Privacy Policy

This Privacy Policy describes how Refill Health Wellbeing Private Limited, a company incorporated under the Companies Act, 2013 and having its registered office at 2-7-7, Venkat Nagar, Kakinada - 533003, Andhra Pradesh, India ("Refill Health", "we", "us" or "our"), processes Personal Data in connection with the Refill Health Platform and Services.

This Privacy Policy applies to Services made available through employers, companies, educational institutions and other organisations that contract with or sponsor access to Refill Health. Such organisations are referred to as "Sponsors".

It applies to:

1. employees, workers, faculty members, staff, students aged 18 years or above, eligible dependants and other authorised Members;
2. parents and lawful guardians who request or authorise counselling for a person below 18 years;
3. Minor Counselling Recipients who receive counselling through a separately administered service flow;
4. representatives and administrators of Sponsors;
5. Mental Health Professionals, Coaches, Care Navigators and other professionals using the Platform;
6. visitors to Refill Health websites or applications; and
7. persons who contact Refill Health for support, partnership, employment, professional or business purposes.

All capitalised terms not defined in this Privacy Policy shall have the meanings assigned to them in the Refill Health Terms of Use. This Privacy Policy should be read with the Terms of Use, applicable clinical consent forms, Minor Counselling Consent, assessment notices, AI notices, crisis notices, cookie notices and any additional notice presented when Personal Data is collected.

Sponsorship of the Services by an employer or educational institution does not give the Sponsor unrestricted access to a Member's Personal Data or Clinical Information.

1. We provide Sponsors only with anonymous and aggregated reports.
2. Reports are generated only when a minimum reporting threshold is met.
3. We do not disclose therapy or counselling notes, session content, private messages, item-level assessment responses, individual assessment scores, diagnoses, treatment plans or identifiable safety classifications to Sponsors.
4. We do not sell or rent Personal Data.
5. We do not use identifiable mental-health or clinical information for targeted or behavioural advertising.
6. We do not knowingly permit Sponsors to use Refill Health information for recruitment, termination, promotion, appraisal, grading, academic discipline or another adverse employment or educational decision.
7. Safety-related disclosures are limited, as far as reasonably practicable, to information necessary to manage the identified risk.

This Privacy Policy is a notice explaining our processing practices. It is not unlimited, irrevocable or blanket consent to every form of processing.

Where consent is required, Refill Health will seek an appropriate affirmative action after providing information about the Personal Data proposed to be processed, the purpose, whether the information is mandatory or optional, likely recipients, consequences of declining and the method for withdrawal.

Separate consent may be requested for therapy or teletherapy, assessments, processing of a minor's Personal Data, optional recordings, AI-assisted transcription if introduced in the future, identifiable research, optional integrations or marketing communications.

Continued use of the Platform will not be treated as a substitute for fresh consent where applicable law requires a new consent for a materially different purpose.

Refill Health intends to process Personal Data in accordance with applicable Indian law, including, as and when applicable:

1. the Digital Personal Data Protection Act, 2023 and rules made thereunder;
2. the Information Technology Act, 2000;
3. the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
4. the Mental Healthcare Act, 2017;
5. applicable child-protection, safeguarding, professional, clinical, telehealth and record-keeping requirements;
6. lawful directions issued by competent authorities; and
7. other applicable laws, regulations and judicial or regulatory directions.

"AI Features" means artificial-intelligence, machine-learning, statistical, rules-based or large-language-model features used for matching, recommendations, documentation assistance, analytics, risk indicators, security or other Platform functions.

"Clinical Information" means information concerning mental health, psychological functioning, symptoms, counselling, therapy, assessment, diagnosis, safety, care plans, goals, interventions, progress and interactions with Mental Health Professionals.

"Data Principal" means the individual to whom Personal Data relates.

"Member" means a person aged 18 years or above who is eligible and authorised to access the Platform under a Sponsor programme.

