wisemelon is used by a healthcare organisation, the platform may process:

• patient registration information;
• patient identifiers;
• appointment information;
• consultation information;
• clinical notes;
• medical history;
• symptoms;
• diagnosis;
• prescriptions;
• treatment information;
• laboratory reports;
• diagnostic reports;
• imaging information;
• discharge information;
• insurance information;
• hospitalisation information;
• care and recovery information;
• communications between patients and healthcare providers;
• health assessments;
• other information contained in a patient's healthcare record.

Health information is handled with enhanced confidentiality and security controls.

3.3 Health identifiers

Where enabled and lawfully required, Wisemelon may process health-related identifiers including ABHA and other healthcare identifiers. ABDM-related processing may be subject to additional consent, authentication, interoperability and data-sharing requirements applicable to the particular ABDM service or integration.

3.4 Identity and government documents

Wisemelon may process documents or information such as Aadhaar, PAN, passport, driving licence, insurance cards and other government-issued identification, where necessary for the relevant service, verification, healthcare, insurance, compliance or other authorised purpose.

3.5 Communications and content

Depending on the integration used, Wisemelon may process WhatsApp messages, SMS communications, emails, voice calls, call recordings, Instagram communications, chatbot conversations, attachments, photographs, documents, images, audio and video content.

Where recording or monitoring of communications is used, Wisemelon or the relevant customer will provide appropriate notice and obtain consent or rely on another lawful basis where required by applicable law.

3.6 Location information

Where you provide explicit permission through your device or the Wisemelon application, Wisemelon may collect and use location information to support location-based business and workforce management features. Location information may include precise or approximate device location, depending on your device permissions and the functionality enabled.

Location data may be used for attendance tracking, field staff location updates, location-based task automation, route or work-assignment workflows, and other organisation-configured workflows during an active work session.

If you grant background location permission, Wisemelon may access your location while the application is running in the background only to support the authorised business or workforce features for which that permission was granted. Wisemelon does not use location information for advertising or interest-based advertising.

You can revoke or modify location permission at any time through your device settings. Revoking permission may limit or disable location-dependent functionality.

4.How We Collect Personal Data

Personal data may be collected:

• directly from you;
• from a hospital, clinic or other healthcare organisation;
• from our business customers;
• through Wisemelon applications and websites;
• through WhatsApp, SMS, email, Instagram or other communication channels;
• through integrations with customer systems;
• through healthcare or hospital information systems;
• through ABDM-related integrations where applicable;
• through payment providers;
• from authorised representatives;
• through documents or information submitted to us;
• automatically through cookies, logs and similar technologies.
• from your device or application when you grant location permission.

Where a customer provides personal data to Wisemelon for processing, the customer is responsible for ensuring that it has the required authority to provide that information and instruct Wisemelon to process it.

5.Purposes for Which We Process Personal Data

We process personal data only for specified, legitimate and relevant purposes, including the following:

Service delivery

To provide, operate, maintain and secure Wisemelon and its functionality.

Healthcare and patient engagement

Where instructed by a healthcare customer, to support patient registration, appointment management, patient communication, patient engagement, reminders, pre- and post-consultation communication, healthcare workflows, patient education, care coordination, patient support, healthcare administration, insurance workflows and patient relationship management.

Customer administration

To create and manage accounts, administer subscriptions, process payments, provide customer support, communicate about services and maintain service records.

Security and fraud prevention

To protect our systems, users and customers, detect abuse, investigate security events, prevent unauthorised access and maintain service integrity.

Analytics and service improvement

To understand platform usage, troubleshoot problems, maintain reliability and improve Wisemelon. Where customer or patient health data is involved, Wisemelon will not use such information to train or improve a general-purpose AI model.

Marketing

To send promotional and informational communications where permitted by applicable law and, where required, based on appropriate consent or another lawful basis.

Legal and regulatory compliance

To comply with applicable laws, regulations, court orders, governmental requests, healthcare requirements, cybersecurity obligations and other lawful requirements.

6.AI and Automated Processing

Wisemelon uses artificial intelligence and machine-learning technologies as part of certain platform functionality. AI may be used to understand and classify communications, generate responses or content, assist workflows, identify relevant information, summarise information, assist customer engagement, automate business or healthcare administrative processes and generate insights or recommendations within customer-configured workflows.

