PRIVACY POLICY

1.INTRODUCTION

Zypheal Private Limited (“Zypheal”, “we”, “us”, “our”, and the “Company”, to be construed accordingly) provides nursing and physiotherapy care at the homes of patients, arranged through our website and mobile application (together, the “Platform”). In doing so we necessarily handle information about the health of the people we care for, which is among the most sensitive information a person has. This privacy policy (“Privacy Policy” or “Policy”) explains what we collect, why we collect it, who sees it, how long we keep it, how we protect it and what you may require us to do about it.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), read with the Information Technology Act, 2000 and the rules made under it.

1.1.Who this Policy is for

This Policy applies to visitors to our website and application who do not register; customers who create an account; and patients who receive care, whether or not they hold the account under which the care was booked.

1.2.How to read this Policy

Capitalised terms not defined here carry the meaning given in the Terms of Use and the User Agreement. Where this Policy says that we do not do something, we mean that we do not do it today, and that if we begin to do it we will revise this Policy and tell you before the change takes effect. We have been deliberate about describing what the Company actually does rather than what a policy of this kind customarily says.

2.OUR PRIVACY COMMITMENTS

We handle personal data in accordance with the following principles, which reflect the obligations of a Data Fiduciary under the DPDP Act.

3.DEFINITIONS

“Account Holder” means the person in whose name an account on the Platform is registered and who makes a Booking, whether for themselves or for another person.

“Data Fiduciary”, “Data Principal”, “Data Processor”, “personal data” and “personal data breach” carry the meanings given to them in Section 2 of the DPDP Act.

“Data Protection Board” means the Data Protection Board of India established under the DPDP Act.

“Health Data” means personal data relating to the physical or mental health of a Patient, including conditions, allergies, weight, vital signs, observations recorded at a visit, treatment given, advice given and any document a Patient or Account Holder uploads.

“Patient” means the person who receives the Services, who may or may not be the Account Holder.

“Health Partner” means a nurse or physiotherapist engaged by the Company who attends a Patient.

“Visitor” means a person who accesses the Platform without registering.

“You” means, as the context requires, a Visitor, an Account Holder or a Patient.

4.THE TWO PEOPLE IN EVERY BOOKING

In a great many of our bookings the person who books is not the person who receives care. A son books for his mother; a daughter books for her father after a discharge. This is the ordinary case in home healthcare, and it is the single most important thing to understand about how we handle data, because the law attaches the rights to the Patient and not to the person who pays.

4.1.The Patient is the Data Principal

Under the DPDP Act, the person to whom personal data relates is the Data Principal, and it is that person’s consent that makes the processing of their personal data lawful. Where the Patient is a competent adult, the Account Holder cannot give that consent for them. A person’s family does not hold their privacy rights.

We therefore separate the two things that are commonly run together:

4.2.How the Patient’s consent is taken

The attending Health Partner presents the Notice and the Patient Consent and Data Protection Form at the first visit, in a language the Patient understands where we are able to, explains what they say, and records the Patient’s consent on the Health Partner’s device; and we leave the Patient a printed card carrying the same information, how to reach us and how to withdraw. What is recorded in every case is the version and the exact text shown, the time, and the identity of the person who took the consent.

A Patient may refuse, and a Patient may withdraw at any time. A Health Partner will not proceed with care where the Patient objects, whatever the Account Holder has agreed to.

4.3.Patients who cannot consent for themselves

Where the Patient is a child, consent is given by a parent or lawful guardian in accordance with Clause 6 below. Where the Patient is a person with a disability who has a lawful guardian, or has for the time being lost the capacity to decide, we take the consent of the person lawfully entitled to decide for them; our Health Partner will still explain the care in words the Patient can follow and will not proceed if the Patient objects. Separately, where a threat arises to a Patient’s life or immediate health and the Patient cannot then consent, we act, relying on the legitimate use the DPDP Act recognises for a medical emergency, and we seek their consent as soon as they are able to give it.

Being unable to read or write is not a barrier. Nothing in our consent process requires a Patient to read a screen or sign a document.

4.4.What the Account Holder sees, and what they do not

The clinical note made at a visit is shown to no customer at all, including the Account Holder. An Account Holder sees that a visit was booked, for whom, where and when, that it took place, and what it cost.

In addition, a Patient may instruct us not to share information about them with the person who booked or paid, and we will honour that instruction from the moment it is given. The instruction may be given to the attending Health Partner or to our support team. Where it is given, the Account Holder is told only what is necessary for them to know that the visit they arranged and paid for took place.

5.NOTICE

This Clause sets out the personal data we collect, the purposes for which we process it and the basis on which we do so. The Data Protection Notice we present when we ask for your consent is to the same effect.

