Privacy Policy

Effective date: 1 October 2024  ·  Last updated: 7 September 2026

1. Who we are

This Privacy Policy explains how Rapidsurge Innovations Private Limited ("Rapidsurge Innovations", "Rio Health", "we", "us" or "our"), which operates the "Rio Health" medicine-delivery service and the website rioai.in (the "Website"), collects, uses, shares and protects your personal information.

By placing an order with Rio Health or otherwise sharing your information with us, you agree to this Privacy Policy. If you do not agree, please do not use our services.

2. Scope

This policy applies to information we collect:

• when you contact us or place an order through WhatsApp;
• when you make a payment for an order;
• when you visit the Website; and
• when you communicate with our customer-support or grievance team.

Ordering currently takes place through WhatsApp. The Website is informational and does not offer account registration or an online shopping cart.

3. Information we collect

3.1 Information you give us when ordering (via WhatsApp)

• Your name and delivery address;
• Your mobile number (your WhatsApp number);
• Details of the products you wish to order;
• Photographs or scans of prescriptions, medicine strips, packaging or doctor's notes that you send us;
• Health-related information that you choose to include in your messages (for example, the condition a medicine is for, allergies, or the age of the patient);
• Any delivery instructions, feedback or correspondence you send us.

3.2 Payment information

Payments are processed by our payment-gateway partner, Paytm. Card numbers, UPI IDs, net-banking credentials and similar payment details are collected and processed directly by Paytm on their systems. We do not collect or store your full card, UPI or bank-account details. We receive only limited information such as a transaction/reference ID, the payment amount, and whether the payment succeeded or failed.

3.3 Information collected automatically on the Website

When you visit rioai.in, our hosting provider and standard web technologies may automatically record limited technical data such as your IP address, browser type, device information, referring page and the pages you view. This is used to operate the site, keep it secure and understand aggregate usage. The Website uses only essential cookies needed for it to function; it does not run advertising cookies.

4. How we use your information

We use your information to:

• receive, verify, process, pack and deliver your orders;
• verify prescriptions and dispense prescription medicines in accordance with applicable law;
• take payment and process refunds;
• communicate with you about your order, delivery and support requests;
• handle returns, replacements, complaints and grievances;
• keep records that pharmacy, tax and other laws require us to keep;
• detect, prevent and investigate fraud, misuse and safety issues;
• improve our products, service quality and delivery operations;
• comply with legal obligations and respond to lawful requests from authorities.

5. Legal basis

We process your information on the basis of your consent (which you give by placing an order and sharing your details), to perform our contract with you (delivering your order), to comply with our legal and regulatory obligations (including under the Drugs and Cosmetics Act, 1940 and the Drugs and Cosmetics Rules, 1945), and for our legitimate business interests such as fraud prevention and service improvement.

6. Prescriptions and health information

Prescriptions and health-related details are treated as sensitive personal data. We collect them only to dispense medicines lawfully and safely. Access is restricted to authorised pharmacy and fulfilment staff. We retain prescription records for as long as required under the Drugs and Cosmetics Rules and other applicable law.

7. How we share your information

We share personal information only as needed and only with:

• Delivery personnel – your name, address and phone number, so your order can be delivered;
• Paytm – to process payments and refunds;
• Service providers – IT, cloud hosting, communication and logistics providers who help us run the service, under confidentiality obligations;
• WhatsApp / Meta – as the messaging platform over which you choose to contact us (their own privacy terms apply to the WhatsApp app);
• Regulators and authorities – drug-control, tax, law-enforcement or other authorities where disclosure is required by law or to protect rights, safety or prevent fraud;
• Professional advisers – lawyers, accountants and auditors where necessary;
• A successor entity – in connection with a merger, acquisition or reorganisation, subject to this policy.

We do not sell your personal information, and we do not share it for third-party advertising.

8. Data retention

We keep your personal information for as long as needed for the purposes described above, and for as long as required to meet pharmacy record-keeping, tax, accounting and other legal obligations. When information is no longer required, we delete it or anonymise it.

9. Data security

We use reasonable security practices and procedures to protect your information, including access controls and secure infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own device and WhatsApp account secure.

10. Your rights

Subject to applicable law, you may:

• ask what personal information we hold about you and request a copy;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information we no longer need to keep;
• withdraw your consent to further processing.

To exercise any of these, contact our Grievance Officer (Section 13). Please note that if you withdraw consent or ask us to delete information we need to provide the service or to meet legal obligations, we may not be able to continue serving you, and we may retain records the law requires us to keep.

11. Third-party links

The Website or our messages may link to third-party sites or services (for example, Paytm's payment page). We are not responsible for the privacy practices of those third parties. Please review their policies.

12. Children

Our services are intended for persons aged 18 and above. We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us and we will delete it, except where it must be retained by law. Medicines ordered for a child should be ordered by a responsible adult.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it (and the Digital Personal Data Protection Act, 2023 as and when in force), the contact details of our Grievance Officer are:

We will acknowledge grievances within 48 hours and endeavour to resolve them within the timelines prescribed by applicable law.

14. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. Material changes will be notified where required by law.

15. Contact

Questions about this policy or your information: amitahuja@rioai.in  ·  +91 98716 32212.