# PRIVACY POLICY
*Effective Date:* 18 August 2026
*Last Updated:* 18 August 2026
## 1. INTRODUCTION
Welcome to *MedMentor* (“MedMentor”, “we”, “us”, “our” or “the Company”).
MedMentor provides educational counselling, medical admission assistance, overseas medical education consultancy, university application assistance, documentation support and related services.
This Privacy Policy explains how MedMentor collects, receives, uses, processes, stores, protects, shares and deletes personal information when you:
* Visit or use **https://medmentor.icu/**
* Submit an enquiry or callback request;
* Request counselling;
* Contact MedMentor by telephone, email or other communication channels;
* Apply for educational or admission-related services;
* Provide academic or identity documents;
* Communicate with our counsellors, representatives or authorized partners.
This Privacy Policy is intended to provide transparency regarding our handling of personal information and is designed with reference to applicable Indian laws, including the *Information Technology Act, 2000, applicable rules relating to reasonable security practices and sensitive personal data, the **Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the **Digital Personal Data Protection Rules, 2025 (“DPDP Rules”)*, as applicable from time to time.
The DPDP Act and Rules have a phased commencement framework. Accordingly, references in this Policy to DPDP obligations shall apply when and to the extent those provisions become legally operative. MedMentor may implement these requirements earlier as part of its privacy and data-governance practices.
—
# 2. DEFINITIONS
For purposes of this Privacy Policy:
### “Personal Data”
Means any data about an individual who is identifiable by or in relation to such data.
### “Data Principal”
Means the individual to whom the personal data relates.
### “Data Fiduciary”
Means the person or entity that determines the purpose and means of processing personal data.
For the purposes of applicable DPDP provisions, MedMentor may act as a Data Fiduciary where it determines why and how personal data is processed.
### “Data Processor”
Means a person or entity that processes personal data on behalf of a Data Fiduciary.
### “Processing”
Includes collection, recording, organization, storage, use, sharing, disclosure, transmission, alteration, retrieval, erasure or other operations performed on personal data.
### “Child”
For purposes of the DPDP Act, a child means an individual who has not completed eighteen years of age.
—
# 3. INFORMATION WE COLLECT
We collect only information reasonably required for the purposes for which it is processed.
Depending on the services you request, we may collect:
## 3.1 Basic Personal Information
* Full name;
* Date of birth;
* Gender, where relevant to an admission process;
* Residential/contact address;
* Mobile number;
* Email address;
* Parent/guardian details where applicable.
## 3.2 Academic Information
For counselling and admission assistance, we may collect:
* Class 10/12 information;
* Academic marks and grades;
* NEET or other entrance examination information;
* Academic certificates;
* Preferred course;
* Preferred country;
* Preferred university;
* Academic history;
* Admission eligibility information.
## 3.3 Admission and Documentation Information
Where required for services requested by you, we may process:
* Passport information;
* Identity documents;
* Photographs;
* Academic certificates;
* Migration/transfer certificates;
* Entrance examination records;
* Medical/admission documentation;
* Visa-related documents;
* Other documents required by universities, educational institutions or government authorities.
You should not submit documents or information that are unnecessary for the relevant service.
## 3.4 Parent/Guardian Information
Where a student is under eighteen years of age, we may collect information relating to the student’s parent or lawful guardian for counselling, consent, admission and documentation purposes.
## 3.5 Communication Information
We may retain information contained in communications between you and MedMentor, including enquiries submitted through forms, emails, telephone communications and other customer-support channels.
## 3.6 Technical Information
When you visit our website, certain information may be automatically collected, including:
* IP address;
* Browser type;
* Operating system;
* Device information;
* Date and time of access;
* Pages visited;
* Referring webpage;
* Basic website usage information;
* Security and diagnostic information.
—
# 4. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA
MedMentor may process personal data for the following purposes:
1. Responding to enquiries and callback requests;
2. Providing educational counselling;
3. Providing medical admission counselling;
4. Evaluating admission requirements;
5. Identifying potentially suitable universities and courses;
6. Assisting with university applications;
7. Assisting with admission documentation;
8. Assisting with visa-related documentation and processes;
9. Communicating application updates;
10. Providing requested educational services;
11. Coordinating with universities and authorized representatives;
12. Providing customer support;
13. Maintaining records relating to services provided;
14. Preventing fraud, misuse and unauthorized access;
15. Protecting the security and integrity of our website and systems;
16. Complying with legal, regulatory or governmental requirements;
17. Resolving disputes and enforcing contractual rights;
18. Improving our services and website;
19. Sending service-related communications;
20. Sending promotional communications where permitted and where the required consent or other lawful basis exists.
We will not intentionally collect or process personal data beyond what is reasonably necessary for the relevant purpose.
