Zypheal
Zypheal

Zypheal Terms and Conditions

Version 2026-09-28.1

Zypheal Private Limited

Last updated: 28 September 2026 | Version: V1-2026 | Effective from: 24 September 2026

These Terms and Conditions are one document in three sections: the User Agreement, which is the contract for the services and applies once you hold an account; the Terms of Use, which governs use of our website and app by every person, whether you hold an account or not; and the Data Privacy Checklist, which sets out in full what personal information we hold, why, who else sees it and what you can ask us to do with it. Each section is reproduced in full and unaltered, and keeps its own clause numbering, so a reference to a clause of the Terms of Use or of the User Agreement is to a clause of that section.

User Agreement

1. Scope of this Agreement and nature of the relationship

1.1 This User Agreement (the “Agreement”) is a legally binding contract between Zypheal Private Limited, a company incorporated under the Companies Act, 2013, having corporate identity number U62099KA2026PTC225979 and its registered office at F1002, Tower 1, Gulmohar, Adarsh Palm Retreat, Bellandur, Bangalore South, Karnataka 560103, India (the “Company”, “Zypheal”, “we” or “us”) and the person who makes a Booking through the Platform (the “User” or “you”).

1.2 This Agreement takes effect when you create an Account on the Platform, continues for as long as you hold an Account, and governs your registration, your Account, every Booking you make and the provision of the Services. It applies in addition to the Terms of Use, which govern access to and use of the Platform by every person, whether registered or not.

1.3 Where the Services are to be rendered to a Patient, the Patient Consent and Data Protection Form must also be completed by the Patient, or by the person lawfully entitled to consent on the Patient’s behalf, before the Services begin. Your acceptance of this Agreement is not a substitute for that consent.

1.4 The Services currently comprise home nursing services and home physiotherapy services, rendered at the Service Address. The Services do not include medical consultation, teleconsultation, diagnosis, prescription, the supply of medicines, diagnostic or laboratory services, or emergency or ambulance services.

1.5 In the event of any inconsistency, the order of precedence is: (a) the Booking Confirmation; (b) this Agreement (including its Schedules); (c) the Terms of Use; and (d) the Policies.

1.6 Capitalised terms used but not defined in this Agreement have the meanings given to them in Schedule A or, if not defined there, in the Terms of Use.

2. Registration and your Account

2.1 To register you must be at least 18 (eighteen) years of age and competent to contract under the Indian Contract Act, 1872. You must provide your name, mobile number and e-mail address and complete the verification the Company requires, and you must accept this Agreement. Registration is complete only on your acceptance of this Agreement and the Privacy Policy, and the Company will retain a copy of this Agreement as accepted by you, with the date and time of acceptance, in your Account.

2.2 You must provide information that is true, accurate, current and complete and must keep it updated. The Company may require verification of your identity or address at any time, and may refuse, restrict or suspend registration where information cannot be verified.

2.3 You may hold only one Account, and you are responsible for the confidentiality of your credentials and any one-time password, and for all activity through your Account. You must notify the Company immediately of any unauthorised use.

2.4 Your Account may hold one or more Patient profiles. By adding a Patient profile you make the representations in Clause 3.2 in respect of that Patient. The Company may require evidence of your authority, and may remove a Patient profile where authority is not established or is withdrawn.

2.5 You may deactivate or close your Account at any time through the Platform or by writing to the Company. Closure does not affect a Booking already confirmed, any Fee already due, the Company’s obligation to retain clinical records as required by law, or any provision of this Agreement expressed to survive.

2.6 Registering an Account does not oblige you to make any Booking, and does not oblige the Company to accept one.

3. The User, the Patient and Bookings made on behalf of another person

3.1 A Booking may be made by the Patient personally, or by another person on the Patient’s behalf. Where the person making the Booking is not the Patient, that person is referred to in this Agreement as the “Requesting User”. The Requesting User is the contracting party, is responsible for the Fees, and remains bound by this Agreement whether or not the Patient is aware of, or agrees with, any particular arrangement.

3.2 By making a Booking on behalf of a Patient, the Requesting User represents and warrants to the Company that:

  • the Requesting User has disclosed accurately his or her relationship to the Patient (such as spouse, child, parent, sibling, relative, guardian, attorney under a power of attorney, employer, neighbour or friend);
  • the Requesting User is authorised by the Patient to make the Booking or, where the Patient is unable to give that authority, is a parent, lawful guardian, holder of a valid power of attorney, or is otherwise a person lawfully entitled to make arrangements for the Patient’s care;
  • the clinical and personal information provided about the Patient including diagnosis, prescriptions, allergies, infection status, mobility, cognitive status and history of aggression is accurate and complete to the best of the Requesting User’s knowledge, and the Requesting User will update it promptly on any change;
  • the Requesting User is authorised to provide the Patient’s personal data and health data to the Company, and (where the Patient is a child or a person with a disability who has a lawful guardian) gives consent on that person’s behalf as required by section 9 of the Digital Personal Data Protection Act, 2023; and
  • the Requesting User will convey to the Patient any information about the Services that the Patient needs in order to receive them safely, and will convey to the Company any material information communicated by the Patient. 3.3 Booking is not consent to treatment. Where the Patient is able to make decisions for himself or herself, the Practitioner will explain the proposed care to the Patient and obtain the Patient’s own informed consent before rendering any procedure. The Patient may refuse or withdraw consent at any time, in which case the Practitioner will stop. Where the Patient is unable to make decisions, consent will be taken from the parent, lawful guardian or other person lawfully entitled to give it.

3.4 A Patient who is able to make decisions for himself or herself may direct the Company not to share information about his or her condition or treatment with the Requesting User. The Company will respect such a direction, and may as a result be unable to provide the Requesting User with updates, visit notes or records. The Requesting User acknowledges this and agrees that Fees remain payable notwithstanding.

3.5 Where the Patient is a minor, an adult member of the household must be present at the Service Address throughout each visit. The Company may decline to render, or may discontinue, a Service where no such adult is present.

3.6 Where more than one person makes or is associated with a Booking for the same Patient, the Company may treat any of them as authorised to give instructions, and each of them is jointly and severally liable for the Fees. Where instructions conflict, the Company will act on the instruction of the Patient if the Patient is able to give it, and otherwise on the instruction of the person who made the Booking, and may suspend the Services until the conflict is resolved.

3.7 A Requesting User may be substituted, and the Patient may take over a Booking, by written notice to the Company, subject to settlement of Fees then due.

4. Bookings, allocation and scheduling

4.1 You may request a Service by selecting the service type, date, time, duration and Service Address on the Platform and providing the required information. A request is an offer; a contract for that Service arises only when the Company issues a Booking Confirmation.

4.2 All Bookings are subject to the availability of a suitably qualified Practitioner in the relevant locality. The Company will use reasonable efforts to allocate a Practitioner who meets any stated preference (including a preference as to the gender of the Practitioner), but preferences cannot be guaranteed.

4.3 The Company may require, before accepting or continuing a Booking: a prescription, referral, discharge summary or care plan from a registered medical practitioner; a clinical assessment (which may be chargeable); or further information about the Patient or the Service Address.

4.4 The Company may decline a Booking, or discontinue a Service, where: (a) the Patient’s clinical needs cannot in the Company’s reasonable opinion be met safely at the Service Address, or require hospital care; (b) the information provided is materially inaccurate or incomplete; (c) the Service Address is unsafe or unsuitable; (d) the conduct of any person at the Service Address places the Practitioner at risk or breaches Clause 6.4; (e) Fees remain unpaid; or (f) the Company is prevented by law. Where the Company declines or discontinues for a reason other than your breach, it will refund the Fees for the Services not rendered.

4.5 The Company allocates Practitioners to Bookings and may substitute one Practitioner for another at any time, including at short notice on account of illness, leave, safety, roster requirements or the clinical needs of the Patient. You do not acquire any right to the services of a particular Practitioner. The Company will use reasonable efforts to maintain continuity of care for Bookings of longer duration.

4.6 The Services are rendered for the duration stated in the Booking Confirmation. A Practitioner is not obliged to remain beyond that duration. Any extension is subject to availability and is chargeable on a pro-rata basis at the rates notified by the Company.

4.7 Where a Practitioner is delayed, the Company will inform you and will, at your option, reschedule the visit or extend it by the period of the delay where practicable, or refund the Fee for that visit if the delay exceeds 120 (one hundred twenty) minutes.

5. The Services: standard, scope and exclusions

5.1 The Company will render the Services with the reasonable skill and care to be expected of a competent practitioner of the relevant category, in accordance with the Company’s clinical protocols and with applicable law.

5.2 Each Practitioner renders the Services strictly within the scope of practice, training and competence applicable to his or her category of registration. Nurses hold registration with the competent State Nursing Council, and physiotherapists hold registration with the competent State Allied and Healthcare Council under the National Commission for Allied and Healthcare Professions Act, 2021.

5.3 No Practitioner will diagnose any condition, prescribe, substitute, alter or discontinue any medicine, or perform any act reserved to a registered medical practitioner. Nurses administer medicines only in accordance with the written prescription of a registered medical practitioner. Any request to act outside that limit will be refused, and the refusal is not a deficiency in service.

5.4 The Services do not include domestic work, cooking, cleaning beyond the Patient’s immediate care area, child care, care of other members of the household, or accompanying the Patient outside the Service Address unless the Booking Confirmation expressly provides for it.

5.5 The Company gives no warranty as to clinical outcome. Recovery, improvement or the response of a Patient to nursing or physiotherapy care depends on factors outside the Company’s control, and no statement on the Platform or by any Practitioner is a promise or guarantee of any particular outcome.

5.6 Unless the Booking Confirmation states otherwise, medicines, consumables, dressings, mobility aids and medical equipment required for the Patient’s care are to be arranged and paid for by the Patient or the household. Any equipment or instrument brought by the Company remains the property of the Company, must not be retained, and must be returned on request.

