Legal
Privacy Policy
How MedNext Academy Private Limited collects, uses and protects personal data under India's DPDP Act 2023 across its public site and learning platform.
Explore MedNextPrivacy Policy
This Privacy Policy explains how MedNext Academy Private Limited (referred to here as MedNext, we, us or our) collects, uses, shares and protects personal data when you use our website at mednext.academy, our learning platform, applications and related services (together, the Services). MedNext Academy Private Limited is a company incorporated in India and is the operator of the Services described here. We handle personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and other applicable Indian law. By using the Services you consent to the practices described in this policy.
1. Who we are. MedNext Academy Private Limited, CIN U80302TZ2021PTC036762, GSTIN 33AAOCM8576G1ZY, with its registered office at 31 Sangamam Nagar, Podanur, Coimbatore, Tamil Nadu 641023, India, is the data fiduciary responsible for personal data processed through the Services. Our main operating and correspondence address is No. 241 Rangarajapuram Main Road, 4th Floor Ziyad Court, Kodambakkam, Chennai 600024, Tamil Nadu, India. MedNext Academy Private Limited is a subsidiary of MedNext Limited, a company incorporated in England and Wales, the parent company of the MedNext group. Services offered by MedNext Limited to users in the United Kingdom are governed by separate UK-law policies published on the relevant UK-facing sites; this policy governs the Services operated from India. For any privacy question or request, contact us at hello@mednext.academy.
2. Scope of this policy. This policy covers personal data processed when you browse our public website, create or use a MedNext account, subscribe to a plan, use our learning and clinical-reference features, contact support, or interact with us through an institution that has purchased access on your behalf. Where your college or institution provides your access under a business agreement, the institution may also have responsibilities for the data it shares with us, and its own policies may apply alongside this one.
3. What data we collect. We collect: account data, such as your name, email address, password (stored only in hashed form) and profile details you choose to provide, for example your course year or exam goal; subscription and payment data, such as your plan, billing history and payment status - payment card and bank details are collected and processed by our payment processor and are not stored by MedNext; learning data, such as chapters read, questions attempted, scores, study time, streaks and progress used to provide study features; support and communications data, such as messages you send to us; and technical data, such as IP address, device and browser type, log data and cookie or local-storage identifiers. Where an institution enrols you, we may receive your name, email address and course details from that institution to set up your access.
4. What we do not collect. MedNext is an education and reference platform, not an electronic health record. We do not collect patient data, patient health records, diagnoses or treatment plans under any circumstances, and you must never submit patient-identifiable information through the Services, including in support requests, community features or notes. We do not collect precise GPS location, your device contact lists, or your files or photos beyond anything you deliberately upload.
5. How and why we use your data. We use personal data to create and manage your account; provide, personalise and improve the learning features, question banks and clinical-reference tools; track study progress and power features such as revision plans and streaks; process subscriptions, billing, renewals and refunds; respond to support requests and grievances; send service and transactional messages and, where permitted, updates about the Services; maintain the security, integrity and reliability of the platform, including preventing fraud, account sharing and scraping; and comply with legal obligations. We do not use your personal data to build advertising profiles, and we do not sell, rent or trade personal data to any third party.
6. Legal basis and consent. Under the DPDP Act we process personal data on the basis of the consent you give when you create an account, subscribe or use the Services, and for certain legitimate uses recognised by the Act, such as processing necessary for the purpose for which you voluntarily provided the data, compliance with law, and responding to legal obligations. Where processing relies on consent, you may withdraw that consent at any time by adjusting your settings, deleting your account or contacting us; withdrawal does not affect processing already carried out and may limit or end your ability to use some or all of the Services.
7. How we share data. We share personal data only with service providers who process it on our instructions to help us run the Services, for example payment processors, cloud hosting and storage providers, analytics providers and email or communication tools. These providers are bound by contractual obligations to protect your data and to use it only for the purposes we specify. Where your access is provided by your institution under a business agreement, we may share enrolment status and aggregate or individual learning-progress information with that institution as agreed in the applicable contract and notified to you. We may also disclose data where required by Indian law or a competent authority, to enforce our terms, or to protect the rights, safety and security of MedNext, our users or the public.
