-------------------------------------------------- DRAFT FOR ATTORNEY REVIEW ONLY — NOT LEGAL ADVICE This Data Breach Response Letter is a preparation draft only. Notification deadlines and content requirements under the DPDP Act 2023 India and CERT-In directions must be confirmed with a qualified Indian attorney immediately. All facts must be verified by MediCare Diagnostics Pvt Ltd before sending. This letter does not guarantee compliance with any law. -------------------------------------------------- 1. LETTER HEADER MediCare Diagnostics Pvt Ltd Pune, Maharashtra, India Date: October 30 2026 Reference: DBL-2026-001 Subject: Notice about a data security incident affecting your personal information Dear Valued Customer, 2. OPENING STATEMENT We are writing to tell you about a data security incident that affected some of your personal information. This letter explains what happened, what information was involved, what we are doing, and what you can do. 3. WHAT HAPPENED Between October 3 and October 5 2026, an unauthorized person used login details belonging to one of our software vendors to access our customer booking database. We became aware on October 6 2026 and shut off the access the same day. Our investigation is still continuing. 4. WHAT INFORMATION WAS INVOLVED The information involved includes your name, mobile number, email address, and the names of tests you booked. About 12,000 customers were affected. Based on our investigation so far, Aadhaar numbers, bank or card details, and full test reports were not accessed. 5. WHAT WE ARE DOING 1. We disabled the vendor login details. 2. We reset all staff passwords. 3. We added two-step login for system access. 4. We hired an independent forensic firm to investigate. 5. We reported the incident to CERT-In. 6. WHAT YOU CAN DO 1. Be careful with calls or messages that mention your tests or bookings. 2. Never share OTPs or passwords with anyone. We will never ask for them. 3. Check your bank and card statements for unfamiliar activity. 4. Report suspected fraud to the national cybercrime portal at cybercrime.gov.in. 7. SUPPORT WE ARE OFFERING We are not offering paid monitoring. Our helpline in Section 9 is available to answer your questions. 8. NOTIFICATION TO AUTHORITIES We have notified CERT-In. Notification to the Data Protection Board of India is to be confirmed by the organization. 9. CONTACT AND HELP Contact: Anita Rao, Data Protection Officer Helpline: 1800 123 4567 Hours: 9 AM to 7 PM, Monday to Saturday Email: privacy@medicarediagnostics.example Address: MediCare Diagnostics Pvt Ltd, Pune, Maharashtra, India You may also complain to the Data Protection Board of India. 10. CLOSING We are sorry for the worry this incident may cause you, and we take the protection of your information seriously. Anita Rao Data Protection Officer MediCare Diagnostics Pvt Ltd REVIEWER NOTES ON DEADLINES (planning notes only) 1. CERT-In directions require reporting of certain incidents within a short fixed period after noticing. Confirm now. 2. DPDP Act 2023 duties to inform the Board and each affected person, and their timing, must be confirmed. 3. Mandatory content of the notice must be confirmed against the DPDP Act and its rules. 4. Confirm whether the vendor contract, police, or other bodies must be told. 5. Deadlines run from awareness on October 6 2026. An attorney must confirm them urgently. PLAIN ENGLISH SUMMARY This letter tells customers a vendor login was misused to reach a booking database. It explains the timeline and the data involved in short plain sentences. It says how sorry we are without using words that admit legal fault, while still being honest about the incident. It gives customers simple steps such as protecting OTPs and checking statements. Before sending, an attorney must confirm deadlines, content, and every fact. BREACH LETTER CHECKLIST (planning aid only) - Facts verified by the incident lead - Attorney review completed - CERT-In and Board notices filed or set - Recipient list confirmed - Helpline staffed and scripted - Senior management approval obtained - Email and post method chosen - Copies retained and follow-up set WHAT TO CONFIRM BEFORE SENDING 1. The CERT-In reporting deadline. 2. The DPDP Act deadline and content rules for notifying affected people. 3. Whether health data rules apply to test names. 4. Whether the vendor and police must be told. 5. That every statement about the incident is accurate and complete. 6. Attorney review of the full letter. -------------------------------------------------- This Data Breach Response Letter draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute legal advice and does not guarantee compliance with any breach notification law. Deadlines may already be running. All facts must be verified before sending. --------------------------------------------------