The DPDP Act requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to personal data necessary for the specified purpose.
—
# 5. CONSENT
Where consent is required, MedMentor will seek consent through an appropriate affirmative action.
Consent requests will be presented in clear and reasonably understandable language and will identify the relevant purpose of processing.
You may withdraw consent where consent is the basis for processing.
Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
Where withdrawal makes it impossible for MedMentor to provide a requested service, certain services may no longer be available.
Under the DPDP Act, withdrawal of consent should be capable of being exercised with an ease comparable to the manner in which consent was given.
—
# 6. WEBSITE ENQUIRY AND CALLBACK FORMS
If you submit information through a MedMentor enquiry, contact or callback form, we may collect information such as:
* Student name;
* Mobile number;
* Email address;
* Educational/admission information;
* Other information voluntarily entered into the form.
The information will be used to respond to your enquiry and provide relevant counselling or admission assistance.
### Recommended Website Consent Notice
By submitting a form on this website, you acknowledge that you have read the Privacy Policy and consent to MedMentor processing the information submitted by you for the purpose of responding to your enquiry and providing the requested counselling/admission-related assistance.
You may contact MedMentor to withdraw consent where applicable or to exercise your available data-protection rights.
—
# 7. CHILDREN’S PERSONAL DATA
MedMentor recognizes that students seeking medical education may be below eighteen years of age.
Where applicable DPDP provisions relating to children are in force, MedMentor will implement the required safeguards for processing children’s personal data, including obtaining verifiable parental or lawful guardian consent where required.
MedMentor will not knowingly undertake processing of children’s personal data that is prohibited under applicable law.
MedMentor will not knowingly use children’s personal data for targeted advertising or behavioural monitoring where such processing is prohibited by applicable law.
Parents or lawful guardians may contact MedMentor regarding a child’s personal data where they are legally authorized to do so.
The DPDP Act contains specific obligations concerning children’s data, including parental consent and restrictions concerning harmful processing, tracking/behavioural monitoring and targeted advertising, subject to statutory exceptions.
—
# 8. SENSITIVE OR HIGH-RISK INFORMATION
Although the DPDP Act does not create the same “sensitive personal data” category used under India’s earlier SPDI framework, MedMentor may receive information that is inherently confidential or capable of causing significant harm if misused, including:
* Identity documents;
* Passport information;
* Academic records;
* Financial/admission documentation;
* Medical documentation where required for an admission process;
* Information concerning minors.
MedMentor will take reasonable measures to restrict access to such information to authorized persons who require it for legitimate business or service purposes.
During the transition period, applicable requirements under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 may also remain relevant.
—
# 9. SHARING OF PERSONAL DATA
MedMentor does *not sell personal data*.
We may share personal data where reasonably necessary with:
### Educational Institutions
* Universities;
* Medical colleges;
* Educational institutions;
* Authorized admission offices;
* University representatives.
### Service Providers
* IT and hosting providers;
* Website service providers;
* Communication service providers;
* CRM/service-management providers;
* Document-processing providers;
* Authorized technology providers.
### Professional and Operational Partners
* Authorized admission representatives;
* Visa/documentation service providers;
* Travel or accommodation service providers where requested;
* Professional advisers.
### Government and Legal Authorities
Personal data may be disclosed where required or authorized by:
* Courts;
* Government authorities;
* Regulatory authorities;
* Law-enforcement agencies;
* Other competent statutory authorities.
Third-party processors handling personal data on behalf of MedMentor will be expected to process such data only for authorized purposes and subject to appropriate contractual and security requirements.
—
# 10. INTERNATIONAL DATA TRANSFER
MedMentor provides assistance relating to medical education outside India.
Accordingly, personal data may need to be transferred or disclosed to universities, colleges, representatives or service providers located outside India.
Such transfer may be necessary to provide the service requested by the student or applicant.
MedMentor will comply with applicable Indian requirements concerning transfer of personal data outside India, including any restrictions or conditions notified by the Central Government under applicable law.
The DPDP Act provides that the Central Government may restrict transfer of personal data to specified countries or territories by notification and subject such transfers to specified conditions.
—
# 11. DATA SECURITY
MedMentor will implement reasonable technical and organizational safeguards appropriate to the nature of personal data processed.
Depending on the relevant system and risk, safeguards may include:
* Access controls;
* Password protection;
* Authentication mechanisms;
* Role-based access;
* Encryption where appropriate;
* Secure transmission mechanisms;
* Data backups;
* Monitoring and logging;
* Malware and security protections;
* Restricted administrative access;
* Secure deletion procedures;
* Vendor/security controls.