8. Data retention. We retain personal data for as long as your account is active and thereafter only as long as needed to provide the Services, comply with legal, tax, accounting or reporting obligations under Indian law, resolve disputes and enforce our agreements. As a general rule, account and learning data is deleted or anonymised within a reasonable period after account deletion, subject to records we are legally required to keep, such as invoicing and tax records retained for the periods prescribed under GST and other applicable law. When personal data no longer serves the purpose for which it was collected and retention is not required by law, we erase it.
9. Security. We use appropriate technical and organisational safeguards to protect personal data, including encryption of data in transit, hashed password storage, access controls, logging and monitoring, and internal restrictions so that staff access personal data only where there is a legitimate operational need. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we become aware of a personal data breach affecting you, we will notify the Data Protection Board of India and affected users as required by the DPDP Act. Please keep your login credentials confidential and contact us immediately at hello@mednext.academy if you suspect unauthorised access to your account.
10. Your rights as a data principal. Under the DPDP Act you have the right to access a summary of the personal data we process about you and the processing activities involved; the right to correction, completion and updating of your personal data; the right to erasure of personal data that is no longer necessary, subject to legal retention requirements; the right to grievance redressal through our Grievance Officer; and the right to nominate another individual to exercise your rights in the event of death or incapacity. To exercise any right, contact hello@mednext.academy. We may need to verify your identity before acting on a request, and we will respond within the timelines required by applicable law.
11. Your duties as a data principal. The DPDP Act also places duties on data principals. When using the Services you must not impersonate another person, must not suppress material information when providing data for a document or proof, and must not register a false or frivolous grievance or complaint. Please keep the information in your account accurate and up to date.
12. Grievance Officer. In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer for India can be reached at: Grievance Officer, MedNext Academy Private Limited, 31 Sangamam Nagar, Podanur, Coimbatore, Tamil Nadu 641023, India, email hello@mednext.academy (mark the subject line "Grievance"). We will acknowledge grievances promptly and resolve them within the timelines required by applicable law. If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India.
13. Cookies and similar technologies. We use cookies and browser local storage for sign-in and session security, for remembering your preferences, and for privacy-respecting analytics that help us understand how the site is used. Details of each category, and how to manage or refuse cookies, are set out in our Cookie Policy.
14. International transfers and overseas users. MedNext serves learners in India and worldwide, and we may process or store data using reputable cloud service providers with infrastructure in other countries, and may share limited data with our parent company for group administration. Where personal data is transferred outside India, we do so in accordance with the DPDP Act, including any restrictions the Central Government notifies on transfers to specific countries, and we require recipients to protect the data to the standards described in this policy. If you use the Services from outside India, note that your data will be processed by MedNext Academy Private Limited in accordance with Indian law; where laws such as the EU or UK GDPR grant you additional rights as a resident of those jurisdictions, you may contact us at hello@mednext.academy to exercise them.
15. Children and eligibility. The Services are designed for medical students, healthcare professionals and adult learners. We do not knowingly process the personal data of children under 18 years of age without verifiable consent of a parent or lawful guardian as required by the DPDP Act, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided personal data to us without appropriate consent, contact us at hello@mednext.academy so we can delete it.
16. Changes to this policy. We may update this Privacy Policy to reflect changes in our practices, the Services or the law. We will update this page when we do, and where changes are material we will take reasonable steps to notify you, for example by a notice on the platform or an email to your registered address. Please review this policy periodically.
17. Contact. For any privacy question, request or grievance, contact MedNext Academy Private Limited at hello@mednext.academy. Registered office: 31 Sangamam Nagar, Podanur, Coimbatore, Tamil Nadu 641023, India. Correspondence address: No. 241 Rangarajapuram Main Road, 4th Floor Ziyad Court, Kodambakkam, Chennai 600024, Tamil Nadu, India.
Return to MedNext Academy
Explore clinician-written learning resources, structured revision and practice across the MedNext platform.
Explore MedNext