5.1.The personal data we collect, and how long we keep it

5.2.Why we process personal data

5.3.What we do not collect

We think it is as useful to tell you what we have decided not to take as to tell you what we take. As at the date of this Policy:

5.4.Option to decline consent

You may grant or withhold any consent we rely on. Where the processing you decline is essential to providing the Services safely, we may be unable to provide them, and we will tell you so on the screen before you confirm rather than afterwards. Declining an optional consent never affects the Services.

6.CHILDREN AND PERSONS WITH A LAWFUL GUARDIAN

A person under the age of 18 may not hold an account on the Platform or make a Booking for themselves. We ask for date of birth, and where an Account Holder’s own date of birth shows them to be under 18 we do not accept the registration or the Booking.

A child may receive care, booked for them by a parent or lawful guardian who holds the account. This is the ordinary paediatric route, and it matters here because our mother and baby care service is provided to newborns and infants, whose personal data is a child’s personal data from the first visit.

What we do to verify that consent is this. The parent or lawful guardian holds an account whose mobile number has been verified by a one-time code. From within that signed-in account they add the child as a family member, state their relationship to the child, and give a separate and expressly recorded consent naming that child. We store the account holder’s verified identity, the declared relationship, the child’s identity as given, the version and text of the notice shown, and the time and IP address of the consent. We do not accept a Booking, and no care is given, for a child unless that consent is on record. We do not ask for a birth certificate or a guardianship order, and no such document is a condition of receiving care. We do not track a child, monitor a child’s behaviour, or direct any advertising at a child.

The same arrangements apply to a Patient who is a person with a disability and who has a lawful guardian appointed under any law for the time being in force.

7.HOW WE OBTAIN AND RECORD CONSENT

7.1.Where consent is taken

Consent is taken at the point at which it is needed, on its own screen, and not buried in the acceptance of a contract. Specifically:

7.2.What we record

For every acceptance we record who gave it, which document and version they were shown, the exact text of that version, when they gave it, the Booking it relates to where relevant and, for a consent given on behalf of another person, the identity of that person. We keep that record so that we can show you later precisely what you saw and agreed to. It cannot be altered once written.

7.3.Withdrawing Consent

You may withdraw any consent at any time. You can do so in the application where it offers the control, by writing to us at support@zypheal.com, by telling our support team, or by telling the attending Health Partner. It is no harder to withdraw than it was to give, you do not need to explain yourself, and you do not need anyone’s permission. A Patient may withdraw their own consent directly and never has to ask the person who booked to do it for them.

Withdrawal takes effect at once. The consent record is stamped as withdrawn and our systems then refuse any new Booking or clinical entry that would have depended on it. Withdrawal operates for the future: it does not affect anything lawfully done before it, and it does not displace an obligation imposed by law to retain a record of care already given. Where withdrawal means we can no longer provide the Services, the screen tells you so before you confirm.

7.4.Consent Managers

We manage consent ourselves and are not registered with, and do not route consent through, a Consent Manager under Section 6(7) of the DPDP Act and Rule 4 of the DPDP Rules. If that changes we will say so here.

8.RETENTION, ERASURE AND ACCOUNT CLOSURE

8.1.How long we keep things

We keep personal data only for as long as the purpose for which it was collected is served, and erase it when that purpose is no longer served, unless a law requires us to keep it longer. The periods are those in the table at Clause 5.1. The principal ones are these.

8.2.Closing your Account

You may ask us at any time to close your account, in the application where it offers the control or by writing to us at support@zypheal.com. On closure we erase your name, e-mail address, date of birth, saved addresses, family member records, uploaded documents, chat messages, device tokens and communication preferences, and we overwrite your mobile number and every remaining identifying field with a non-identifying placeholder, so that nothing links the account to a person. We complete this within 30 days. Your clinical records are separated from your identity at once and destroyed at the end of the period above.

8.3.The three things we keep, and why

Three records survive closure, in every case stripped of any name, address, telephone number or clinical detail, and in every case append-only and incapable of being edited by anyone, including us:

8.4.Backups

Backups are encrypted and are held by our managed database service for 14 days. A single record cannot be removed from a backup that has already been taken. We state that plainly rather than promise something the technology cannot do. A record you have asked us to delete is deleted from the live system at once; the backups that still contain it expire on their own 14-day cycle, after which no copy remains.

9.WHERE YOUR DATA IS STORED

All personal data is stored on servers located in India. Every part of our system is configured to that effect, and it is not a default we have simply left in place.