Access to personal data will be restricted to personnel and service providers who require access for legitimate purposes.
The DPDP Rules contemplate reasonable security safeguards including measures such as encryption, access control, monitoring, backups, detection/response mechanisms and maintenance of relevant logs.
—
# 12. PERSONAL DATA BREACHES
MedMentor will maintain reasonable procedures for identifying, assessing, containing and responding to personal data breaches.
Where a personal data breach occurs and applicable law requires notification, MedMentor will notify the relevant authority and affected individuals in the manner and within the time period prescribed by applicable law.
The DPDP Rules provide for notification to affected Data Principals and the Data Protection Board and contemplate detailed information to the Board within 72 hours, subject to the applicable statutory framework.
—
# 13. DATA RETENTION
MedMentor will retain personal data only for as long as reasonably necessary for:
* Providing requested services;
* Completing admission processes;
* Maintaining business records;
* Meeting legal or regulatory obligations;
* Resolving disputes;
* Preventing fraud;
* Enforcing contractual rights;
* Protecting legitimate business interests.
When personal data is no longer required and there is no legal requirement to retain it, MedMentor will take reasonable steps to delete, anonymize or securely dispose of it.
Personal data will not be retained indefinitely merely because it was collected.
—
# 14. COOKIES
The MedMentor website may use cookies and similar technologies for:
* Essential website functionality;
* Security;
* Performance;
* Website analytics;
* Improving user experience;
* Understanding website usage.
Third-party services integrated into the website may also use cookies or similar technologies.
Users may control cookies through their browser settings.
If MedMentor introduces advertising, analytics or other tracking technologies requiring additional consent under applicable law, appropriate notices and consent mechanisms will be implemented.
—
# 15. MARKETING COMMUNICATIONS
MedMentor may communicate with users regarding:
* Enquiries;
* Counselling;
* Admission applications;
* University updates;
* Requested services;
* Service-related announcements.
Where required by applicable law, promotional communications will be sent only after obtaining the appropriate consent or otherwise relying on a legally permitted basis.
Users may request that promotional communications be stopped.
Stopping promotional communication will not necessarily stop essential service-related communications.
—
# 16. DATA PRINCIPAL RIGHTS
Subject to applicable law and its commencement, an individual may have rights including:
* The right to obtain information regarding personal data processing;
* The right to request correction of inaccurate or incomplete personal data;
* The right to request erasure of personal data where applicable;
* The right to withdraw consent where consent is the basis of processing;
* The right to obtain information regarding the means available for exercising rights;
* The right to lodge a grievance;
* The right to nominate another individual to exercise applicable rights in specified circumstances.
Requests should be submitted using the contact details provided in this Privacy Policy.
MedMentor may require reasonable verification of identity before processing a request involving personal data.
The DPDP Act expressly provides rights relating to access, correction, erasure, withdrawal of consent, grievance redressal and nomination, subject to its provisions and commencement.
—
# 17. GRIEVANCE REDRESSAL
MedMentor will maintain an appropriate mechanism for receiving and addressing privacy-related grievances.
If you believe that your personal data has been processed improperly or you have a concern regarding this Privacy Policy, you may contact us.
### Privacy / Grievance Contact
*MedMentor*
2nd Floor, The Ark Tower,
Above Bank of Baroda,
Mohan Nagar, Kamptee Road,
Nagpur – 440001, Maharashtra, India
*Telephone:* 07124063488
*Mobile:* +91 9225214054 / +91 7798707778
*Email:* [info@medmentor.icu](mailto:info@medmentor.icu)
The above contact may be used for:
* Privacy enquiries;
* Consent withdrawal requests;
* Correction requests;
* Erasure requests;
* Data-access requests;
* Child/parental requests;
* Privacy complaints;
* Data-security concerns.
—
# 18. IDENTITY VERIFICATION
To protect personal information, MedMentor may request reasonable information necessary to verify the identity or authority of a person making a privacy request.
This may include confirmation of:
* Name;
* Registered email address;
* Registered mobile number;
* Relevant application/reference information;
* Parent/guardian relationship where the request concerns a child.
We will avoid collecting additional information solely for verification where reasonably possible.
—
# 19. THIRD-PARTY WEBSITES
The MedMentor website may contain links to third-party websites, including universities, educational institutions and service providers.
Third-party websites operate independently and may have their own privacy policies.
MedMentor is not responsible for the privacy, security or content practices of third-party websites that it does not control.
Users should review the privacy policy of any third-party website before submitting personal information.