6. Obligations of the User, the Patient and the household

6.1 You must disclose, before the Services begin and on any change: the Patient’s diagnosis and current prescriptions; known allergies; any communicable or infectious condition (including tuberculosis, hepatitis, HIV, COVID-19 or a multi-drug-resistant organism); any history of aggression, wandering or self-harm; any cognitive impairment; and any other matter relevant to the safety of the Patient or the Practitioner.

6.2 You must provide a safe and suitable working environment, including: safe access to the Service Address; adequate light and ventilation; clean water and hand-washing facilities; a place for the Practitioner to keep his or her belongings; freedom from smoking in the room during a visit; and the restraint of pets.

6.3 An adult member of the household or an attendant must be present where the Patient is a minor, where the Patient has a cognitive impairment, at a first visit, and wherever the Booking Confirmation so requires.

6.4 No person at the Service Address may subject a Practitioner to abuse, threat, violence, harassment, or discrimination on the ground of caste, religion, gender, region, language or any other ground, or to any conduct of a sexual nature. The Company will withdraw the Practitioner immediately and may terminate this Agreement without refund of the Fee for the visit concerned. You acknowledge that the Service Address is the Practitioner’s workplace for the purposes of the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, and you agree to co-operate with any inquiry conducted under that Act.

6.5 You must not ask a Practitioner to act outside the scope of the Services or of his or her Scope of Practice, to administer any medicine that has not been prescribed in writing, to alter a prescribed dose, or to perform any procedure for which the Company has not allocated the Practitioner.

6.6 You must not record a Practitioner by photograph, video or audio without the Practitioner’s consent. If any camera or other recording device operates in the room where the Services are rendered, you must disclose it before the visit begins; the Company may require that it be switched off during personal or intimate care, and may withdraw the Practitioner if it is not.

6.7 You must not pay any money, tip or gratuity, or give any gift, directly to a Practitioner. All Fees are payable to the Company. If a Practitioner asks for any payment or gift, report it to the Company immediately.

6.8 The Company is not responsible for the safekeeping of cash, jewellery, documents, valuables or medicines in the household. You should keep them secured.

6.9 You must report promptly any concern about the conduct, competence or attendance of a Practitioner, and any deterioration in the Patient’s condition.

7. Non-solicitation of Practitioners

7.1 You acknowledge that the Company invests substantially in the recruitment, verification, background-checking, training, supervision and insurance of its Practitioners, and that the introduction of a Practitioner to a Patient’s household is a valuable part of what you pay for.

7.2 Accordingly, during the period in which the Services are rendered and for 12 (twelve) months after the last Service, neither you, nor the Patient, nor any member of the Patient’s household or family, shall directly or indirectly employ, engage, solicit or take the services of any Practitioner who has attended the Patient, otherwise than through the Company.

7.3 If this Clause 7 is breached, you shall pay the Company an amount equal to being the higher of INR 5,00,000 or the Fees payable for 24 (twenty four) months of the relevant Service, as reasonable compensation. The Parties agree that this amount is a genuine pre-estimate of the loss the Company would suffer, and not a penalty, and it is payable without proof of actual loss to the extent permitted by section 74 of the Indian Contract Act, 1872.

7.4 The Company may, in its discretion, consent in writing to a direct engagement of a Practitioner, on such terms as it may specify. Nothing in this Clause restrains any Practitioner from exercising any lawful profession, trade or business.

8. Fees, payment, cancellation and refunds

8.1 The Fee for each Service is the amount stated in the Booking Confirmation. Fees are payable in advance and a Booking is confirmed only upon receipt of payment, unless the Company agrees otherwise in writing.

8.2 Payment is made through the payment gateway made available on the Platform. The Company does not collect or store your complete card, bank or UPI credentials. You must use a payment instrument that you are authorised to use.

8.3 Fees are stated inclusive or exclusive of taxes as indicated at the time of Booking. Any tax payable on the Services under applicable law will be charged in addition where the Fee is stated to be exclusive of taxes, and a valid invoice will be issued.

8.4 Additional charges may apply for: extension of a visit beyond the booked duration; visits at night or on a public holiday; travel beyond the stated service area; and consumables supplied by the Company. Such charges are set out in the Booking Confirmation and will be intimated before they are incurred wherever practicable.

8.5 All cancellations and refunds shall be governed by our Policies.

8.6 Where a Service is terminated part way through for a reason attributable to the Company, the Fee is payable only for the part performed, and the balance will be refunded.

8.7 Where the Company offers a package, subscription or bundle of visits, Supplemental Terms will apply, and will state the validity period, whether the package is transferable, and the basis on which unused visits are refunded.

8.8 You must not initiate a chargeback in respect of a Service that has been rendered. If you dispute a charge, raise it with the Company under Clause 13 first. The Company may suspend Bookings while a chargeback is pending and may recover from you any amount debited on a chargeback that is subsequently found to be unjustified.

9. Clinical governance, incidents and records

9.1 Every Practitioner is verified as to identity, qualification, registration and antecedents before allocation, works under the supervision of the Company’s clinical supervisors, and is bound by the Company’s clinical protocols.

9.2 Practitioners observe standard precautions for infection prevention and control. Biomedical waste, including sharps, generated in the course of the Services will be collected by the Practitioner and removed for disposal by the Company in accordance with the Bio-Medical Waste Management Rules, 2016, and will not be left in the household waste.

9.3 If an incident occurs including a fall, a medication error, an injury, a needle stick, a deterioration in the Patient’s condition, or an allegation against a Practitioner, you should report it to the Company as soon as possible and in any event within 24 (twenty-four) hours. The Company will acknowledge the report, investigate it, and inform you of the outcome within 15 (fifteen) days.

9.4 The Company maintains a record of each visit, including observations, interventions and medicines administered. The Patient (or, where the Patient is unable to request it, the person lawfully entitled to act for the Patient) may request a copy of the record, which the Company will provide within 10 days. Records are retained for the period stated in the Privacy Policy or required by law, whichever is longer.

9.5 The Company may contact the Patient’s treating registered medical practitioner where the Patient or the person lawfully entitled to act for the Patient so directs, or where it is necessary in the interests of the Patient’s safety.

10. Personal data and health data

10.1 The Company is a Data Fiduciary in respect of the personal data of the User and the Patient, and processes it in accordance with the Digital Personal Data Protection Act, 2023, the rules made thereunder, and the Privacy Policy, which forms part of this Agreement.

10.2 Where a Patient is unable to give consent and there is a medical emergency involving a threat to life or an immediate threat to health, the Company may process personal data to the extent necessary to respond to that emergency, as a legitimate use under section 7 of the Digital Personal Data Protection Act, 2023, and will obtain consent as soon as it is reasonably practicable.

10.3 Personal data and health data are processed for the purposes of: allocating a Practitioner; planning and rendering the Services; maintaining clinical and visit records; billing and payment; safety, quality and incident management; customer support; and compliance with law.

10.4 Such data may be shared with the Practitioner attending the Patient, the Company’s clinical supervisors and support staff, its payment gateway, its insurers and professional advisers, and any authority to which disclosure is required by law. The Company does not sell personal data.

10.5 The Patient (or the person lawfully entitled to act for the Patient) may request access to, or correction or erasure of, personal data, may withdraw consent, and may nominate another person to exercise those rights, in the manner described in the Privacy Policy. Withdrawal of consent may prevent the Company from continuing to provide the Services, and does not affect the Company’s obligation to retain clinical records as required by law.

10.6 The Company will notify affected persons and the Data Protection Board of India of any personal data breach as required by law.

11. Responsibility, insurance and limitation of liability

11.1 Subject to Clause 11.3, and to the maximum extent permitted by law, the Company is not liable for any indirect, incidental or consequential loss, or for loss of profit, loss of business or loss of opportunity, arising out of or in connection with the Services or this Agreement.

11.2 Subject to Clause 11.3, and to the maximum extent permitted by law, the Company’s aggregate liability in connection with the Services in any period of 12 (twelve) months shall not exceed the higher of (a) the total Fees paid by you to the Company in the 3 (three) months preceding the event giving rise to the claim, and (b) INR 5,000 (Indian Rupees Five Thousand). The Company’s liability in respect of the Platform is dealt with in Clause 13 of the Terms of Use, and the two limits apply separately.

11.3 The Company is responsible for the acts and omissions of its Practitioners in the course of their employment and does not seek to disclaim that responsibility. No exclusion or monetary cap in this Clause 11 applies to liability for: (a) death or personal injury caused by the negligence of the Company or of a Practitioner; (b) fraud, fraudulent misrepresentation or wilful misconduct; (c) gross negligence; (d) any breach by the Company of its obligations as a Data Fiduciary under the Digital Personal Data Protection Act, 2023; (e) any deficiency in service, unfair trade practice or unfair contract term within the meaning of the Consumer Protection Act, 2019; or (f) any other liability that cannot lawfully be excluded or limited.

11.4 Aggregation. All claims arising out of the same event, or out of a series of related events or a continuing state of affairs, are treated as a single claim arising on the date of the first of them, for the purposes of the limits in this Clause 11.

11.5 Matters for which the Company is not responsible. Subject to Clause 11.3, the Company is not responsible for loss arising from:

  • information about the Patient that was inaccurate, incomplete or withheld, or a failure to disclose a material change in the Patient’s condition;
  • the act or omission of the Patient, of any member of the household, of any attendant not engaged by the Company, or of any third party;
  • a failure by the Patient or the household to follow the care plan, the instructions of the treating registered medical practitioner, or the advice given by the Practitioner;
  • the condition, safety or suitability of the Service Address, or the conduct of any person at it;
  • medicines, consumables or equipment supplied or arranged by the Patient or the household, including their quality, storage or expiry;
  • the clinical outcome of care that was rendered with reasonable skill and care; or
  • delay or non-performance caused by an event of the kind described in Clause 16.5. 11.6 Contribution. Subject to Clause 11.3, the Company’s liability is reduced to the extent that the loss was caused or contributed to by any of the matters in Clause 11.5, or by a failure by the User or the Patient to comply with this Agreement.