"Minor Counselling Recipient" means a person below 18 years who receives counselling through a separately administered parent- or guardian-authorised service flow and who does not independently register for or use the Platform.

"Personal Data" means data about an individual who is identifiable by or in relation to such data, including Personal Information and Sensitive Personal Data or Information recognised under applicable Indian law.

"Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, use, analysis, sharing, transmission, restriction, erasure or destruction.

"Professional Services" means therapy, counselling, coaching, assessments, Care Navigation or other professional support provided through or arranged by Refill Health.

"Sponsor" means an employer, company, educational institution or other organisation that makes Services available to eligible persons.

The Personal Data we collect depends on the Services used, the Sponsor programme, your choices and the nature of the professional relationship.

6.1 Identity and account information

1. full name, preferred name, date or year of birth and age;
2. email address, mobile number and city, state or country;
3. login credentials, account identifiers and authentication information;
4. language, communication and accessibility preferences;
5. profile information voluntarily provided; and
6. identity-verification information where reasonably necessary.

6.2 Sponsor and eligibility information

1. employee, student, staff or Member identifier;
2. work or institutional email address;
3. eligibility or affiliation status;
4. department, location, programme category or other limited cohort information;
5. benefit entitlement and start or end of eligibility; and
6. organisation or educational institution name.

6.3 Demographic and matching preferences

1. age range, language, preferred professional characteristics, appointment preferences, accessibility needs, location or time zone and other information relevant to matching or access.

6.4 Mental-health and wellbeing information

1. goals and reasons for seeking support;
2. mood, sleep, energy, stress or wellbeing check-ins;
3. symptoms and symptom history;
4. assessment questions, responses, scores and severity classifications;
5. information relating to alcohol or substance use, trauma, attention, mood, eating, sleep, stress or burnout;
6. functional and workplace or educational wellbeing information;
7. care preferences, self-care activity and completion information; and
8. other wellbeing information voluntarily disclosed.

6.5 Therapy, counselling and clinical records

1. intake information, appointment history, clinical formulation, session notes and progress notes;
2. treatment or support plans, goals, objectives, interventions and assignments;
3. assessments, progress measures, referrals and transition summaries;
4. communications with the treating professional, documents uploaded by the person or guardian and informed-consent records; and
5. other records reasonably created during care.

6.6 Coaching and Care Navigation information

1. coaching goals, action plans, progress updates, barriers to care, referral information and follow-up communications.

6.7 Crisis and safety information

1. statements or responses indicating possible self-harm, suicide, violence, abuse or other risk;
2. risk-screening responses, risk level and safety classifications;
3. emergency-contact and lawful-guardian information;
4. location information voluntarily provided for an active safety response;
5. contact attempts, safety plans, escalation actions and communications with appropriate recipients.

6.8 Communications and support information

1. email, telephone, SMS, WhatsApp or in-app communications;
2. support requests, complaints, feedback, surveys, satisfaction ratings and appointment-related communications.

6.9 Technical and device information

1. IP address, device type, operating system, browser, language, time zone, login time, feature usage, session duration, errors, crash information, security events and diagnostic information.

6.10 Payment and transaction information

1. billing name, payment status, transaction identifier, invoice information, amount and date of payment, taxes and refund information where direct-pay Services are introduced.

6.11 Sponsor administrator and business-contact information

1. name, job title, organisation, work contact details, account permissions, business communications, contractual and billing information.

6.12 Professional information

1. identity, contact details, qualifications, registrations, experience, expertise, language, availability, profile, supervision and training records, quality information, assignments and payment information.

We may collect Personal Data:

1. directly from you;
2. from a parent or lawful guardian for a Minor Counselling Recipient;
3. from a Sponsor for eligibility or programme administration;
4. from a Mental Health Professional, Coach or Care Navigator;
5. from an emergency contact, authorised referral source or nominated representative;
6. through use of the Platform;
7. from authorised third-party integrations and approved service providers;
8. from publicly available professional registers for credential verification; and
9. from lawful authorities or other sources where permitted by law.