6.1 No general-purpose AI training using customer/patient data

Wisemelon does not use customer or patient personal data to train or improve general-purpose AI models.

Where third-party AI services are used to provide a specific service, applicable customer agreements, technical safeguards and provider terms govern such processing.

6.2 Human and clinical responsibility

AI-generated outputs may contain errors, omissions or inaccuracies. Where Wisemelon is used in healthcare environments, healthcare organisations and qualified healthcare professionals remain responsible for clinical decisions, diagnosis, treatment, patient safety and professional judgement.

7.Consent and Other Lawful Grounds

Depending on the processing activity, Wisemelon may process personal data based on the consent of the Data Principal; where processing is based on another lawful use recognised under applicable law; to provide a service requested by the Data Principal; to perform obligations arising from a customer relationship; to protect the security of systems and services; to comply with legal obligations; where processing is carried out under the instructions of a Data Fiduciary/customer; or for other purposes permitted by applicable law.

Where consent is relied upon, it will be obtained through an appropriate mechanism and linked to the relevant purpose. Consent may be withdrawn through the mechanism provided for that purpose. Withdrawal of consent will not affect processing lawfully carried out before withdrawal, and processing may continue where another lawful basis or legal obligation permits or requires it.

8.Privacy Notices

Wisemelon seeks to provide privacy notices that are clear and understandable and that explain what personal data is being collected; why it is being collected; how it will be used; applicable sharing arrangements; how consent may be withdrawn; how privacy rights may be exercised; and how complaints may be submitted.

Where required by applicable law, notices will be provided in English or in another language permitted or required under applicable law.

9.Healthcare Data and Patient Privacy

Wisemelon recognises that healthcare information requires a high level of confidentiality.

When processing patient information, we seek to apply privacy and security principles including purpose limitation, minimum necessary access, role-based access, confidentiality, authentication, encryption, controlled data sharing, data integrity, availability and continuity, auditability, retention and deletion controls, and incident management.

Where Wisemelon processes patient data as a Data Processor, the healthcare organisation remains the Data Fiduciary unless otherwise determined by the relevant legal or contractual arrangement.

Patients should normally direct requests relating to their hospital medical record to the relevant hospital or healthcare organisation. Wisemelon may assist that organisation in responding to such requests.

10.ABDM and Health Information Exchange

Wisemelon is currently integrating with the Ayushman Bharat Digital Mission (ABDM).

Where ABDM functionality is enabled, Wisemelon will seek to implement applicable ABDM requirements and technical specifications concerning patient identity, consent, health information exchange, authentication, access control, interoperability, confidentiality and integrity, and patient control over health information.

ABDM-related processing may involve healthcare providers, Health Information Providers, Health Information Users, consent managers or other ABDM participants. The relevant participant remains responsible for the obligations assigned to it under the applicable ABDM framework.

11.NABH-Aligned Healthcare Data Practices

Wisemelon designs its healthcare functionality to support healthcare organisations in implementing privacy and security practices relevant to applicable NABH Digital Health Standards, including controls concerning authenticated access, access control, encryption, patient information security, digital consent, correction and erasure workflows, information management, data retention, auditability, confidentiality and privacy.

NABH Digital Health Standards cover security and privacy of personal health data and, for relevant digital-health systems, controls such as encryption at rest and in transit, controlled sharing, digital consent and access-related safeguards.

12.Sharing of Personal Data

Wisemelon may disclose or provide access to personal data only where necessary and permitted under applicable law.

• Customer organisations - hospitals, clinics, businesses or other organisations using Wisemelon, particularly where such organisation is the Data Fiduciary.
• Infrastructure and technology providers - cloud infrastructure, hosting, database, security and related technology providers.
• Communication providers - providers supporting WhatsApp, SMS, email, voice and social messaging.
• AI service providers - third-party AI providers used to perform specific services requested by Wisemelon or its customers.
• Payment providers - payment processors such as Razorpay or other providers used for payment processing.
• Analytics and technology providers - providers supporting analytics, performance monitoring, customer support, advertising, website functionality and related services.
• Legal and regulatory authorities - where disclosure is necessary to comply with applicable law, court orders, governmental directions, regulatory obligations, cybersecurity requirements, or prevention, detection or investigation of unlawful activity.