11.7 Mitigation and no double recovery. You must take reasonable steps to mitigate any loss. You may not recover more than once in respect of the same loss, whether under contract, in tort, under statute or under an indemnity; and any amount recovered from an insurer or from a third party in respect of the same loss is credited against the Company’s liability.

11.8 Service failures: first remedies. Where the Company fails to render a Service for a reason attributable to it, the Company will, at your election, (a) re-perform the Service at no additional charge, (b) refund the Fee for that Service, or (c) reimburse the reasonable cost of obtaining an equivalent service.

11.9 Claims against Practitioners. In consideration of the Company accepting responsibility for the acts and omissions of its Practitioners in the course of their employment, you agree to bring any claim arising out of the Services against the Company, and not personally against any Practitioner, employee, officer or director of the Company. This Clause does not apply to any claim arising out of a criminal offence, fraud, or conduct outside the course of employment, and does not affect any right to complain to a statutory council or to the police.

11.10 Indemnity by you. You agree to indemnify the Company against any loss, claim or liability that it suffers to the extent caused by: your breach of this Agreement; information about the Patient that you gave and that was materially false or incomplete; injury to a Practitioner caused by the condition of the Service Address or by the conduct of any person at it; or your provision of another person’s personal data without the authority required by law. This indemnity does not extend to loss caused by the Company’s own breach or negligence.

11.11 Where a limitation in this Clause 11 is held to be unenforceable in relation to a particular claim or person, that limitation applies to the extent permitted by law and the remainder of this Clause continues to apply.

12. Term, suspension and termination

12.1 This Agreement applies from the time you make a Booking and continues while any Booking remains to be performed or any Fee remains unpaid.

12.2 You may terminate a Booking of a continuing nature (such as a shift-based or package-based engagement) by giving the Company 7 (seven) days’ notice, and will be liable for the Fees for Services rendered up to the end of that period.

12.3 The Company may suspend or terminate the Services immediately where: any person at the Service Address breaches Clause 6.4; the Patient’s needs can no longer be met safely at home; information that is material to the Patient’s care or the Practitioner’s safety proves to be materially false; Fees remain unpaid after notice; or the Company is required to do so by law. The Company will inform you and, where practicable, will allow a reasonable period for alternative arrangements to be made for the Patient’s care.

12.4 On termination, Fees for Services rendered remain payable, amounts prepaid for Services not rendered will be refunded (except where the termination follows your fraud or a breach of Clause 6.4), and Clauses 7, 9, 10, 11, 13, 14 and 16 survive.

13. Grievance redressal

13.1 Any complaint about the Services may be made to customer care at 9019808410 (telephone) or support@zypheal.com (e-mail), or to the Grievance Officer appointed under Clause 10 of the Terms of Use, whose details are published on the Platform.

13.2 The Company will issue a ticket number and acknowledge a complaint within 48 (forty-eight) hours and will endeavour to redress it within 1 (one) month, in accordance with the Consumer Protection (E-Commerce) Rules, 2020. A complaint concerning clinical care will also be dealt with under Clause 9.3.

13.3 Nothing in this Agreement limits any right or remedy available to you as a consumer under the Consumer Protection Act, 2019.

14. Governing law and dispute resolution

14.1 This Agreement and any dispute arising out of or in connection with it are governed by the laws of India.

14.2 Before commencing any proceeding, the complaining party shall raise the matter under Clause 13 and allow 30 (thirty) days for it to be resolved.

14.3 Where the dispute is unresolved, it shall be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996 by a sole arbitrator appointed by agreement, failing which appointed under section 11 of that Act; the seat and venue shall be Bengaluru, Karnataka and the language English.

14.4 Subject to Clause 14.3, the courts at Bengaluru, Karnataka have jurisdiction. Either party may apply to a court for urgent interim relief.

15. Representations of the User

15.1 You represent and warrant, on each Booking, that: you are at least 18 years of age and competent to contract; the information you have given about yourself, the Patient and the Service Address is true and complete; you have the authority described in Clause 3.2 where you book for another person; you are authorised to use the payment instrument used; and you will comply with this Agreement and the Terms of Use.

15.2 These representations are treated as repeated each time you make a Booking or receive a Service.

16. Miscellaneous

16.1 Entire agreement. This Agreement, the Booking Confirmation, the Terms of Use, the Policies and any Supplemental Terms constitute the entire agreement between you and the Company in relation to the Services.

16.2 Amendment. The Company may amend this Agreement in the manner provided in Clause 2 of the Terms of Use. An amendment does not affect a Booking already confirmed.

16.3 Assignment. You may not assign this Agreement. The Company may assign it to an affiliate or to a person acquiring the whole or part of its business, on notice, provided your rights are not prejudiced.

16.4 Severability and waiver. If any provision is invalid or unenforceable it shall be severed to the minimum extent necessary and the remainder shall continue. No failure or delay in exercising a right is a waiver of it.

16.5 Force majeure. Neither party is liable for a failure or delay caused by an event beyond its reasonable control, including an act of God, flood, earthquake, epidemic or pandemic, public health order, riot, curfew, strike, failure of power or telecommunications, or the act of any government or authority. This Clause does not excuse a failure to refund amounts prepaid for Services not rendered.

16.6 Notices. Notices to you may be given by e-mail, SMS, in-application notification or at the Service Address. Notices to the Company must be given at the address in Clause 10 of the Terms of Use.

16.7 Electronic contracting. You agree that this Agreement may be accepted electronically and that electronic records maintained by the Company are valid and admissible in accordance with the Information Technology Act, 2000 and the Bharatiya Sakshya Adhiniyam, 2023.

SCHEDULE A

Definitions

“Booking” means a request for the provision of a Service made through the Platform, and “Booking Confirmation” means the Company’s confirmation of it, stating the Service, date, time, duration, Service Address and Fee.

“Clinical Protocols” means the clinical protocols, standard operating procedures, care plans, documentation standards and escalation matrices prescribed by the Company from time to time.

“Fees” means the amounts payable for the Services, together with any applicable taxes and any additional charges under Clause 8.4.

“Patient” means the person who receives or is to receive the Services.

“Platform” means the Company’s website and mobile application, as defined in the Terms of Use.

“Practitioner” means a nurse or physiotherapist employed by the Company and allocated by it to render the Services.

“Requesting User” has the meaning given in Clause 3.1.

“Scope of Practice” means the scope of practice, competence and training applicable to a Practitioner’s category of registration.

“Service Address” means the residence or other premises stated in the Booking Confirmation at which the Services are to be rendered.

“Services” means the home nursing services and home physiotherapy services described in Schedule B.

“Terms of Use” means the Company’s terms of use for the Platform, as amended from time to time.

Terms of Use

1. Overview and scope

1.1 Zypheal Private Limited, a company incorporated under the Companies Act, 2013, having corporate identity number U62099KA2026PTC225979 and its registered office at F1002, Tower 1, Gulmohar, Adarsh Palm Retreat, Bellandur, Bangalore South, Karnataka 560103, India (the “Company”, “Zypheal”, “we”, “us” or “our”) owns and operates the website www.zypheal.com and the Zypheal mobile application, together with all sub-domains, successor URLs, related pages and digital properties that the Company owns or controls (collectively, the “Platform”).

1.2 The Platform is used to discover, book, manage and pay for home nursing services and home physiotherapy services rendered at the residence or other premises of a patient (the “Services”).

1.3 The Platform is not a marketplace, listing service, aggregator or intermediary between you and any third-party service provider. Where you book a Service, your contract for that Service is with the Company, and the Company is answerable for the Services in accordance with the User Agreement.

1.4 These Terms of Use (the “Terms”) are a legally binding agreement between you and the Company, and govern your access to and use of the Platform, whether you access it as a Visitor (a person who browses the Platform without registering) or as a Registered User (a person who creates an Account). “You” and “your” refer to the person accessing or using the Platform.

1.5 Creating an Account requires, in addition to these Terms, your acceptance of the User Agreement, which governs your registration, your Account and the booking and provision of the Services. A Visitor who does not register is bound by these Terms alone. Where the Services are to be rendered to a Patient, the Patient Consent and Data Protection Form must also be completed before the Services begin. In the event of any inconsistency, the order of precedence is: (a) the Booking Confirmation for the Service concerned; (b) the User Agreement; (c) these Terms; and (d) the Policies.

1.6 Capitalised terms used but not defined in the body of these Terms have the meanings given to them in Schedule A (Definitions and Interpretation), which forms an integral part of these Terms.

1.7 The Company may introduce further services on the Platform from time to time. Any such service may be subject to Supplemental Terms, which will be notified on the Platform and which apply in addition to these Terms for that service.

2. Acceptance, amendment and electronic contracting

2.1 These Terms take effect and bind you on the earlier of (a) your clicking “I agree”, “Accept”, “Sign up”, “Continue” or a similar control, and (b) your accessing, browsing or otherwise using any part of the Platform. If you do not agree to these Terms, you must not access or use the Platform.

2.2 The Company may amend these Terms from time to time to reflect changes in law, regulation, technology, security requirements or the Services. The amended Terms will be posted on the Platform with a revised “Last updated” date and, where the change is material, the Company will give you notice by email, SMS or an in-application notification before the change takes effect.

2.3 Your continued use of the Platform after an amendment takes effect constitutes your acceptance of the amended Terms. An amendment does not affect a Booking that has already been confirmed, which continues to be governed by the terms in force when the Booking Confirmation was issued.