Where a Sponsor or guardian provides Personal Data, that person or entity is responsible for having lawful authority to provide it and for giving any notice required from them. Refill Health will independently provide appropriate information concerning its own processing.

Certain Personal Data is necessary to verify eligibility, establish and secure an account, provide counselling or therapy, administer an assessment, manage safety, comply with law or administer a Sponsor-funded benefit. Failure to provide necessary information may prevent us from providing the relevant Service.

Other information, such as certain preferences, check-ins, profile details or journals, may be optional. Declining optional information will not ordinarily prevent access to unrelated Services. Refill Health will not require Personal Data disproportionate to the identified purpose.

9.1 Account and eligibility administration

Creating and managing accounts, verifying identity and eligibility, authenticating users, administering access rights, maintaining security and managing benefit limits.

9.2 Providing Professional Services

Arranging and providing counselling, therapy, coaching, Care Navigation, appointments, secure communications, records, referrals, continuity of care and follow-up.

9.3 Assessments and measurement-based care

Administering assessments, calculating scores, identifying potential care needs, measuring progress, supporting professional interpretation and recommending further support.

9.4 Matching and personalisation

Recommending professionals, care pathways, self-care tools, programmes and reminders using goals, preferences, availability and clinical appropriateness.

9.5 Safety and crisis management

Identifying possible safety concerns, facilitating human review, contacting appropriate persons, supporting safety planning and documenting actions.

9.6 Platform operation

Providing functionality, troubleshooting, maintaining availability, sending operational communications, improving accessibility and responding to support enquiries.

9.7 Security and fraud prevention

Authenticating accounts, detecting suspicious activity, preventing unauthorised access, investigating incidents and protecting users and Refill Health.

9.8 Anonymous and aggregated Sponsor reporting

Providing only anonymous and aggregated information about programme activation, utilisation, engagement, broad support categories, service performance, outcome trends, satisfaction and organisational wellbeing where minimum reporting thresholds are met.

9.9 Quality assurance and clinical governance

Professional supervision, service-quality monitoring, complaint investigation, clinical audit, credential management and safety review.

9.10 Product and service improvement

Understanding feature usage, improving workflows, testing features, evaluating AI performance and improving relevance using aggregated, anonymised, masked or pseudonymised data wherever reasonably possible.

9.11 Legal and regulatory compliance

Complying with law, lawful requests, audits, record-keeping, legal claims and professional obligations.

9.12 Payments and business administration

Processing payments if introduced, issuing invoices, administering refunds, maintaining tax and accounting records and managing Sponsor contracts.

Depending on the circumstances, Refill Health may process Personal Data:

1. on the basis of valid consent;
2. to provide a Service voluntarily requested or initiated by the individual or guardian;
3. for legitimate uses recognised under applicable law;
4. to comply with legal, professional or regulatory obligations;
5. to respond to a medical, mental-health or safety emergency;
6. for permitted employment, institutional or Sponsor-administration purposes;
7. pursuant to a lawful order or direction; or
8. under another legal ground recognised by applicable law.

Where consent is the basis, it may be withdrawn through the Platform or by contacting privacy@refillhealth.com. Withdrawal will not affect processing lawfully undertaken before withdrawal and may make it impossible to continue a Service that necessarily depends on the relevant information.

Refill Health uses Amazon Bedrock and may use other approved global artificial-intelligence, large-language-model, machine-learning and rules-based service providers.

AI Features may support:

1. care-pathway recommendations;
2. therapist, counsellor or Coach matching;
3. personalised self-care recommendations;
4. assessment interpretation support;
5. risk indicators for human review;
6. draft summaries and professional documentation assistance;
7. quality and safety review;
8. Platform security; and
9. anonymous and aggregated analytics.

AI outputs may be incomplete, incorrect or inappropriate for an individual situation. They are decision-support outputs and not independent diagnoses. Qualified professionals remain responsible for clinical judgment, treatment decisions and final professional records.