13.Third-Party Service Providers and Subprocessors

Wisemelon may appoint third-party service providers and subprocessors to provide infrastructure, communication, payment, AI, analytics, security, customer-support and other services.

Wisemelon seeks to impose appropriate contractual confidentiality, security and data-processing requirements on relevant processors.

For customer patient data, subprocessors are used only for purposes consistent with the customer's instructions and applicable contractual arrangements, subject to applicable law.

Customers requiring a detailed subprocessor list or processing addendum may request the applicable documentation from Wisemelon.

14.International Data Processing

Wisemelon production infrastructure is hosted primarily on Amazon Web Services (AWS) in India, including the Asia Pacific (Mumbai) region (ap-south-1) and, where enabled for the applicable environment, the Asia Pacific (Hyderabad) region (ap-south-2).

Wisemelon does not authorise routine access to customer or patient data by Wisemelon personnel located outside India.

However, certain third-party service providers, including global communication, AI, payment, analytics or other technology providers, may process limited information from jurisdictions outside India depending on the service and configuration.

Where such processing occurs, Wisemelon will apply contractual, organisational and technical measures appropriate to the processing and comply with applicable Indian law concerning transfers and disclosures.

15.Data Security

Wisemelon maintains technical and organisational safeguards designed to protect personal data against unauthorised access, loss, alteration, disclosure, destruction or other misuse.

Security measures currently include, as applicable:

• encryption during transmission;
• encryption at rest;
• role-based access control;
• multi-factor authentication;
• data segregation between customers;
• regular backups;
• vulnerability scanning;
• penetration testing;
• incident response procedures;
• employee confidentiality obligations;
• controlled access to production systems;
• security controls for cloud infrastructure.

Access auditing and monitoring capabilities may vary by deployment and contractual configuration. Where applicable or required, customer-specific audit logging and monitoring can be enabled or configured as part of the service.

Wisemelon regularly reviews its security practices and may strengthen or modify these measures as technology, threats, law and applicable standards evolve.

16.Security Incidents and Data Breaches

Wisemelon maintains an incident-response process for suspected or confirmed security incidents.

Where a personal data breach occurs, Wisemelon will assess the incident and take reasonable steps to contain the incident; investigate its nature and extent; protect affected systems and information; mitigate potential harm; preserve relevant evidence; notify customers where required under contract or applicable law; notify affected Data Principals where Wisemelon is the relevant Data Fiduciary and notification is required; and notify regulators or authorities where required by applicable law.

Where Wisemelon acts as a Data Processor, it will notify the relevant Data Fiduciary/customer in accordance with the applicable contract and applicable law and assist the customer with legally required notifications.

Wisemelon will also comply with applicable cybersecurity reporting requirements, including CERT-In directions where applicable.

17.Data Retention

17.1 Wisemelon-managed data

Unless a longer period is required by law, contract, dispute resolution, security requirements or another lawful purpose, Wisemelon generally seeks to retain personal data only for as long as reasonably necessary for the purpose for which it was collected and, as a general operational rule, for up to one year after the applicable purpose ends or the account becomes inactive.

17.2 Hospital and customer patient data

• retention is governed primarily by the customer agreement;
• customer instructions regarding deletion and retention will be followed;
• data may be retained longer where required by applicable law;
• backup and disaster-recovery copies may be retained for periods specified in the applicable contract or technical retention policy;
• security logs may be retained for the periods required by applicable law.

Where the purpose for processing has ended and no lawful retention requirement applies, Wisemelon will delete, anonymise or otherwise appropriately dispose of the relevant information within the applicable retention process.

18.Deletion and Erasure

You may request deletion of personal data processed by Wisemelon where applicable.

Deletion may be subject to legal obligations; healthcare record retention requirements; contractual requirements; legitimate security requirements; dispute resolution; fraud prevention; accounting or regulatory requirements; and data contained in backups that cannot be immediately overwritten.

Where Wisemelon acts as a Data Processor for a hospital or customer, requests relating to patient records may need to be addressed to the relevant Data Fiduciary/customer. Wisemelon will provide reasonable assistance to the customer to process authorised deletion or erasure requests.