2.4 If you access or use the Platform on behalf of a company, firm, trust, hospital, employer or other organisation, you represent that you are authorised to bind that organisation, and “you” refers to both that organisation and to you.

2.5 You consent to contracting by electronic means. You agree that clicking an acceptance control, completing a one-time password verification, or confirming a Booking on the Platform constitutes a valid and enforceable acceptance, and that electronic records maintained by the Company are admissible in evidence in accordance with the Information Technology Act, 2000 and the Bharatiya Sakshya Adhiniyam, 2023.

3. Visitors and Registered Users

3.1 A Visitor may, without registering: browse public pages of the Platform; read informational content; view indicative service descriptions and prices; search for service availability by locality; and submit an enquiry or a request for a call back.

3.2 A Visitor may not make a Booking, access or add a Patient profile, view any clinical record, visit note or invoice, message the care team, or use any other feature that the Company designates as available only to Registered Users.

3.3 To become a Registered User you must create an Account by providing your name, mobile number and email address, and by completing verification (including verification of your mobile number by one-time password). Making a Booking requires further information, including the Service Address, the Patient’s details and relevant clinical information.

3.4 Registration is completed only when you accept the User Agreement. The Company will make the User Agreement available to you before you do so, and a copy of the User Agreement as accepted by you, together with the date and time of acceptance, will be retained in your Account.

3.5 You must be at least 18 (eighteen) years of age and competent to contract under the Indian Contract Act, 1872 in order to register or to make a Booking. A person below the age of 18 must not register on the Platform. Services for a Patient who is a minor, or who is otherwise unable to make decisions for himself or herself, may be booked only by a parent or lawful guardian or by another person lawfully entitled to make arrangements for that Patient’s care, in accordance with the User Agreement.

3.6 The creation, security, use and closure of an Account, and your obligations in relation to it, are governed by the User Agreement, which you accept on registering.

4. Nature of Platform content; no medical advice

4.1 All content made available on the Platform including articles, care guides, frequently asked questions, condition and symptom information, checklists and indicative prices is general information only. It is not medical advice, diagnosis, prognosis, treatment or a recommendation, and it is not a substitute for consultation with a registered medical practitioner.

4.2 Accessing the Platform, reading its content, creating an Account or making an enquiry does not create any practitioner–patient relationship between you and the Company or any of its practitioners. Such a relationship arises only when a Booking is confirmed and the Services are rendered under the User Agreement.

4.3 The Platform does not offer, and the Company does not provide through the Platform: consultation with a doctor, teleconsultation or telemedicine, diagnosis, the issue or renewal of prescriptions, the sale, supply, dispensing or delivery of medicines, or laboratory or diagnostic services. No practitioner engaged by the Company will prescribe, substitute, alter or discontinue any medicine or treatment. Nurses administer medicines only in accordance with the written prescription of a registered medical practitioner.

4.4 Any assessment, observation, care plan, visit note or report made available through the Platform relates only to the Services actually rendered, is prepared by the practitioner who rendered them, and does not constitute a comprehensive medical opinion or a substitute for evaluation by a registered medical practitioner.

4.5 Information displayed on the Platform about practitioners, including qualifications, registration, experience, photographs and any verification indicator, is informational. Practitioners are allocated to Bookings by the Company, and the Company may substitute one Practitioner for another, including at short notice on account of illness, leave, safety or the clinical needs of the Patient. The display of a particular practitioner is not a commitment that that practitioner will attend, and the substitution of a Practitioner is not a breach of these Terms or of the User Agreement.

4.6 Prices displayed on the Platform are indicative and may vary by locality, duration, shift, clinical requirement and time of booking. The Fee applicable to a Booking is the Fee stated in the Booking Confirmation.

4.7 The Platform is not an emergency service. If a Patient is experiencing a medical emergency, including chest pain, breathlessness, severe bleeding, loss of consciousness, a fall with suspected injury, seizure, stroke symptoms or a suspected overdose, call 112 or 108 immediately, or take the Patient to the nearest hospital. Do not use the Platform, in-application chat, e-mail or any messaging channel to report a medical emergency. The Company does not monitor those channels continuously and cannot guarantee a response within any period.

5. Acceptable use of the Platform

5.1 You must use the Platform only for lawful purposes and only to obtain, arrange or manage the Services for yourself or for a Patient on whose behalf you are authorised to act.

5.2 You must not, and must not permit any other person to:

  • impersonate any person, misstate your identity or your relationship with a Patient, or provide false, misleading or incomplete information;
  • make a Booking that you do not intend to honour, or use another person’s payment instrument without authority;
  • access or attempt to access another user’s Account, any Patient record that does not relate to you, or any part of the Platform that you are not authorised to access;
  • copy, scrape, crawl, harvest, index or systematically extract any content, price, practitioner profile or data from the Platform, whether manually or by any automated means, or use any robot, spider or similar tool;
  • reverse engineer, decompile, disassemble, modify, adapt or create derivative works of the Platform or any part of it, or attempt to derive its source code;
  • introduce any virus, worm, trojan, ransomware or other harmful code, or probe, scan, test the vulnerability of, or attempt to breach, the security of the Platform;
  • interfere with the operation of the Platform, impose an unreasonable load on its infrastructure, or circumvent any rate limit, access control or security measure;
  • use the Platform, or any information obtained from it, to build, train, benchmark or operate a competing service, dataset or model, or for any commercial purpose other than obtaining the Services;
  • solicit, approach, recruit or engage any practitioner of the Company otherwise than through the Company, or contact any practitioner on a personal contact detail for a purpose connected with the Services;
  • upload, post or transmit any content that is unlawful, defamatory, obscene, pornographic, paedophilic, invasive of another’s privacy, insulting or harassing on the basis of gender, racially or ethnically objectionable, encouraging of an offence, or otherwise unlawful under the Information Technology Act, 2000 and the rules made thereunder;
  • upload or provide the personal data or health data of any other person without the authority or consent required by law;
  • infringe any intellectual property right, or remove, obscure or alter any proprietary notice on the Platform;
  • misuse any promotional code, referral benefit or discount, or exploit any error in the Platform for gain; or
  • use the Platform in any manner that violates any applicable law, including laws relating to data protection, medical practice, drugs and cosmetics, or unlawful communications. 5.3 Any review, rating, photograph, testimonial or other material that you submit must be accurate, must relate to a Service actually received, and must not identify any practitioner or any other patient in a manner that is defamatory or that discloses another person’s health information. The Company may decline to publish, may edit for length, or may remove any such material.

5.4 The Company may investigate any suspected breach of this Clause 5 and may suspend or restrict access, remove content, cancel Bookings, or take any other step permitted by law, in accordance with Clause 11.

6. User content, reviews and feedback

6.1 You retain ownership of the content that you submit to the Platform (“User Content”). You grant the Company a non-exclusive, royalty-free, worldwide licence to host, store, reproduce, adapt (for formatting), publish and display User Content for the purposes of operating, securing, supporting and improving the Platform and the Services, and, in the case of reviews and testimonials, of displaying them on the Platform and in the Company’s marketing, identifying you by first name and locality only, unless you ask the Company not to publish them.

6.2 You represent that you own or are entitled to submit all User Content, that it does not infringe the rights of any third party, and that where it contains the personal data of another person you have that person’s consent or other lawful authority.

6.3 If you provide any suggestion, idea or feedback about the Platform or the Services (“Feedback”), the Company may use it for any purpose without restriction or any obligation to you. Feedback is not confidential.

6.4 The Company is under no obligation to monitor User Content, but may review, moderate, refuse to publish or remove User Content, and may retain records of removed content as required by law.

7. Intellectual property

7.1 The Platform, and all software, interfaces, designs, layouts, text, graphics, illustrations, photographs, videos, care guides, protocols, forms, compilations and databases comprised in it, together with all copyright, trade mark, design, database and other intellectual property rights in them, are owned by the Company or its licensors. All rights not expressly granted are reserved.

7.2 The Company grants you a limited, revocable, non-exclusive, non-transferable and non-sub-licensable licence to access and use the Platform for the purpose of obtaining the Services for yourself or for a Patient on whose behalf you are authorised to act, and for no other purpose. This licence terminates automatically on the termination of these Terms or the closure of your Account.

7.3 “Zypheal”, the Zypheal logo and all other marks, names and taglines displayed on the Platform are trade marks of the Company. You must not use them without the Company’s prior written consent.

7.4 If you believe that any content on the Platform infringes your copyright or other right, write to the Grievance Officer at the address in Clause 10 with details of the right, the location of the content, and a statement of your good-faith belief that the use is not authorised. The Company will deal with the complaint in accordance with the Copyright Act, 1957, the Information Technology Act, 2000 and the rules made under them.

8. Privacy, health data and communications

8.1 The Company’s Privacy Policy (available on the Platform) forms part of these Terms and describes how the Company collects, uses, discloses, retains and protects personal data. Where these Terms and the Privacy Policy differ on a matter of data handling, the Privacy Policy prevails.

8.2 The Company is a Data Fiduciary in respect of personal data processed through the Platform, and processes it in accordance with the Digital Personal Data Protection Act, 2023 and the rules made thereunder. Information about a Patient’s health, condition, treatment and care is processed for the purpose of providing and administering the Services, and is shared only with the practitioner attending the Patient, the Company’s clinical supervisors, and such other persons as the Privacy Policy describes or as law requires.

8.3 Where you provide the personal data of any other person, including a Patient, you confirm that you are authorised to do so and that the necessary consent has been obtained. Where the Patient is a child or a person with a disability who has a lawful guardian, you confirm that you are the parent or lawful guardian, or are acting with the authority of the parent or lawful guardian, and you consent on that person’s behalf as required by section 9 of the Digital Personal Data Protection Act, 2023.