Refill Health applies data-minimisation measures so that identifiable Personal Data is not provided to an AI service where the intended function can reasonably be performed using anonymised, masked, pseudonymised or limited information.

Refill Health will not knowingly use identifiable counselling-session content, private clinical messages, identifiable assessment responses or clinical notes to train publicly available or general-purpose AI models unless the use is separately disclosed, a lawful basis exists, any required specific consent is obtained and appropriate safeguards are implemented.

Approved external providers should be contractually restricted from selling Personal Data, using it for unrelated advertising or using identifiable Refill Health clinical information to train their general-purpose models without authorisation.

Refill Health will not knowingly provide individual AI-generated clinical predictions, assessment scores or risk classifications to Sponsors for recruitment, performance appraisal, promotion, grading, disciplinary action, termination, suspension or another adverse decision.

Mental-health and counselling information is subject to heightened confidentiality. Refill Health, its authorised personnel and participating professionals will maintain confidentiality except where disclosure is:

1. authorised by the individual or lawful representative;
2. reasonably necessary for another professional to provide care or treatment;
3. necessary for confidential professional supervision or clinical governance;
4. necessary to protect a person from serious harm or violence;
5. necessary to prevent a threat to life;
6. required for mandatory reporting or child safeguarding;
7. required by a competent court, authority, regulator or professional body;
8. required in the interests of public safety or security;
9. reasonably necessary for lawful programme administration without disclosing counselling content; or
10. otherwise permitted or required by law.

Where a disclosure is made for safety or legal reasons, Refill Health will, where reasonably practicable, limit the disclosure to information necessary for the relevant purpose.

13.1 Anonymous and aggregated reporting

Sponsors receive anonymous and aggregated reports only. Reports will be produced only where a minimum reporting threshold is met. Information may be suppressed, combined, rounded, delayed or withheld where reporting could reasonably enable identification of an individual.

Reports may include aggregated programme activation, utilisation, engagement, broad categories of support, service performance, outcome trends, satisfaction, wellbeing indicators and organisational or institutional insights.

13.2 Information not shared with Sponsors

1. therapy, counselling or coaching notes;
2. session content, recordings or transcripts;
3. private messages;
4. individual assessment responses or scores;
5. diagnoses, treatment plans, goals or objectives;
6. detailed reasons for seeking support;
7. medication information;
8. individual safety classifications; and
9. identifiable parent or guardian information.

13.3 Restrictions on Sponsor use

Refill Health does not knowingly permit Sponsor reports to be used to identify an individual or to make recruitment, promotion, appraisal, compensation, disciplinary, termination, suspension, grading, admission or academic-evaluation decisions.

14.1 Mental Health Professionals and Coaches

Relevant information may be shared for matching, counselling, assessment, treatment, appointments, continuity of care, referrals and professional supervision.

14.2 Care Navigators and authorised Refill Health personnel

Access may be provided for care coordination, support, appointment administration, safety management, clinical governance, security, finance, legal compliance and complaint resolution. Access should be role-based and limited to legitimate needs.

14.3 Approved service providers and processors

We may engage providers for cloud hosting, storage, cybersecurity, identity management, communications, video conferencing, support, scheduling, analytics, payments, AI infrastructure, backups and technical maintenance. Providers should be subject to appropriate confidentiality, security, purpose-limitation, retention and deletion obligations.

14.4 Sponsors

Only anonymous and aggregated information is shared as described in Section 13, except where a specific lawful disclosure is separately authorised or required.

14.5 Parents, lawful guardians, emergency contacts and nominated representatives

Limited information may be shared where authorised, necessary for the counselling of a minor, reasonably necessary for safety or permitted or required by law. Naming an emergency contact does not provide general access to an account or clinical record.

14.6 Authorities and legal recipients

Information may be disclosed to courts, statutory authorities, law-enforcement agencies, emergency responders, hospitals, regulators or professional bodies where required or permitted by law.

