Privacy policy

Account data: name, phone number, email (optional), language preference.

Care details: service requested, patient age and conditions, medication list (when shared), care plan, vitals, visit logs.

Booking data: address, scheduling preferences, payment method (via Cashfree, never directly stored).

Usage data: pages visited, device type, approximate location (city), IP address. Used for security and product analytics; never sold.

• Deliver care services through the booked agency
• Process payments and issue invoices
• Send booking notifications (push, WhatsApp, SMS)
• Detect fraud and abuse
• Improve the product (anonymous, aggregated)
• Comply with Indian law and regulator requirements

The agency you book. They get the care details they need to deliver service — and only those.

Cashfree for payment processing.

Service providers for hosting (AWS ap-south-1), email, SMS, and analytics — under data processing agreements.

We do not share your data with insurers, advertisers, or any other third party without your explicit consent.

Data is encrypted in transit (TLS 1.2+) and at rest. Access inside our team is RBAC-controlled and audited. We follow the controls documented in our public SECURITY.md and are independently pen-tested annually.

If we discover a personal-data breach affecting you, we will notify you within 72 hours per DPDP requirements.

• Bookings & invoices: 7 years (regulatory)
• Audit logs: 2 years
• OTP and login logs: 30 days
• Marketing analytics: 13 months
• Account and personal data: until you delete your account. Your account closes immediately; the data is deleted 90 days later, so you can change your mind or take a copy
• Medical records created by a doctor — consultations, prescriptions, lab results: 3 years from the date of treatment, as India’s medical-records rules require, and longer where a case is medico-legal or the patient was a minor. Kept disconnected from your identity once your account is deleted

You can:

• Access the data we hold about you, and a summary of how it is processed
• Correct, complete or update inaccurate data
• Delete your account and data
• Withdraw consent at any time, for marketing or for processing
• Nominate someone to exercise these rights on your behalf if you die or become unable to
• Raise a grievance with us. Under the DPDP Act you must give us the chance to resolve it first; if we do not, you may then complain to the Data Protection Board of India

You can delete your account and data yourself from the account deletion page. To exercise any other right, email care@aayulhealth.com. We respond within 30 days.

The marketplace is for adults. Care booked for a child must be booked by a parent or legal guardian, who is the data principal for that booking.

All personal data is stored in AWS Mumbai (ap-south-1) by default. We do not transfer personal data outside India except where strictly required (e.g. SDK error reporting), and only under DPDP-compliant safeguards.

Material changes get email notice and a 14-day lead time before they take effect. Cosmetic changes (typos, formatting) are made silently.

Aayul Health Pvt Ltd · DPO: care@aayulhealth.com · India