8.4 Acceptance of these Terms and of the User Agreement is not a substitute for the consent of the Patient. Before the Services begin, the Company will give the Patient (or, where the Patient is a child or a person with a disability who has a lawful guardian, that guardian) a notice under section 5 of the Digital Personal Data Protection Act, 2023 and will obtain that person’s itemised consent in the Patient Consent and Data Protection Form. Consent may be withdrawn at any time, with the same ease with which it was given, in the manner stated in that Form and in the Privacy Policy.

8.5 You consent to receive service and transactional communications relating to your Account, Bookings, visits, payments and safety by SMS, WhatsApp, e-mail, voice call and in-application notification. These communications are necessary for the provision of the Services and cannot be opted out of while you hold an Account or have an active Booking. Promotional communications are sent only with your consent and may be withdrawn at any time, and the Company sends commercial communications in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018.

8.6 The Platform uses cookies and similar technologies as described in the Privacy Policy or the Cookie Policy. You may manage non-essential cookies through the controls provided.

8.7 The Company maintains reasonable security safeguards. No system is entirely secure, and you are responsible for the security of the device, network and e-mail account you use to access the Platform. If you become aware of any actual or suspected compromise of your Account, or of any personal data accessible through it, notify the Company immediately.

9.1 The Platform uses third-party services, including payment gateways, communication and messaging providers, mapping and location services, cloud hosting and analytics. Your use of a third-party service through the Platform may be subject to that provider’s own terms and privacy policy.

9.2 The Platform may contain links to third-party websites or resources. The Company does not control and is not responsible for the content, products, services, security or privacy practices of any third-party site, and a link does not imply any endorsement.

9.3 The Company does not collect or store your complete card, bank or UPI credentials. Payments are processed by a payment gateway regulated by the Reserve Bank of India, and are subject to that gateway’s terms. Refunds are made to the original payment instrument in accordance with the User Agreement.

10. Customer care and grievance redressal

10.1 The legal name of the seller of the Services is Zypheal Private Limited; its registered address and corporate identity number are set out in Clause 1.1. Customer care may be reached at 9019808410 (telephone) and support@zypheal.com (e-mail), between 7:00 a.m. and 8:00 p.m. on all days.

10.2 In accordance with the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology Act, 2000, the Company has appointed the following Grievance Officer:

Name: Bharath Kumar B S

Designation: Grievance Officer

Address: F1002, Tower 1, Gulmohar, Adarsh Palm Retreat, Bellandur, Bangalore South, Karnataka 560103, India

E-mail: support@zypheal.com Telephone: 9019808410

10.3 On receiving a complaint, the Company will issue a ticket number and acknowledge the complaint within 48 (forty-eight) hours, and will endeavour to redress it within 1 (one) month of receipt, in accordance with the Consumer Protection (E-Commerce) Rules, 2020. If the complaint concerns clinical care, it will also be dealt with under the incident procedure in the User Agreement.

10.4 If you are not satisfied with the response of the Grievance Officer, you may escalate the matter to the Nodal Officer at support@zypheal.com (e-mail) and 9019808410 (telephone).

10.5 Nothing in these Terms limits or excludes any right or remedy available to you as a consumer under the Consumer Protection Act, 2019, including the right to make a complaint to the District, State or National Consumer Disputes Redressal Commission having jurisdiction.

11. Suspension, termination and availability

11.1 The Company may, on notice (or without prior notice where the matter is urgent or where notice would prejudice an investigation), restrict, suspend or terminate your access to the Platform or your Account where: (a) you breach these Terms, the User Agreement or any Policy; (b) the Company reasonably suspects fraud, misuse of a payment instrument, or the provision of false information; (c) your conduct, or the conduct of any person at the Service Address, threatens the safety or dignity of a practitioner or of any other person; (d) Fees due remain unpaid; or (e) the Company is required to do so by law or by an order of a court or authority.

11.2 On suspension or termination: your right to use the Platform ceases; Fees already accrued remain payable; amounts prepaid for Services not yet rendered will be refunded, except where the termination results from your fraud or from a breach for which the User Agreement provides otherwise; and the Company will retain or delete records in accordance with the Privacy Policy and applicable law.

11.3 You may stop using the Platform at any time and may close your Account as provided in Clause 3.8.

11.4 The Company may modify, suspend or discontinue the Platform or any feature of it, including for maintenance, security, capacity or legal reasons. Where a discontinuation is permanent and affects Bookings already confirmed, the Company will give you reasonable notice and will refund amounts prepaid for Services that will not be rendered.

12. Disclaimers relating to the Platform

12.1 The Platform is provided on an “as is” and “as available” basis. The Company does not warrant that access to the Platform will be uninterrupted, timely, secure or free from error, that defects will be corrected, or that the Platform or the servers that make it available are free of harmful components.

12.2 The Company does not warrant the accuracy, completeness or currency of general informational content on the Platform, or that any slot, time, locality or practitioner shown as available will remain available until a Booking is confirmed.

12.3 This Clause 12 concerns the Platform. The standard of care applicable to the Services themselves, and the Company’s responsibility for them, are dealt with in the User Agreement and are not excluded or limited by this Clause.

13. Limitation of liability

13.1 Subject to Clause 13.3, and to the maximum extent permitted by law, the Company is not liable for any indirect, incidental or consequential loss, or for loss of profit, loss of business, loss of opportunity or loss of data, arising out of or in connection with your use of the Platform.

13.2 Subject to Clause 13.3, and to the maximum extent permitted by law, the Company’s aggregate liability in respect of the Platform (as distinct from the Services) in any period of 12 (twelve) months shall not exceed the higher of (a) the total Fees paid by you to the Company in the 1 (one) month preceding the event giving rise to the claim, and (b) INR 2,000 (Indian Rupees Two Thousand).

13.3 Aggregation. All claims arising out of the same event, or out of a series of related events or a continuing state of affairs, are treated as a single claim arising on the date of the first of them, for the purposes of the limits in this Clause 13.

13.4 Contribution. The Company’s liability is reduced to the extent that the loss was caused or contributed to by: (a) information about the Patient that was false, misleading or incomplete when given, or that was not updated; (b) a failure by the Patient or the household to follow the care plan, the instructions of the treating registered medical practitioner, or the advice of the Practitioner; (c) the act or omission of any member of the household, of any attendant not engaged by the Company, or of any third party; or (d) the condition of the Service Address or the conduct of any person at it.

13.5 Service failures: first remedies. Where the Company fails to render a Service for a reason attributable to it, the Company will, at your election, (a) re-perform the Service at no additional charge, or (b) refund the Fee for that Service.

13.6 Claims against Practitioners. The Company accepts responsibility for the acts and omissions of its Practitioners in the course of their employment. In consideration of that acceptance, you agree to bring any claim arising out of the Services against the Company, and not personally against any Practitioner, employee, officer or director of the Company. This Clause does not apply to any claim arising out of a criminal offence, fraud, or conduct outside the course of employment, and does not affect any right to complain to a statutory council or to the police.

13.7 Where a limitation in this Clause 13 is held to be unenforceable in relation to a particular claim or person, that limitation applies to the extent permitted by law and the remainder of this Clause continues to apply. No exclusion or monetary cap in this Clause 13 applies to liability that cannot lawfully be excluded or limited.

14. Indemnity

14.1 You agree to indemnify the Company against any loss, liability, claim, cost or expense (including reasonable legal costs) that the Company suffers or incurs to the extent caused by: (a) your breach of these Terms or of any applicable law; (b) your User Content; (c) your provision of another person’s personal data or health data without the authority or consent required by law; (d) any false, misleading or incomplete information that you provide; or (e) the use of your Account by any person to whom you disclosed your credentials.

14.2 This indemnity does not extend to any loss to the extent caused by the Company’s own breach, negligence or wilful misconduct. The Company will notify you promptly of any claim to which the indemnity applies, will not settle it without consulting you, and will take reasonable steps to mitigate the loss.

15. Governing law and dispute resolution

15.1 These Terms and any dispute arising out of or in connection with them (including any non-contractual dispute) are governed by the laws of India.

15.2 Before commencing any proceeding, you agree to raise the matter with the Grievance Officer under Clause 10 and to allow the Company a period of 30 (thirty) days from the date of the complaint to resolve it.

15.3 The dispute shall, if not resolved under Clause 15.2, be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996 by a sole arbitrator appointed by agreement between the parties, failing which appointed on an application under section 11 of that Act. The seat and venue of arbitration shall be Bengaluru, Karnataka and the language shall be English.

15.4 Subject to Clause 15.3, the courts at Bengaluru, Karnataka shall have jurisdiction. Nothing in this Clause prevents either party from applying to a court for urgent interim relief, including under section 9 of the Arbitration and Conciliation Act, 1996.

16. Miscellaneous

16.1 Entire agreement. These Terms, together with the User Agreement, the Policies and any Supplemental Terms, constitute the entire agreement between you and the Company in relation to the Platform and supersede all prior understandings on that subject.

16.2 Severability. If any provision of these Terms is held invalid or unenforceable, it shall be severed to the minimum extent necessary and the remaining provisions shall continue in full force.

16.3 Waiver. No failure or delay by the Company in exercising a right operates as a waiver of it, and no single or partial exercise prevents any further exercise.

16.4 Assignment. You may not assign or transfer your rights under these Terms. The Company may assign or transfer these Terms to an affiliate or to a person acquiring the whole or part of its business, on notice to you, provided your rights are not prejudiced.

16.5 Force majeure. The Company is not liable for any failure or delay in the operation of the Platform caused by an event beyond its reasonable control, including an act of God, flood, earthquake, epidemic or pandemic, public health order, riot, war, strike, failure of power or telecommunications, cyber attack, or the act of any government or authority.

16.6 Notices. The Company may give notice to you by e-mail, SMS, in-application notification or by posting on the Platform. You may give notice to the Company at the address in Clause 10. Notices are in English.