19.Your Rights

Right to access

To obtain information concerning personal data processed by the relevant Data Fiduciary and other information prescribed by applicable law.

Right to correction, completion and updating

To request correction of inaccurate or misleading personal data and, where applicable, completion or updating of personal data.

Right to erasure

To request erasure of personal data where permitted by law and where continued retention is not legally or otherwise lawfully required.

Right to grievance redressal

To raise a grievance regarding processing of personal data or exercise of applicable privacy rights.

Right to nomination

To nominate another individual to exercise applicable rights in the event of death or incapacity, in accordance with applicable law and prescribed procedures.

These rights apply subject to the DPDP Act, 2023, the DPDP Rules, 2025, applicable exemptions, and other applicable law.

20.How to Exercise Your Rights

Requests should be sent to hello@wisemelon.ai. Please include sufficient information to allow us to identify the Data Principal, the relevant account, customer or hospital, the specific request, and the data or processing activity concerned.

For security purposes, Wisemelon may verify the identity or authority of the person making a request before processing it.

Where the relevant data is controlled by a hospital, clinic, employer, business or other Data Fiduciary, Wisemelon may redirect the request to that organisation or coordinate with it to fulfil the request.

21.Withdrawal of Consent

Where processing is based on consent, you may withdraw consent by contacting hello@wisemelon.ai. Where technically available, users may also use the withdrawal or unsubscribe mechanism provided through the applicable service or communication.

Withdrawal of consent will not affect processing that occurred lawfully before withdrawal or processing that may continue under another lawful basis.

Wisemelon seeks to ensure that withdrawal mechanisms are reasonably accessible and, where required by law, are as easy to use as the mechanism through which consent was provided.

22.Marketing Communications

Wisemelon may send marketing or promotional communications through WhatsApp, SMS, email and telephone calls, subject to applicable law and required consent.

You may opt out by emailing hello@wisemelon.ai or using any unsubscribe or opt-out mechanism provided in the relevant communication.

Essential service messages, transactional messages, account notifications, security notifications and legally required communications may continue where permitted by applicable law.

23.Cookies and Similar Technologies

Wisemelon and its websites may use cookies, pixels, tags, SDKs and similar technologies for essential website functionality, authentication, security, performance, analytics, understanding website usage, advertising and marketing, campaign measurement, personalisation and session recording or heatmap functionality where enabled.

Depending on the website or service configuration, these technologies may include Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, session recording/heatmap tools and other analytics technologies.

Third-party technologies may be subject to the privacy policies of the respective providers. Where required by law, Wisemelon will provide appropriate cookie choices or consent mechanisms.

24.Children's Personal Data

Wisemelon may process information concerning persons below 18 years of age where this occurs in connection with healthcare services provided by a hospital, clinic, healthcare professional, parent, guardian or other authorised person.

Where Wisemelon acts as a Data Processor, the relevant healthcare organisation or other Data Fiduciary is responsible for ensuring that appropriate authority, consent and safeguards are in place, except to the extent applicable law places an obligation directly on Wisemelon.

Where Wisemelon acts as a Data Fiduciary and applicable law requires verifiable parental or guardian consent, Wisemelon will implement appropriate measures to obtain such consent.

Wisemelon will not knowingly use children's personal data for targeted advertising or behavioural purposes where prohibited by applicable law.

25.Data Accuracy

Wisemelon seeks to maintain accurate and reliable personal data appropriate to the relevant purpose.

However, where personal data is provided by a Data Principal, customer or healthcare organisation, Wisemelon generally relies on the provider for the accuracy of the information unless Wisemelon is independently responsible for verifying it.

Users and customers should notify the relevant Data Fiduciary or Wisemelon where information needs to be corrected.

26.Patient and Healthcare Communications

Where Wisemelon facilitates healthcare communications, messages may contain information concerning appointments, healthcare reminders, treatment-related information, reports, prescriptions, follow-ups, patient education and other healthcare information configured by the healthcare provider.

The healthcare organisation remains responsible for ensuring that communications sent through Wisemelon are appropriate for the patient, authorised, accurate and consistent with applicable healthcare and privacy requirements.