14.7 Corporate transactions

Information may be disclosed under confidentiality safeguards in connection with a proposed or completed merger, investment, acquisition, restructuring, financing, sale of assets or transfer of business.

1. We do not sell or rent Personal Data.
2. We do not disclose counselling content to a Sponsor merely because the Sponsor funds the Service.
3. We do not use identifiable Clinical Information for behavioural or targeted advertising.
4. We do not permit unauthorised Sponsor access to clinical records.
5. We do not publicly disclose a person's use of mental-health Services.
6. We do not record counselling, therapy or coaching sessions without appropriate notice and any required consent.
7. We do not use emergency-contact details for unrelated marketing.
8. We do not use Personal Data for a materially incompatible purpose without an appropriate legal basis and notice.

Refill Health does not currently use AI systems to record or transcribe counselling, therapy or coaching sessions, and does not ordinarily audio-record or video-record such sessions.

If recording, transcription or AI-assisted session documentation is introduced in the future, the person or lawful guardian will be informed in advance, the purpose and retention period will be explained, any required consent will be obtained, access will be restricted and unrelated model training will be prohibited unless separately authorised.

A professional may prepare ordinary clinical or counselling notes without recording the session.

Refill Health may use anonymous, aggregated or appropriately de-identified information for programme evaluation, service improvement, clinical-quality analysis, workplace or educational wellbeing insights, statistical analysis, product development, assessment validation and AI evaluation.

Information will not be represented as anonymous where an individual can reasonably be re-identified. Research involving identifiable information, intervention beyond ordinary care or publication of identifiable information will be subject to separate governance, notice, ethics review and consent where required.

Refill Health intends to host its primary application databases and stored clinical records in India.

Refill Health uses or may use approved global cloud, cybersecurity, communications, analytics, AI, LLM and other technology providers. Depending on a provider's infrastructure, routing, availability, support operations, backup or disaster-recovery architecture, limited Personal Data may be accessed or processed outside India. The precise location may vary and may not always be determined solely by Refill Health.

Where Personal Data is processed outside India, Refill Health will take reasonable steps to ensure that:

1. the processing is permitted under applicable Indian law;
2. only information reasonably necessary for the authorised purpose is made available;
3. the provider is subject to contractual confidentiality, security and purpose restrictions;
4. access is limited to authorised persons and systems;
5. appropriate retention and deletion controls are applied;
6. the provider is not authorised to sell the Personal Data or use identifiable clinical information for unrelated advertising; and
7. Refill Health remains responsible for oversight of processing undertaken on its behalf.

Refill Health will retain Personal Data, clinical records, counselling records, assessment information, consent records, account information, communications, security logs, financial records and other records in accordance with applicable laws, professional standards, contractual obligations, approved internal policies and standard operating procedures.

Personal Data will be retained only for as long as reasonably necessary to:

1. provide the Services;
2. maintain continuity and quality of care;
3. comply with clinical, safeguarding, legal, regulatory, tax, accounting, cybersecurity and contractual obligations;
4. investigate complaints, safety concerns or security incidents;
5. establish, exercise or defend legal claims; and
6. fulfil other lawful and legitimate operational requirements.

Different categories of records may be subject to different retention periods depending on their nature, sensitivity, purpose, the age of the Service recipient and applicable legal or professional requirements.

Upon expiry of the applicable retention period, Personal Data will be securely deleted, anonymised or placed under restricted archival controls in accordance with Refill Health's standard data-retention and disposal procedures.

Closure of an account, withdrawal of consent or termination of eligibility will not require Refill Health to delete information that must be retained for clinical, safeguarding, legal, regulatory, security, accounting, dispute-resolution or other lawful purposes.

Refill Health may retain relevant information for a longer period where reasonably necessary in connection with an actual or anticipated legal proceeding, regulatory enquiry, safeguarding review, complaint, audit, security incident, insurance claim or lawful direction.