16.7 Survival. Clauses 6 (User content, reviews and feedback), 7 (Intellectual property), 8 (Privacy, health data and communications), 10 (Customer care and grievance redressal), 11.2 (Effect of termination), 12 (Disclaimers), 13 (Limitation of liability), 14 (Indemnity), 15 (Governing law and dispute resolution), 16 (Miscellaneous) and Schedule A survive the termination of these Terms.

SCHEDULE A

Definitions and Interpretation

Interpretation

(a) “including” means “including without limitation”; (b) words in the singular include the plural and vice versa; (c) a reference to a statute includes any amendment, re-enactment or subordinate legislation made under it; (d) headings are for convenience only; (e) a reference to “days” is to calendar days unless stated to be business days; (f) a reference to “writing” includes electronic records; and (g) a reference to a Clause or Schedule is to a Clause of, or Schedule to, these Terms.

A term that is defined both in these Terms and in the User Agreement bears the same meaning in each. Where a term used in these Terms is not defined in them, it bears the meaning given to it in the User Agreement.

Definitions

“Account” means the registration created by a Registered User on the Platform, including the profile, credentials, saved addresses, Patient profiles, Booking history and settings associated with it.

“Booking” means a request made through the Platform for the provision of a Service on a specified date, at a specified time and at a specified Service Address.

“Booking Confirmation” means the confirmation issued by the Company accepting a Booking, stating the Service, the date, time and duration, the Service Address and the Fee.

“Fees” means the amounts payable for the Services, as stated in the Booking Confirmation, together with any applicable taxes and any additional charge payable under the User Agreement.

“Patient” means the person who receives or is to receive the Services, whether or not that person is the Registered User.

“Platform” has the meaning given in Clause 1.1.

“Policies” means the Privacy Policy, the Cookie Policy, the cancellation and refund policy and any other document that the Company publishes on the Platform and identifies as a policy, each as amended from time to time.

“Practitioner” means a nurse or physiotherapist employed by the Company and allocated by it to render the Services.

“Registered User” means a person who has created an Account.

“Patient Consent and Data Protection Form” or “Consent Form” means the form in which the Patient, or the person lawfully entitled to consent on the Patient’s behalf, is given notice under section 5 of the Digital Personal Data Protection Act, 2023 and gives consent to the processing of personal data and to the receipt of the Services.

“Service Address” means the residence or other premises at which the Services are to be rendered, as stated in the Booking Confirmation.

“Services” means the home nursing services and home physiotherapy services described on the Platform and in Schedule B to the User Agreement, and any further service that the Company may offer under Supplemental Terms.

“Supplemental Terms” means additional terms applicable to a particular service, feature, offer or region, published on the Platform and incorporated into these Terms.

“User Agreement” means the agreement that you must accept in order to create an Account, and which governs your registration, your Account and the booking and provision of the Services.

“User Content” has the meaning given in Clause 6.1.

“Visitor” means a person who accesses the Platform without creating an Account.

Data Privacy Checklist

Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, Zypheal is a Data Fiduciary in respect of the personal data of its customers, its patients and its own staff. We require the following information, for us to assess and accordingly draft the data privacy policy for the company, including the relevant consent forms.

Please describe what happens today, not what is intended to happen. Where something has not been built or decided yet, say so. “Not yet decided” and “we do not do this” are complete answers, and are far more useful to us than an optimistic one. The Privacy Policy is a public statement by the Company: once it is published, everything in it becomes a representation the Company has to live up to. A policy that describes a safeguard the Company does not in fact operate creates exposure twice over, under the Digital Personal Data Protection Act, and as a misleading representation under the Consumer Protection Act, 2019.

Answered on 25 September 2026.

Whose data you hold, and where it comes from?

S. No.QuestionsCompany Comment
1Which groups of people will you hold data about? Our working list is: customers who register; patients (who are often not the customer); family members and attendants; practitioners and other employees; job applicants; corporate and insurer contacts; and website visitors. Tell us which of these are real for you and whether any are missing.Real for us: customers who register (one row per person, reached only by phone number); patients who are not the customer — a family member the account holder books for, held as a care-recipient record and copied onto each booking so the record of what was booked cannot change afterwards; practitioners and other staff; and website visitors (page path, timestamp and a rotating daily hash — see Q23). Not held, contrary to the working list: family members and attendants as people in their own right (the only non-customer we hold is the care recipient); job applicants (no applicant tracking of any kind exists); and corporate or insurer contacts (no B2B or insurer module exists).
2Do you receive patient information from anyone other than the customer, for instance a hospital, a discharge desk, a doctor, or a referral partner? If so, who, and what do they send?No. Every field about a patient is typed in by the account holder or written by the attending practitioner during the visit. There is no feed, integration or intake from a hospital, discharge desk, doctor or referral partner, and no such interface has been built.
3Do customers ever share another person’s contact details with you, for example in a referral programme, or a “share with family” feature?Two things to separate. The referral programme does not take contact details — a referrer shares a code and the referee types it in themselves, so we never learn who was invited, or that anyone was invited, until they arrive. There is no invite-by-phone-number and no contact upload. Adding a family member does: the account holder enters another living person's first and last name, relation, gender, date of birth, conditions, allergies and weight. That person has not interacted with us and usually will not. This is the most significant third-party data we hold.
4Will you hold the details of an emergency contact or of the attendant at home, and if so what is captured?No. Neither is captured. There is no field for either, and a booking asks for no contact other than the account holder's own.

What you collect from customers and patients?

S. No.QuestionsCompany Comment
5What exactly does the sign-up screen capture: name, mobile, e-mail, password or OTP, date of birth, gender? Do you offer Google or Apple sign-in, and if so what does the provider pass to you?A mobile number, and nothing else. Login is a one-time code sent to that number, and it is the only way to sign in — no password, no date of birth and no gender at sign-up. There is no Google or Apple sign-in: Google Sign-In existed and was removed on 10 September 2026 because it linked accounts by an e-mail address the provider had not verified to us, so nothing is passed to us by any identity provider. Name and e-mail are collected later in account settings. Date of birth is collected on the patient profile, and an account holder whose date of birth shows them to be under 18 cannot book for themselves — see Q14.
6List every field on the patient profile and the booking form such as diagnosis, prescriptions, allergies, infection status, mobility, cognitive status, weight, height, existing devices, and so on.Patient profile (the account holder themselves): date of birth, gender, preferred language, conditions, allergies, weight. Family member: first name, last name, relation, gender, date of birth, conditions, allergies, weight. Booking: all of the above copied onto the booking at the time of booking, so the record of what was booked cannot change afterwards; the service address — latitude, longitude, formatted address, street, locality, pincode, building or floor, address type and free-text access instructions; and an optional prescription or medical document the customer may attach (Q9). Not collected: diagnosis as a coded field, infection status, mobility, cognitive status, height and existing devices. Conditions and allergies are free text.
7Do you collect Aadhaar, PAN or any other government identity document from customers, at any stage? If yes, at what point, why, and where is the image stored?No. Not at any stage, from customers, from patients, or from practitioners. There is no column for one, no upload path that would accept one, and no screen that asks.
8What is captured at each visit: vital signs, observations, medicines administered, progress notes, checklists?The practitioner records, on the visit note: Assessment; Vitals — blood pressure, temperature, pulse rate, SPO2, respiratory rate, RBS and a pain score from 0 to 5; K/c/o (known case of); Allergic reactions; and Additional observation. Allergies and known conditions are shown prominently, in red, so they cannot be missed at the bedside. Treatment given, advice given and whether follow-up is recommended are recorded alongside. All fields are free text, with a curated pick-list offered to physiotherapists whose selected labels are stored as text. The practitioner may also attach a document or photograph of a prescription or of a drug administered. Alongside the note we store the visit timestamps (en route, arrived, started, completed) and the location readings described in Q20.
9Can a customer or practitioner upload documents, discharge summaries, prescriptions, lab reports, scans? Where are those files stored, and who can open them?Yes, on both sides. A customer may attach an optional prescription or other medical document while making a booking, and a practitioner may attach a prescription or a photograph of a drug administered to the visit note (Q8). Those files are stored encrypted in our own object storage in Mumbai, are never public, and are opened only by the practitioner assigned to that visit and by the patient or account holder who uploaded them. Office and support staff cannot open them: clinical material is refused to every staff role without exception (Q32). Practitioners separately upload their own professional credentials (Q18), which are not patient documents.
10Are clinical photographs taken (wounds, treatment sites)? On whose device, stored where, and for how long?No. Not on any device. There is no field, upload path or storage for one.
11Is any audio or video of a visit ever recorded?No.
12Do you run a feedback call or survey after a visit, and is it recorded or transcribed?There is an in-app feedback form after a visit — a star rating, an optional free-text comment and tags. We may also make an outbound feedback call, and a call placed through the platform is recorded (Q35). Nothing is transcribed.
13What payment data touches your systems? Which gateway do you use, and do you store any token, masked card number, UPI handle or bank detail yourself?The gateway is Razorpay, using its hosted checkout: the customer enters card or UPI details on Razorpay's own page, never on ours. We store the Razorpay order, payment and refund identifiers, the amount in paise, and the method as a bare word ("upi", "card"). We do not store, and never receive, a card number, a masked card number, a payment token, a UPI handle or any bank detail.
S. No.QuestionsCompany Comment
14Will you serve patients under 18? Paediatric home nursing is a real segment, so please answer this deliberately rather than by default.A person under 18 cannot hold an account or make a booking for themselves, and the product enforces this. Where the account holder's own date of birth shows them to be under 18, the profile refuses to save it as their own and no booking can be made for themselves; they are told why. A minor can receive care, booked for them by a parent or lawful guardian as a family member, which is the normal paediatric route. The basis is not a medical statute — none bars a minor from receiving nursing or physiotherapy care. It is that (a) under sections 10 and 11 of the Indian Contract Act, 1872 a minor cannot contract, so a minor cannot agree to these terms or to a fee, and (b) under section 9 of the Digital Personal Data Protection Act, 2023 a child's personal data may be processed only with the verifiable consent of a parent or lawful guardian. Both point the same way: the contracting party and the consenting party must be an adult.
15If yes, how will you verify that the person consenting is the parent or lawful guardian, and what document will be seen and recorded?The parent or lawful guardian holds the account, and consent for the minor is given by them from within their own signed-in account: they add the minor as a family member, state their relationship to them, and give a separate, explicitly recorded on-behalf consent naming that child. What is stored is the account holder's identity as verified at login (their mobile number, verified by one-time code), the relationship they declared, the child's identity as given, the exact version and text of the notice shown, and the time and IP address of the consent. A booking or a clinical entry for that child without that consent on record is refused by the server, not merely discouraged by the app. We do not ask for, see or store a birth certificate, guardianship order or any other document, and no such document is a condition of service.
16For patients who cannot read or write, what is the workflow for oral consent, and who witnesses it?The consent of record is given by the person who books, from within their own signed-in account, and it is given expressly on behalf of the patient where the two are different people. There is no form for the patient to read or sign, on a device or on paper, so being unable to read or write is no barrier to receiving care and nothing is asked of the patient that they cannot do. Before beginning care the practitioner explains what they are about to do and takes the patient's verbal agreement, in the patient's own language where the practitioner shares it. That exchange is not recorded and is not witnessed — it is the ordinary courtesy of clinical practice rather than a second consent, and the consent the Company relies on remains the one given by the account holder. A practitioner will not proceed where the patient objects, whatever the account holder has consented to.