Wisemelon provides technical functionality and does not replace the professional obligations of healthcare providers.

27.Payment Information

Payments for Wisemelon services may be processed through third-party payment providers.

Wisemelon may receive information such as billing name, billing address, invoice details, payment status, transaction reference and subscription information.

Payment instrument information may be processed directly by the applicable payment provider in accordance with its privacy policy, security controls and legal obligations.

28.Data Segregation

Wisemelon uses technical and organisational controls intended to segregate customer environments and prevent unauthorised access between customers.

Customer or hospital personnel are permitted to access data only according to the roles and permissions assigned to them.

29.Employee and Contractor Confidentiality

Personnel and contractors who may have access to confidential or personal data are subject to appropriate confidentiality obligations and are expected to access information only for authorised business purposes.

Access to production systems is restricted according to organisational and technical controls.

30.Third-Party Links and Integrations

Wisemelon may integrate with or link to third-party websites, applications or services. Third-party services operate according to their own privacy policies and terms. Wisemelon is not responsible for privacy practices of third parties except to the extent that Wisemelon has responsibility under applicable law or contractual arrangements.

31.Data Processing Agreements

Where Wisemelon processes personal data on behalf of a customer, the parties may enter into a Data Processing Agreement, Master Services Agreement, healthcare data addendum, security schedule or equivalent contractual instrument.

Such agreements may specify processing instructions, categories of personal data, purposes, authorised subprocessors, security obligations, incident notification, retention, deletion, audit rights, confidentiality, assistance with Data Principal requests, regulatory cooperation, data location, and business continuity and disaster recovery.

Where there is a conflict between this Privacy Policy and an executed customer data-processing agreement, the agreement will govern to the extent permitted by applicable law.

32.Government and Law-Enforcement Disclosures

Wisemelon may disclose personal data where it reasonably believes that disclosure is necessary to comply with applicable law; comply with valid legal process; respond to a lawful government request; protect the rights, safety or property of Wisemelon or another person; or prevent, investigate or respond to fraud, abuse, security threats or unlawful activity.

Wisemelon will seek to limit such disclosure to the information reasonably necessary for the relevant purpose, subject to applicable legal obligations.

33.Changes to This Privacy Policy

Wisemelon may update this Privacy Policy from time to time to reflect changes in our services, technology, applicable law, regulatory guidance, ABDM requirements, NABH requirements or processing practices.

The updated version will be published on the relevant website and will state the updated date. Where required by applicable law, Wisemelon will provide additional notice or obtain consent for material changes.

34.Grievance Redressal

For questions, privacy concerns, data-rights requests or complaints relating to personal data processed by Wisemelon, contact:

Wisemelon will process grievances in accordance with applicable law and its grievance-redressal procedure.

Where Wisemelon acts only as a Data Processor for a hospital or other organisation, the Data Principal may be required to use the grievance mechanism of the relevant Data Fiduciary before escalating the matter further, to the extent permitted or required by applicable law.

35.Applicable Law

This Privacy Policy is governed by the laws of India.

Subject to applicable law, disputes relating to this Privacy Policy shall be subject to the jurisdiction of the courts having appropriate jurisdiction over the registered office of Bizmorphic Research Private Limited.

Nothing in this clause limits any statutory rights or remedies that cannot lawfully be excluded or restricted.

36.Contact Us

For privacy, data protection, deletion, correction, consent withdrawal or other privacy-related enquiries:

Bizmorphic Research Private Limited
Kundan-Kushal Ngr, FL No. F-14,
Behind Koel Complex, Bopodi,
Pune, Maharashtra - 411020, India
Email: hello@wisemelon.ai

37.Regulatory and Reference Materials

This Policy has been drafted with reference to the following current public materials relevant to Wisemelon's stated processing model:

• Digital Personal Data Protection Act, 2023 - India Code
• Digital Personal Data Protection Rules, 2025 - Ministry of Electronics and Information Technology
• ABDM Health Data Management Policy - National Health Authority
• NABH Digital Health Standards - National Accreditation Board for Hospitals & Healthcare Providers
• NABH Digital Health Standards for HIS/EMR Systems
• CERT-In Directions under Section 70B - Cyber Incident Reporting and Security Practices
• AWS Global Infrastructure - Regions