Anonymous and aggregated information that does not identify an individual may be retained and used for lawful statistical analysis, service improvement, research, clinical governance and organisational reporting.

A Member may request account deactivation or deletion through the Platform or by contacting privacy@refillhealth.com. Account deletion does not necessarily require immediate deletion of every record.

Information may be retained where necessary for clinical record-keeping, safety, legal compliance, fraud prevention, security, financial records, dispute resolution, professional obligations or legal claims. Retained information will be restricted and will not be used for unrelated purposes.

Where processing is based on consent, the individual or lawful representative may withdraw consent by using the Platform or contacting privacy@refillhealth.com. Following a valid withdrawal, Refill Health will stop the relevant consent-based processing within the period required by law unless another lawful basis permits or requires continued processing.

Withdrawal will not invalidate processing undertaken before withdrawal. Withdrawal of consent necessary for a particular clinical or counselling Service may make it impossible to continue that Service.

Subject to applicable law, identity verification and lawful limitations, a Data Principal may request to:

1. obtain information about Personal Data being processed;
2. access a summary of Personal Data and processing activities;
3. correct inaccurate data;
4. complete incomplete data;
5. update outdated data;
6. request erasure where continued retention is not required;
7. withdraw consent;
8. raise a grievance;
9. nominate another individual to exercise applicable rights in the event of death or incapacity; and
10. approach a competent statutory, regulatory or judicial authority.

Requests may be submitted to privacy@refillhealth.com. Refill Health may request information reasonably necessary to verify identity and protect records. Clinical-record access may be subject to additional mental-health, professional and safety rules.

Users and lawful representatives should provide authentic and accurate information, update materially inaccurate information, safeguard account credentials, avoid impersonation, avoid providing another person's data without authority and promptly report suspected unauthorised access. These responsibilities do not reduce Refill Health's independent legal obligations.

Refill Health maintains reasonable technical, administrative, organisational and contractual safeguards appropriate to the nature and sensitivity of the Personal Data processed.

Safeguards may include, as applicable:

1. encryption in transit and at rest;
2. role-based access controls and authentication controls;
3. access logging, monitoring and review;
4. segregation of organisational and clinical information;
5. vulnerability and security testing;
6. secure software-development practices;
7. backups, recovery and continuity controls;
8. incident-response procedures;
9. workforce confidentiality obligations and security training;
10. vendor due diligence and contractual data-protection requirements;
11. masking, tokenisation or pseudonymisation; and
12. secure deletion and disposal.

Only safeguards actually implemented and verified by Refill Health should be represented publicly as current controls. No electronic system can be guaranteed to be completely secure.

Refill Health will maintain procedures to identify, assess, contain, investigate, remediate and document Personal Data breaches. Where required by law, affected individuals, the Data Protection Board of India, CERT-In, Sponsors, regulators or other competent authorities will be notified within applicable timeframes.

A notification may describe the nature of the breach, the information affected, likely consequences, mitigation measures, actions the affected person may take and contact details for assistance. Suspected incidents may be reported to privacy@refillhealth.com.

The registered Refill Health Platform, including self-registration, personal user accounts, self-service assessments, self-care tools, secure messaging and independent appointment booking, is intended only for persons who have completed 18 years of age and are legally competent to enter into a contract.

A person below 18 years may not independently create a Refill Health account, accept the Terms of Use, access the registered Platform as a User, independently complete Platform assessments or independently book counselling sessions.

Refill Health may nevertheless provide counselling to a person below 18 years through a separately administered Minor Counselling Service. The person will be treated as a Minor Counselling Recipient, not as a registered Platform User.

Before providing counselling to a Minor Counselling Recipient, Refill Health will ordinarily require:

1. a request, referral or authorisation from a parent or lawful guardian;
2. reasonable verification that the person providing consent is an adult;
3. reasonable verification of parental or lawful-guardian authority;
4. informed consent from the parent or lawful guardian;
5. appropriate assent from the Minor Counselling Recipient, having regard to age, maturity and understanding; and
6. acceptance of the applicable Minor Counselling Consent and Privacy Notice.