A limited amount of personal data is handled outside India by the service providers who deliver messages and notifications to you, who convert an address into a location, and who receive reports of errors in our application. What reaches them is narrow — a mobile number and the text of a message, a notification token, an address, or a report of an error, which carries the kind of device, its operating system and the version of the application, and no name, telephone number or health information. Your clinical records never leave India.

No website measurement data leaves India, and none of it is shared with anyone. No transfer we make is to a country restricted by the Central Government under Section 16 of the DPDP Act, and we will revise this Clause if that changes.

Limited hard-copy records, where any are kept, are held in secure, access-controlled premises in India.

10.WHO WE SHARE YOUR DATA WITH

10.1.Our service providers

To operate the Platform we share personal data with service providers who host our systems, process payments, deliver messages and notifications, provide mapping and address services, and receive reports of errors in our application. Each acts as our Data Processor, on our documented instructions and under a written contract requiring equivalent safeguards. If you ask us, we will tell you which of them holds your personal data.

10.2.The attending Health Partner

The Health Partner assigned to a visit sees only the Patient they are then assigned to, and only what bears on the care they are about to give, such as conditions, allergies, age rather than date of birth, gender and weight, together with the service address. Access ends when the visit is completed and the note window closes. The clinical record of a visit is read by the attending Health Partner and by our medical officer and the clinical supervisors who oversee that care, and by no one else; support staff see only what a Booking requires. Every such reading is logged against the person who made it.

10.3.Other disclosures

We may also disclose personal data where the disclosure is required by law or by an order of a court or of a competent authority; in response to a lawful request from a regulator, a police authority or the Data Protection Board; where it is necessary to investigate or prevent fraud, misuse or a threat to the safety of any person; and where it is necessary to establish, exercise or defend a legal claim. In a merger, acquisition or transfer of business, personal data may pass to the successor, which must assume the obligations in this Policy or offer materially equivalent protection, and we will tell you before that happens.

We do not sell personal data, and we do not share it with any advertiser, data broker or analytics provider.

11.SECURITY

We protect personal data by the technical and organisational measures required of a Data Fiduciary by Section 8(5) of the DPDP Act and Rule 6(1) of the DPDP Rules. In outline, data is encrypted in transit and at rest; access is granted on a need-to-know basis and is restricted by role, so that clinical records are read only by the attending Health Partner and by our medical officer and clinical supervisors, are not available to office or support staff, and are open to the attending Health Partner only for the period of the visit; sign-in is by a one-time code sent to your registered mobile number, and we do not use passwords at all; access to identity and clinical data is logged, and those logs are retained for 12 months as Rule 6(1)(e) requires; and backups are encrypted and are tested by restoration. Our Data Processors are engaged under written contracts requiring equivalent safeguards. We review these measures periodically and as our systems change.

We do not publish the detail of our security architecture, because publishing it would weaken it. We will describe it, to the extent appropriate, to a regulator, an auditor or a customer with a proper interest, under suitable confidentiality.

11.1.If something goes wrong

In the event of a personal data breach we will intimate each affected Data Principal without delay, describing the nature and extent of the breach, when and where it occurred, its likely consequences, the measures we have taken, what you can do to protect yourself, and how to reach us. We will intimate the Data Protection Board of India without delay and furnish the detailed particulars it requires within 72 hours, and we will report any reportable cyber security incident to CERT-In within 6 hours of becoming aware of it.

11.2.Residual risk

No method of electronic transmission or storage is wholly secure, and we do not say otherwise. Our liability in respect of a security incident is as provided by applicable law and by the Terms of Use/User Agreement, and nothing in this Policy excludes or limits any liability which cannot lawfully be excluded, including under the DPDP Act and the Consumer Protection Act, 2019.

12.YOUR RIGHTS

The DPDP Act confers the following rights on you, and we honour all of them. A Patient holds these rights in respect of their own personal data whether or not they hold the account under which care was booked.

12.1.When a Patient dies

We provide palliative care and we care for a great many elderly patients, so we have thought about this rather than leave it to be worked out at the time. The DPDP Act confers rights on living persons, and the Act’s rights do not survive a Data Principal. Two things follow. A nomination made recorded with us is what entitles the nominee to exercise the Patient’s rights, and we encourage every Patient to make one. In the absence of a nomination we will deal with the legal representative of the deceased on production of reasonable proof of that capacity, and we will release the records of the care given, which the family is often entitled to and almost always needs. The retention periods at Clause 8 continue to apply, and the account may be closed by the nominee or the legal representative on the same terms as by the Patient.

12.2.How to make a request

Write to us at support@zypheal.com, or use your account settings where the application offers the control. Please give us enough to identify you and to locate the data; ordinarily the registered mobile number is enough, and we may ask you to confirm it by a one-time code. We do not require any identity document.