—
# 20. DATA PROCESSORS AND SERVICE PROVIDERS
MedMentor may engage third-party service providers to process personal data on its behalf.
Examples may include:
* Website hosting providers;
* Cloud service providers;
* CRM providers;
* Email providers;
* Communication providers;
* Security providers;
* IT service providers;
* Document-management providers.
Where applicable, MedMentor will require appropriate contractual and organizational controls for such processing.
Data processors will not be authorized to use personal data for unrelated purposes except where legally permitted or separately authorized.
—
# 21. GOVERNMENT AND LEGAL DISCLOSURES
MedMentor may disclose personal data where required to do so by:
* Applicable Indian law;
* Court orders;
* Government directions;
* Regulatory requirements;
* Law-enforcement requirements;
* Legal proceedings;
* Fraud-prevention or cybersecurity requirements.
Such disclosure will be limited to information reasonably required for the relevant legal or regulatory purpose.
—
# 22. USER RESPONSIBILITIES
Users are responsible for ensuring that information supplied to MedMentor is accurate and not misleading.
Users should not submit:
* False documents;
* Fraudulent information;
* Documents belonging to another person without authorization;
* Unnecessary confidential information.
Where users provide information relating to another individual, they should have appropriate authority or permission to provide that information where required by law.
—
# 23. SECURITY OF COMMUNICATION
Although MedMentor takes reasonable security measures, transmission of information over the internet cannot be guaranteed to be completely secure.
Users should avoid sending unnecessary confidential documents through unsecured communication channels.
Where a secure document-submission mechanism is provided, users should preferably use that mechanism for sensitive documents.
—
# 24. PRIVACY OF MINORS
Students below eighteen years of age may use MedMentor’s counselling and admission services.
Where applicable, MedMentor may communicate with a parent or lawful guardian regarding:
* Counselling;
* Consent;
* Admission;
* Documentation;
* University applications;
* Visa-related processes.
Where legally required, MedMentor will obtain verifiable parental or lawful guardian consent before processing a child’s personal data.
—
# 25. NO SALE OF PERSONAL DATA
MedMentor does not sell, rent or commercially trade personal data of students, parents, applicants or website visitors.
Personal data may be shared with authorized parties where reasonably necessary to provide requested services, comply with law or fulfil another permitted purpose described in this Privacy Policy.
—
# 26. CHANGES TO THIS PRIVACY POLICY
MedMentor may update this Privacy Policy periodically to reflect:
* Changes in applicable Indian laws;
* Changes in the DPDP Act or DPDP Rules;
* Changes in our services;
* Changes in technology;
* Changes in data-processing practices;
* Changes in security practices.
The updated policy will be published on this webpage with the revised “Last Updated” date.
Users are encouraged to periodically review this Privacy Policy.
—
# 27. APPLICABLE LAW
This Privacy Policy shall be governed by the laws of India.
Depending upon the nature and timing of the relevant processing, applicable requirements may include:
* Information Technology Act, 2000;
* Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable during the transition period;
* Digital Personal Data Protection Act, 2023;
* Digital Personal Data Protection Rules, 2025;
* Other applicable Indian laws and regulations.
The DPDP framework is being implemented in phases. The Government’s notified implementation schedule provides for the principal substantive provisions to take effect after the 18-month transition period ending *13 May 2027*.
—
# 28. CONTACT INFORMATION
### MedMentor
*Registered/Office Address:*
2nd Floor, The Ark Tower,
Above Bank of Baroda,
Mohan Nagar, Kamptee Road,
Nagpur – 440001, Maharashtra, India
*Telephone:* 07124063488
*Mobile:*
+91 9225214054
+91 7798707778
*Privacy / Grievance Email:*
*[info@medmentor.icu](mailto:info@medmentor.icu)*
*Website:*
**https://medmentor.icu/**
—
## 29. ACKNOWLEDGEMENT
By using the MedMentor website or voluntarily providing personal information to MedMentor, you acknowledge that you have had an opportunity to review this Privacy Policy.
Where consent is legally required, MedMentor will obtain consent through an appropriate mechanism before processing the relevant personal data.
*Last Updated:* 18 August 2026
—
### Important Notice
This Privacy Policy is intended as a website compliance document and should be reviewed against MedMentor’s actual technical systems, forms, CRM, analytics tools, advertising platforms, hosting provider, document-storage systems and third-party service providers before publication.
If the website uses Google Analytics, Meta Pixel, Google Ads conversion tracking, WhatsApp APIs, third-party CRM software, cloud storage, payment gateways or other third-party tracking/processing technologies, those systems should be reflected accurately in the final Privacy Policy and consent mechanism.