A Sponsor's referral or contract does not by itself replace parental or lawful-guardian consent where such consent is required.

Minor counselling may be administered through a parent- or guardian-controlled workflow, an authorised institutional coordination process, a secure counselling-session link, Refill Health internal systems or another controlled method. No such method gives the Sponsor access to counselling content or identifiable clinical information.

Providing consent for minor counselling does not automatically provide a parent or guardian with unrestricted access to every counselling communication, professional observation or session note.

Access will be determined in accordance with applicable law, the Minor Counselling Recipient's welfare and best interests, the professional's confidentiality and safeguarding obligations and the lawful authority of the parent or guardian.

Before counselling begins, the professional should explain the limits of confidentiality, what general information may be shared, when confidentiality may need to be broken, how safety concerns will be handled and what, if anything, may be reported to the Sponsor.

Information may be disclosed where necessary to protect the Minor Counselling Recipient or another person from serious harm, comply with child-protection or mandatory-reporting obligations, prevent a threat to life or satisfy another legal requirement.

Refill Health may use email, telephone, SMS, WhatsApp, push notification or in-app communication for account verification, appointments, Care Navigation, assessment reminders, privacy notices, security alerts, support, service updates and safety outreach.

Service-related messages may be necessary for providing Services. Marketing communications will be treated separately and may be opted out of. Sensitive clinical information should be shared through approved secure channels wherever available because ordinary email and messaging services may carry confidentiality risks.

Refill Health may use cookies, local storage, software development kits and similar technologies for secure authentication, session management, preferences, security, fraud prevention, diagnostics, performance measurement and feature-usage analytics.

Where non-essential cookies or analytics technologies are used, Refill Health will provide appropriate information and choice through a Cookie Notice or consent interface. Identifiable mental-health or clinical information will not be used for behavioural advertising.

The Platform may contain links to third-party websites, resources or applications. A third party may process Personal Data under its own privacy policy where the user independently chooses to interact with it. Refill Health is not responsible for independent third-party practices outside its control, but remains responsible for service providers processing Personal Data on its behalf to the extent required by law.

Where an organisation or educational-institution representative contacts Refill Health, professional contact information may be processed to respond to the enquiry, arrange demonstrations, prepare proposals, manage a prospective relationship, conduct due diligence, maintain business records and send relevant business communications.

Business-contact data will not be combined with employee or student clinical information for employment, academic or marketing purposes.

Refill Health does not currently provide psychiatric consultations, medication prescriptions or medication-management Services.

If such Services are introduced in the future, Refill Health will update this Privacy Policy and provide any additional clinical notices, consent documents and professional disclosures required before launch. A future Service will not automatically authorise Personal Data collected for an existing Service to be used for a materially different purpose.

Refill Health may update this Privacy Policy to reflect legal or regulatory changes, new or modified Services, new processing activities, AI Features, providers, security requirements or organisational changes. The revised version will identify its effective date.

Material changes will be notified through the Platform, email or another appropriate channel. Where a new purpose requires consent, posting the revised Policy or continued use alone will not replace the required consent.

Questions, rights requests, privacy complaints, confidentiality concerns and suspected privacy or security incidents may be submitted to:

1. Company: Refill Health Wellbeing Private Limited
2. Address: 2-7-7, Venkat Nagar, Kakinada - 533003, Andhra Pradesh, India
3. Email: privacy@refillhealth.com
4. Contact: Designated Privacy and Grievance Contact

Refill Health will acknowledge and address grievances within the period required by applicable law. Before public release, Refill Health should formally designate the responsible Grievance Officer and maintain the designation in its internal governance records and public contact information as legally required.

The above contact may be used for access, correction, consent withdrawal, account deletion, privacy complaints, clinical-confidentiality concerns, suspected unauthorised access and Personal Data breach enquiries.