We will acknowledge a request or a grievance within 48 hours and respond substantively within 30 days of receipt. Where a request is complex we will tell you, before that period expires, why more time is needed and when you may expect an answer.

You also have duties under Section 15 of the DPDP Act, which include not impersonating another person when providing personal data, not suppressing material information, and furnishing only verifiably authentic particulars when seeking correction or erasure.

12.3.If you are not satisfied

If our response does not satisfy you, you may complain to the Data Protection Board of India. Nothing in this Policy limits any right you have under the Consumer Protection Act, 2019, and nothing in it requires you to arbitrate a complaint about your personal data.

13.AUTOMATED DECISION-MAKING AND ARTIFICIAL INTELLIGENCE

We do not use artificial intelligence or machine learning on customer or patient data, and no decision affecting you is taken by automated means alone. We use no such tool for transcription, summarisation, triage, scheduling or document extraction.

If we build any such feature we will revise this Policy and tell you before it is switched on. We have committed ourselves to one rule in advance, and record it here so that we may be held to it: a clinical note will not be put into a model prompt.

14.COOKIES, MEASUREMENT AND THE WEBSITE

14.1.Cookies

We set no non-essential cookies, and for that reason you will not see a cookie banner. The only cookies we set are those which keep a signed-in session working, which are strictly necessary for the Services and for which consent is not required.

14.2.How we measure our Website

We measure our own website on our own servers. There is no Google Analytics, no Meta pixel, no Google Ads tag, no heatmap tool and no session-recording tool, so no third party receives anything about your visit and the familiar concern about a session recorder capturing what you type into a form does not arise here.

What we record for a page view is the page path, the time it was opened, the broad kind of device, browser and operating system, and a one-way identifier derived from your IP address and browser. Neither your IP address nor your browser details are stored. We record no location from your connection: no city, no region, no coordinates.

We describe this plainly because it deserves to be understood: that identifier can recognise the same browser for up to 12 months. It is never joined to an account, never sits beside a name, a telephone number or an e-mail address, and identifies a browser rather than a person. It sets no cookie and writes nothing to your device.

Two limits are absolute. A signed-in Patient’s own pages: bookings, care plans, messages, profile and consent history are not recorded anywhere. And the query string is discarded from every page view without exception, because what a person types into our search can itself be health information. Search terms are counted so that we learn what care people are looking for, but they are stored with no identifier of any kind beside them, and cannot be connected to a visit, a device or a person.

14.3.Location on the Website and in the Application

The website, or our application on your phone, may ask for a single position, in order to tell you whether we serve your area. Your browser or phone will ask you first, and you may refuse. A position you give us, whether in this way or by choosing a place on the map, is kept rounded to the nearest 100 metres, for no more than 180 days, so that we can learn where people are asking for care that we cannot yet provide; while it is kept it may sit beside the one-way identifier described at Clause 14.2. It is kept in full only if you confirm it as your address.

15.COMMUNICATIONS

We send you service communications such as login codes, booking confirmations, arrival notifications and invoices because they are necessary to provide the Services. Marketing communications are sent only if you have left that channel switched on.

Each channel such as SMS, e-mail and WhatsApp may be turned off individually in account settings, and marketing may be refused without affecting anything else. Turning off a channel can never lock you out of your own account; login codes are always delivered. Promotional messages are sent in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018.

We do not target any marketing communication by reference to a diagnosis, a condition or anything else we have learnt about a Patient’s health.

16.OTHER MATTERS

16.1.Links to other Sites

The Platform may link to third-party sites for reference or convenience. Once you leave, their terms apply, and we are not responsible for their content, security or privacy practices.

16.2.Public Contributions

If we introduce a blog, a forum or a comment facility, anything you choose to publish there is public by design and is shared at your own risk. Please do not post health information about yourself or anyone else.

16.3.Changes to this Policy

As our systems and the law develop, this Policy may be revised. A revised Policy is published at the same address with a new version number and a new effective date. Where a change affects what is done with your personal data we will give you notice by e-mail, SMS or in the application before it takes effect, and we will ask for your consent afresh where consent is required. Continuing to use the Platform after a change takes effect acknowledges the revised Policy, but it is not, and we do not treat it as, consent to any new processing.

16.4.Language

This Policy is published in English. On request we will provide it, or its key parts, in any language specified in the Eighth Schedule to the Constitution of India. Please write to us.

16.5.Governing law

This Policy is governed by the laws of India. Nothing in it affects the jurisdiction of the Data Protection Board of India or of any consumer commission.

17.HOW TO CONTACT US