Privacy Policy

1. Who we are

Ayorva (“we”, “us”, “our”) operates Ayorva, a platform for healthcare discovery, appointment booking, and clinic practice management.

For clinics and providers using Ayorva, you may also be a Data Fiduciary or co-fiduciary for patient data you enter into your systems. This policy describes Ayorva’s processing as a platform; your agreements with patients and your legal counsel govern your independent obligations.

2. Scope & lawful bases

We process personal data only for specified, lawful purposes, including:

• Service delivery: accounts, profiles, bookings, prescriptions, billing, reminders, and in-app features you choose to use.
• Consent: where required or appropriate (e.g. optional communications, certain analytics, AI-assisted tools where we rely on consent).
• Legal obligation & legitimate uses: security, fraud prevention, dispute resolution, and compliance with court or regulatory requests.

Where processing is based on consent, you may withdraw it as described in this policy and in your account; withdrawal does not affect the lawfulness of processing before withdrawal, and some processing may continue where another lawful basis applies (e.g. legal retention).

3. Categories of personal data

• Identity & contact: name, phone, email, address (as provided).
• Account & profile: date of birth, gender, blood group, allergies, and similar fields you or your clinic add.
• Health & clinical: appointments, clinical notes, prescriptions, lab orders, procedures, documents, and messages related to care — as supplied by you or your provider.
• Technical & usage: IP address, device/browser type, logs, cookies, and security telemetry.
• Communications: support tickets, WhatsApp or SMS threads where used for operational messages, and notification preferences.

4. How we use data

• Operate and secure the platform; authenticate users; sync data across devices where applicable.
• Send transactional messages (appointments, prescriptions, invoices) via channels you or your clinic configure.
• Provide optional features such as Health AI only where enabled and, where configured, after recorded consent.
• Improve reliability and safety; monitor abuse; train staff; comply with law.

We do not sell personal data to third parties for unrelated marketing.

5. Sharing & processors

We may disclose personal data to:

• Your clinic and providers for care and administration.
• Processors who assist us, under contracts that require confidentiality and appropriate security. Our key processors are: Oracle Cloud Infrastructure (hosting, Mumbai), Meta Platforms (WhatsApp notification delivery), Razorpay (online payments), 100ms (video consultation media), Sentry (mobile crash and error diagnostics), and OpenAI (optional AI-assisted features, only with your consent).
• Infrastructure & security services such as DDoS protection and TLS termination (e.g. Cloudflare) that may process technical data in transit.
• Authorities when required by applicable law.

A list of key processor categories appears in our internal records; you may request more detail via the contact below.

6. Cross-border transfers

Our platform and patient data are hosted on Oracle Cloud Infrastructure in Mumbai, India. WhatsApp notifications are delivered through Meta Platforms, whose infrastructure may process message data outside India. Optional AI-assisted features are processed by OpenAI in the United States and run only with your consent. Crash and error diagnostics from our mobile apps are processed by Sentry in the United States; these reports carry technical data (device model, app version, error stack traces) and an internal account identifier only — request URLs are stripped of record identifiers before they leave your device, and no name, phone number, or clinical content is included. Video consultations are carried by 100ms, whose global media infrastructure relays the audio and video of a consultation while the call is in progress; we do not record consultations. Online payments are processed by Razorpay, an Indian payment gateway that stores card and UPI details on its own systems in India — we never receive or store your full payment credentials. Where data leaves India, we apply the safeguards required under applicable law and our processor agreements.

7. Retention

We retain data only as long as needed for the purposes above, including statutory retention for health and financial records, dispute resolution, and backups. Retention periods may differ by data category and clinic settings. You may request erasure where the law permits; some records must be retained to meet legal or clinical obligations.

8. Security

We implement technical and organisational measures including TLS (HTTPS) for data in transit, access controls, encryption of selected sensitive fields at the application layer where implemented, audit logging for key actions, rate limiting, and secure development practices. No method of transmission or storage is 100% secure; please use strong passwords and protect your devices.

9. Automated processing & AI

Some features may use automated or AI-assisted tools (e.g. health information assistants). These tools do not replace professional medical advice. Where we rely on consent for such processing, you can manage preferences in your profile. Outputs may be logged only in line with our security and minimisation practices.

10. Your rights (Data Principal)

Subject to applicable law, you may:

• Request access to a summary of your personal data we process as a platform.
• Request correction of inaccurate data in your profile or ask your clinic to correct clinical records they control.
• Request erasure or restriction where grounds exist under law.
• Withdraw consent for processing that is consent-based, via profile settings and consent screens.
• Seek redress through our grievance channel below, and where applicable, before the Data Protection Board of India.
• Provide a nominee where the law allows — submit details through a data request.

Submit requests from My profile → Privacy & your data on the website (when logged in), or email [email protected]. We aim to acknowledge requests within 30 days where applicable.

11. Grievance officer

For complaints about how we handle personal data, contact [email protected]. If you are unsatisfied with the outcome, you may escalate under applicable law (including, where relevant, the Data Protection Board of India).

12. Personal data breach

If we become aware of a breach that materially affects your personal data, we will take steps to contain it, assess impact, and notify authorities and/or affected individuals where required by law. We maintain internal procedures for incident response.

13. Children

Our services are not directed at children without verifiable parental or guardian consent. If you register a minor, the guardian must confirm consent at sign-up. If you believe we have collected a child’s data without proper authority, contact us to request deletion.

14. Cookies & similar technologies

We use cookies and similar technologies for essential operation, session security, and preferences. You can control cookies in your browser; disabling them may limit some features.

15. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or business changes. We will revise the “Last updated” date and version above. For material changes, we may provide additional notice (e.g. banner, email) where required. Continued use after notice may constitute acceptance where permitted by law.

16. Contact

General enquiries: Contact us. Privacy & data rights: [email protected].