Practitioners and staff.

S. No.QuestionsCompany Comment
17What do you hold about a practitioner: identity documents, council registration, qualification certificates, police verification, medical fitness, bank details, PF and ESI numbers, photograph?Held: phone number, e-mail, first and last name; display name, specialisation, discipline, gender, qualification, languages, photograph, average rating; and the documents they upload themselves — qualification and registration certificates with issue and expiry dates, each reviewed and marked verified by staff, with the council registration number recorded from the certificate at the point of verification (Q18). Not held: identity documents, police verification, medical fitness records, bank details, PF number, ESI number. No payroll data of any kind is in the system — attendance produces worked and overtime minutes; what is paid against them happens outside.
18Is the practitioner’s photograph, name or registration number shown to customers in the app?A practitioner uploads the documents relating to their profession, education and registration from within the app. Staff review each one and, on verification, record the council registration number from the certificate against the practitioner's profile. Photograph, display name, discipline, gender, languages, average rating and the verified registration number are shown to customers when choosing a care provider and on the booking — the registration number is the fact a customer can check with the council themselves, which is the point of showing it. The practitioner's own phone number is never shown to a customer, and the uploaded certificates themselves are not shown.
19Is attendance of practitioners captured biometrically, or by app check-in, or both? Is there CCTV at the office or at any hub?App check-in and check-out only — a practitioner clocks in and out from within the app, and their location is captured at the moment of each. No biometrics. No CCTV at any office or hub.

The app, the website and tracking.

S. No.QuestionsCompany Comment
20Does the app collect location? Whose i.e. the customer’s, the practitioner’s, or both? Only at check-in and check-out, or continuously during a shift? Does it collect location in the background when the app is closed?The practitioner's location only. The customer's device location is never collected by the app; the service address is what the customer types and pins on a map. For a practitioner, location is captured at clock-in and clock-out (Q19), at the moment they mark themselves en route and again when they mark themselves arrived, and as a location trail while they are clocked in and on duty — which exists so that travel between visits can be reimbursed accurately and so that the office can reach a practitioner who is running late or in difficulty. Each reading carries the device's reported accuracy and whether the operating system flagged the position as simulated. The trail is collected only between clock-in and clock-out. It is not collected when the practitioner is off the clock, and it is not collected in the background once they have clocked out. It is never shown to a customer (Q21). The website asks the browser for a one-off position to check whether we serve that area, and keeps it only if the visitor then confirms it as their location.
21Is there a live-tracking feature that shows the customer where the practitioner is?No. A customer is told an arrival window and sent a notification when the practitioner sets out; they are never shown a position or a map. The practitioner's location trail (Q20) is an internal record used for reimbursement and for reaching a practitioner during a shift, and the internal operations board deliberately shows no coordinates at all — an arrival reading is taken at a patient's front door, so a map pin there would hand every viewer somebody's home address.
22List every third-party SDK in the app: analytics, crash reporting, push notifications, attribution, advertising, chat, maps.expo-notifications (push, relayed by Expo to Google Firebase Cloud Messaging), expo-location, expo-secure-store, expo-document-picker, expo-device, expo-constants, and react-native-webview (used to show Razorpay's hosted checkout). No analytics SDK, no crash reporting, no attribution, no advertising, no chat and no maps SDK is present in the app.
23What does the website use: Google Analytics, Meta pixel, Google Ads tags, a chat widget, a heatmap or session-recording tool? Session recording in particular needs to be disclosed carefully if it can capture a form field.Our own measurement, on our own servers, and nothing else. There is no Google Analytics, no Meta pixel, no Google Ads tag, no heatmap and no session-recording tool — so the concern about a recorder capturing a form field does not arise, and no website measurement data leaves India. What we record for a page view is: the page path, including which service page it was; the time it was opened; the broad kind of device, browser and operating system it was opened on; and a visitor hash, sha256(a secret salt + IP address + browser user agent). The IP address is used only to rate-limit the request and as material for that hash; the user agent is used to derive the device description and as material for the same hash. Both are used in memory and neither is ever stored. We do not record the visitor’s location at all — no city, no region, no coordinates. The salt is a secret random value held apart from the database and rotated; hashes made under a given salt are kept for up to one year, which is what lets us tell a returning visitor from a new one over a season rather than only within a day. We are describing that plainly because it matters: the hash is a pseudonymous identifier that can recognise the same browser for up to a year. It is never joined to an account, never sits beside a name, a phone number or an email address, and identifies a browser rather than a person. It sets no cookie for measurement and writes nothing at all to an ordinary visitor's device. Two limits are absolute: a signed-in patient's own pages — their bookings, care plans, messages, profile and consent history — are recorded nowhere, and the query string is discarded from every page view without exception, because our catalogue search matches what people type against a vocabulary of symptoms. Search terms themselves are counted, so that we learn what care people are looking for, but they are stored with no visitor hash and no identifier of any kind beside them and cannot be connected to a visit, a device or a person.
24Do you want a cookie consent banner, and do you want non-essential cookies off by default?No banner, because there is nothing to ask about. We set no non-essential cookies. Our measurement (Q23) stores nothing on the visitor's device — no cookie, no local storage, nothing that survives closing the tab and nothing to decline — and there is no third-party analytics tool on the site to set one. The only cookies we set are the ones that keep a signed-in session working, which are strictly necessary for the service and for which the law does not require consent. For completeness: there is one further cookie, and a member of the public never receives it. Our own staff can open the site with a private link before launch, and that sets a cookie marking the browser as ours so that our testing is kept out of the visitor figures.
25What device data is logged: device model, operating system, IP address, advertising identifier, app version, crash logs?Logged: the IP address of a request that read identity or clinical data, kept with the actor, the action and whether the read was allowed or refused; the IP address from which a consent was given; and the push token and platform word ("android" or "ios"). For a website visit, the IP address and the user agent are read and not kept — the IP rate-limits the request, both are hashed as described in Q23, and neither survives the request; what is derived from them and kept is the kind of device (phone, tablet or computer) and the browser and operating system, with their major version numbers only — enough to know what to build and test for, and deliberately not the full build number, which would single a visitor out far more precisely. Not collected: the visitor’s city or any other location, device model, advertising identifier, app version, crash logs.
26List every vendor that will touch customer, patient or practitioner data. Our starting list: cloud hosting, database, object storage, CRM or helpdesk, Exotel, the WhatsApp provider, the SMS vendor, analytics, the payment gateway, e-signature, accounting, HRMS and payroll, and any background-check vendor.AWS (ap-south-1, Mumbai) — compute, the database, object storage, e-mail and cache. Neon — development database only; no production data. Razorpay — payments; holds the card and UPI details we never see. Fast2SMS — the login code by SMS. Meta (WhatsApp Cloud API) — transactional messages and the login code. Expo, relaying to Google Firebase Cloud Messaging — push notifications to the practitioner app. Google Maps Platform — Places and Geocoding for address entry, Routes for travel time. The cache holds only a matrix of travel times between pincode zones, and no personal data. Not used: any analytics vendor, CRM or helpdesk, e-signature, accounting, HRMS and payroll, and any background-check vendor.
27Do you use, or plan to use, any AI or machine learning on customer or patient data: transcription, call summarisation, triage, chatbots, scheduling, document extraction? Which vendor or model?None today. The support chatbot's plumbing exists — conversations, streaming, handover to a human agent — but the only language-model implementation in the codebase returns a fixed placeholder string. There is no transcription, call summarisation, triage, scheduling model or document extraction anywhere. AWS Bedrock in the Mumbai region is the intended vendor when it is built, and the design already forbids sending a clinical note into a prompt. It is not connected, so today the honest answer is none.
28Do you have a data warehouse or analytics database? Is it fed with identifiable data or de-identified data?No. Every metric is a query against the operational database. There is no warehouse, no pipeline and no second copy, identifiable or de-identified.
29Which cloud provider, and in which region is the data stored? If it is AWS or GCP, is it the Mumbai or Hyderabad region? Will any personal data be stored, accessed or processed outside India?AWS, ap-south-1 (Mumbai), exclusively. This is an architectural rule with no exceptions, not a default — every part of the system is pinned to it. Personal data does leave India through three of the vendors above, whose processing location we do not control: Meta's WhatsApp Cloud API, Expo and Google Firebase Cloud Messaging, and Google Maps Platform. What reaches each is narrow — a phone number and a transactional message; a push token and a notification title; an address string — but it is not nothing, and it is stated here so the policy can describe the transfer position accurately. No website measurement data leaves India at all, and none is shared with anyone.

