Privacy Policy

This Privacy Policy explains how AyuBridge collects, uses, shares and protects personal data, including health-related data, when you or your clinic uses our healthcare management platform. It is written to be readable. If anything is unclear, please write to our grievance officer (Section 10).

We aim to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules made under it, the Information Technology Act, 2000, and sector-specific guidance for health data in India.

AyuBridge is operated by <<AYUBRIDGE LEGAL ENTITY>>, a company incorporated in India and acting as a Data Fiduciary with respect to data we collect directly (e.g. demo requests, account holders signing up directly with us). Where a clinic uses AyuBridge to manage its own patient records, AyuBridge typically acts as a Data Processor on behalf of that clinic.

• Identity & demographic data: name, date of birth, gender, photograph (optional), address.
• Contact data: phone number, email, emergency contact details.
• Clinical data: medical history, allergies, current conditions, vital signs, consultation notes, prescriptions, lab/imaging results, visit notes, clinical messages between patient and clinic, ABHA number (where provided).
• Account & usage data: login timestamps, role, IP address (for security and audit), browser/device metadata.
• Payment metadata: Razorpay transaction IDs, amounts, status. We do not store card numbers, CVVs or UPI PINs.

• To provide clinic management services to your clinic.
• To enable booking, consultation, prescription and billing workflows.
• To send appointment confirmations, reminders and clinical follow-ups (only via channels you have opted into).
• To meet our legal, regulatory and audit obligations.
• To investigate and prevent abuse, fraud and security incidents.
• To improve the platform, with PHI never used for product analytics.

• Directly from you when you fill out a registration form, book an appointment, or update your profile.
• From your clinic when staff register you, upload bulk records, or capture data during a visit.
• Automatically when you use the platform — login events, audit-log entries for every PHI access, and standard server logs scrubbed of PHI.

We do not sell your personal data. We share it only with:

• Clinic staff, on a role-based access basis (doctors, managers, front-desk staff). Each access is recorded in our audit log.
• Amazon Web Services (AWS), as our infrastructure processor. Patient data is hosted in AWS Mumbai (ap-south-1).
• Razorpay, for processing online payments and UPI/card transactions, where you choose to pay through the platform.
• Meta (WhatsApp Business Cloud API), for sending appointment messages — only if you have opted into WhatsApp messaging.
• Amazon SES, for transactional emails such as account activation and appointment confirmations.
• Government and regulatory authorities, when required under applicable law (e.g. CERT-In incident reporting).

Patient data is stored and processed in India (AWS ap-south-1, Mumbai). Some control-plane metadata is processed outside India in the ordinary course of running a global cloud service:

• Our public TLS certificate is issued via AWS Certificate Manager in us-east-1 (a CloudFront requirement). The certificate itself is metadata and contains no PHI.
• Our public website's static assets (CSS, JS, images) are served from CloudFront edge locations globally. PHI is never cached at the edge.

Under the DPDP Act, transfer to non-blacklisted countries is currently permitted. The Government of India may notify restricted countries from time to time; we will update this policy if our practices change in response.

• Active records: while you (or your clinic) hold an active account.
• After account closure or pilot termination: 30 days, after which clinical and personal data is deleted, except as required to be retained by law.
• Audit logs of access to clinical data: retained for up to 7 years (consistent with HIPAA-grade discipline) and at least 6 years (consistent with typical DPDP record-keeping expectations).
• Server logs and security events: retained for 180 days (CERT-In Direction, 28 April 2022).

Under the DPDP Act you have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate or incomplete personal data.
• Erase your personal data (subject to legal retention obligations).
• Withdraw consent you previously gave for any specific processing.
• Nominate another individual to exercise your rights in case of death or incapacity.
• Lodge a grievance with us first, and then with the Data Protection Board of India if not satisfied.

For patients with an account, the fastest route is the in-app Delete Account page (for erasure) and the in-app profile / records pages (for access and correction).

For all other rights or any questions, contact our grievance officer: ayubridge.in/grievance-officer or email grievance@ayubridge.in.

We do not knowingly collect data from individuals under 18 without verifiable parental or guardian consent. Where a clinic registers a minor, the parent or guardian is responsible for providing consent and managing the minor's record on their behalf. If you believe we have collected data from a minor without proper consent, write to grievance@ayubridge.in and we will act on it.

• Encryption at rest (AES-256) for the database, file storage, and backups.
• Encryption in transit (TLS 1.2+) for every connection.
• Role-based access control (Admin, Manager, Doctor, Staff, Patient).
• Audit logging of every access to clinical data, attributable to a specific user account.
• Network isolation (private subnets, security groups) and least-privilege IAM.
• Periodic security review and incident-response procedures.

No system is perfectly secure. If you suspect a security incident, please write to grievance@ayubridge.in immediately.

We may update this policy from time to time. Material changes will be communicated to active users by email and through an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision; we encourage you to review it periodically.

• Grievance officer: ayubridge.in/grievance-officer
• Email: grievance@ayubridge.in
• Postal address: <<AYUBRIDGE REGISTERED OFFICE>>