Access, security and devices.

S. No.QuestionsCompany Comment
30What security measures are actually in place today: encryption in transit, encryption at rest, role-based access, multi-factor authentication for staff, access logging, backup and restore testing?Encryption in transit — HTTPS throughout. Encryption at rest — database storage encryption on; every storage bucket encrypted and blocking all public access; uploaded documents and invoices on a managed key. Sign-in — every account, staff and customer alike, signs in with a one-time code sent to the registered mobile number by SMS and WhatsApp. There is no password anywhere in the system, so there is nothing to guess, reuse across sites, phish for or leak in somebody else's breach; a code is valid once and briefly, and is stored only as a hash. A staff account can be disabled by a founder or an administrator, which invalidates every session it holds immediately. Role-based access — extensive, and the strongest part of the system: clinical data passes a single guard that refuses every staff role, including the founder; a patient's phone number and home-identifying address are earned per patient rather than granted per role, so a support agent sees one only while a ticket naming that patient is assigned to them and open, and a supervisor, founder or administrator sees one only by taking a one-hour, reasoned, audited break-glass grant that is announced by name to the other founders and administrators. Finance, doctors and technical staff never see them, grant or no grant. Access logging — every read of identity or clinical data records the actor, the action, the resource, the outcome (allowed, denied or failed) and the client IP; a refused read is logged as refused, not swallowed; the log is append-only, enforced by the database itself, and the application connects as a role with no permission to change or delete those records and no permission to disable that enforcement. Backups — automated and encrypted, 14 days in production, held across availability zones, with deletion protection on, and restored into a scratch environment on a schedule to prove they can be.
31Do practitioners see patient data on their personal phones? Is the app managed or containerised? Can a practitioner take a screenshot, export, or forward a patient’s record?Yes — the app is installed on the practitioner's own Android phone, and it is not centrally managed. The app offers no export, share or forward function, and a screenshot is possible. What is on screen is deliberately narrow: a practitioner sees only the patient they are currently assigned to, and only the conditions, allergies, age, gender and weight that bear on the care they are about to give — age rather than date of birth, because the clinical question is how old someone is and a birth date is an identifier. Access ends when the visit completes and the note window closes. Every one of those reads is logged against that practitioner.
32Can support staff see a patient’s full clinical record, or only what they need for the booking?No. Clinical data is refused to every staff role without exception — the clinical note appears on no staff-facing view at all, so there is no screen, export or report that carries it. Support sees what a booking needs: who, where, when, and the state of the visit.

Retention and deletion.

S. No.QuestionsCompany Comment
33How long do you want to keep clinical records? There is no fixed statutory period for home nursing.Three years from the last visit, after which the clinical record is destroyed. There is no fixed statutory period for home nursing; three years matches the period the National Medical Commission's regulations set for a patient's records and is the closest established standard. Where a complaint, claim or proceeding is open, the record concerned is retained until it is finally disposed of. On account closure the record is separated from the person's identity at once and destroyed at the end of this period (Q36).
34Are backups encrypted, where are they held, and how long are they kept? Can a single record actually be deleted from a backup, or only from the live system?Encrypted, held by the managed database service in ap-south-1, and kept 14 days in production. A single record cannot be individually removed from a backup that has already been taken. It is deleted from the live system immediately, and the backups that still contain it expire on their own 14-day schedule, after which no copy remains. Our deletion commitment is worded to say exactly this rather than to promise something the backup mechanism cannot do.
35How long should call recordings, chat transcripts, IVR logs and app logs be kept? Recordings are the item that most often outlives its usefulness.Call recordings. Calls between a patient and our staff or practitioner — the pre-visit discovery call, and support calls — are placed through a masked-calling service so that neither side ever sees the other's real number. Those calls are recorded, and the recording is kept for 6 months and then destroyed. Recordings are opened only to investigate a specific complaint or safety incident, and every access is logged. Support chat transcripts are kept for 12 months. Login codes are purged after 24 hours, and the code itself is stored only as a hash, never as text. Application logs are kept for 90 days. There is no IVR.
36What happens when a customer closes an account: is the record deleted, anonymised, or simply deactivated?The record is deleted. A customer can close their account from account settings, and on closure: their name, e-mail, date of birth, saved addresses, family-member records, uploaded documents, chat messages, device tokens and communication preferences are erased outright; their mobile number and any remaining identifying field on the account are overwritten with a non-identifying placeholder, so nothing links the account to a person. Their clinical records are separated from their identity at once and destroyed at the end of the period in Q33. Three things are deliberately kept, and the policy says so: the record of the transaction — invoice number, amount, tax and date, without the customer's identity — because the Companies Act, 2013 and the GST law require books of account to be preserved for 8 years; the record of consent, which is what proves what a person was shown and agreed to, and which the Act requires us to be able to produce; and the access log, which records that somebody read a record and whether they were allowed to, and which exists to protect the patient. All three are append-only and cannot be edited by anyone, including us. Nothing in them carries a name, an address, a phone number or any clinical detail after closure. Backups expire as described in Q34.
S. No.QuestionsCompany Comment
37Where in the journey will the data protection notice and the consent appear: at registration, at booking, or at the first visit? Remember that the customer’s click cannot be the patient’s consent where they are different people.At four points: at login, immediately after the one-time code; at booking; when adding a family member; and again whenever the published version changes, as a re-affirmation. It is one document — these Terms and Conditions — and it is enforced by the server before a booking or any clinical entry, not merely rendered by the app. On the point that the customer's click cannot be the patient's consent where they are different people: the two records are kept separate. Booking for a family member requires the account holder to give a distinct on-behalf consent naming that specific person, and a booking or clinical entry without it is refused by the server. Where the patient is a minor, the account holder must be a parent or lawful guardian and consents for them under section 9 of the Digital Personal Data Protection Act, 2023; a person under 18 cannot hold an account or book for themselves at all (Q14). Where the patient is another adult, the account holder confirms they are authorised to act for them, and that on-behalf consent is what the Company relies on. The practitioner takes the patient's verbal agreement before beginning care (Q16) and will not proceed where the patient objects, whatever the account holder has consented to.
38Will the patient consent form be signed on the practitioner’s device or on paper? If on a device, how are the signature, the timestamp and the version of the form stored?Neither. There is no signature, on a device or on paper. Consent is given by tapping in the account holder's own app, and where the patient is a different person the practitioner obtains their agreement at the bedside and records it on the visit note (Q16). What is stored for every acceptance is: the person, the document, its version, a hash of the exact text that was shown to them, the time it was accepted, the time it was captured, the IP address, the booking it was given for where relevant, and — for an on-behalf consent — the identity of the person it was given for. Because the hash is of the exact published text, the version somebody saw can be produced and proved later.
39How will a customer or patient withdraw consent? It must be as easy to withdraw as it was to give, so if consent is a tap, withdrawal has to be a tap. Who receives the request and who actions it?From account settings, in the same app, in the same number of taps it took to give. A customer can withdraw any consent they have given, including a consent given on behalf of a family member, without writing to anyone or asking anyone's permission. Withdrawal takes effect at once: the consent record is stamped as withdrawn, and the server then refuses any new booking or clinical entry that would depend on it. Bookings already completed are unaffected, and any legal obligation to keep a record of past care continues to apply. Withdrawing consent may mean we can no longer provide the service, and the screen says so before the customer confirms.
40Will you use a Consent Manager, or manage consent yourself? If yourself, where is the consent record stored, and can you produce it later with the version of the notice that was shown?Managed ourselves, not through a Consent Manager. Each published document is stored in full with a version and a hash of its body, and each acceptance stores the hash of the exact text shown to that person, so the version shown can be reproduced later and proved. Consent records are append-only and immutable once written: the database rejects any change except stamping a withdrawal once, on a record that has not already been withdrawn.
41Will any of the consents be genuinely optional: marketing, clinical photographs, sharing with the treating doctor, use of de-identified data for training? Optional consents must be separately tickable and must not block the service.The Terms and Conditions are required, and the service cannot be used without accepting them; nothing in them is presented as optional when it is not. What is genuinely optional, and separately controlled, is communication: each channel — SMS, e-mail and WhatsApp — can be turned off individually, and marketing messages can be refused without affecting anything else. Turning off a channel cannot lock anyone out of their own account, because the login code is structurally unreachable from those settings — a rule enforced by a test that inspects the compiled code, not by convention. No consent is bundled with another, and refusing an optional one never blocks the service. Nothing in the system uses personal data for model training, and no de-identified data set is built or shared.
42If the patient tells you not to share information with the family member who booked and paid, is the product able to honour that?Yes. A patient may tell us not to share their information with the family member who booked or paid, and that instruction is recorded against them and honoured: the booker then sees only what they need in order to have arranged and paid for the visit — that it was booked, for when, where in general terms, and that it took place — and nothing about the patient's condition, treatment or care. This sits on top of a rule that already applies to everyone: the clinical note is shown to no customer at all, including the account holder, so what was found or done is never visible to the booker in any case. The request can be made to the attending practitioner or to support, and it takes effect immediately.

Accountability

S. No.QuestionsCompany Comment
43Who will be named as the person answerable for data protection questions: name, designation, e-mail and direct number? This person must be named in the notice.Bharath Kumar B S, Director, Zypheal Private Limited. support@zypheal.com · 9019808410. The same person is named as Grievance Officer and as Nodal Officer in the Terms of Use.