FAMILY MEMBER, CAREGIVER & CHILDREN'S DATA POLICY

1. About this Policy

This document is issued by AVDAUSON HEALTHTECH PRIVATE LIMITED, a company incorporated under the Companies Act, 2013, (the "Company", "we", "us" or "our"). The Company owns and operates the "Aarog" / "Aarog Health Records" mobile applications and the website www.aaroghealthrecords.com (together, "Aarog"). "Aarog" is a brand of the Company and is not a separate legal entity.

Aarog lets you keep health records for your family in one place. This Policy explains when you may create or manage another person's profile, how that person's consent is obtained, and what rights they keep. It should be read with our Privacy Notice and Terms of Use.

Every family member is a person with their own privacy rights. The Company is responsible for their data in the same way as it is for yours.

2. Who you can add

You may create or manage a profile for:

• an adult family member (for example, a spouse, parent, grandparent or sibling) who has accepted your invitation or asked you to manage their records (section 3);
• an adult who cannot make decisions, if you are their lawful guardian, hold a valid power of attorney covering health matters, or are their nominee in Aarog (section 4); and
• a child (anyone under 18), if you are the child's parent or lawful guardian (section 5).

3. Adult family members

To manage an adult family member's records, you must do one of the following:

(a) Invite them. They receive a link by SMS or WhatsApp, see exactly what you will be able to view and do, and give consent with an OTP; or

(b) Declare authority. If they cannot use a phone themselves, confirm in the app that they have asked you to manage their records. Where we have their mobile number, we will send them a notice so they know.

Their control. An adult family member can at any time see who manages their profile, take it over, limit what you see, or remove your access – in the app or by writing to our Grievance Officer.

4. Caregivers for adults who cannot decide

If an adult family member cannot make decisions (for example, because of illness, cognitive impairment or disability), you may manage their profile as their caregiver if you are their lawful guardian, hold a valid power of attorney covering health matters, or are their nominee in Aarog.

Where the law requires us to verify a lawful guardian, we will ask for proof, such as a guardianship order of a court or a certificate issued by the authority designated under applicable disability law. We review caregiver access whenever we receive a credible objection.

5. Children

Who is a child. A child is anyone under 18 years of age. Children cannot open their own Aarog account. A parent or lawful guardian may create and manage a child's profile from their own account.

Verifying the parent. Before we process a child's information, we ask the person creating the profile to confirm in the app that they are an adult and the child's parent or lawful guardian, and we keep a record of that declaration. Before the verifiable-consent requirements of the Digital Personal Data Protection Rules, 2025 apply, we will add a verification method permitted by those Rules (for example, a DigiLocker-based token), and we may ask existing parents to complete it.

No tracking or targeted advertising. We do not track or monitor a child's behaviour and we do not direct targeted advertising at children. A child's data is used only to provide Aarog to the parent or guardian.

Two parents. Both parents or guardians may co-manage a child's profile. Either may invite the other.

Turning 18. When a child's profile reaches 18, we will ask the parent to invite the new adult to take control. The adult can take over the profile, keep the parent as a caregiver (with the adult's consent), or ask us to delete it. Until the adult decides, and for up to 90 days, the parent's access becomes view-only. After that, access is paused until the adult acts.

6. Your responsibilities when you manage someone else's profile

You agree to:

• declare only authority or consent that is true, and keep it up to date;
• keep family members' information confidential and use it only for their care;
• share their records only where they would expect it or have agreed;
• stop accessing a profile, and remove it or tell us, as soon as your authority ends; and
• tell us promptly about any unauthorised access to a family member's records.

7. Sharing family members' records

You may share a family member's records only where you are authorised to. Sharing works in the same way as for your own records: you choose the records, the recipient, the expiry and whether they can download, and you can revoke the share at any time. Once a recipient has viewed or downloaded a record, they hold their own copy and are responsible for it.

8. Disputes and revocation of authority

If a family member, or someone acting for them, tells us that you do not have authority to manage their profile:

• we will pause your access to that profile within 72 hours and tell you;
• we will ask both of you for any relevant information;
• we will decide within 15 days and tell both of you the outcome; and
• we will not delete the records during the review unless the family member asks us to.

We do not decide family relationships, guardianship, inheritance or medical decision-making authority. Except where the law requires us to verify, we rely on the declarations made in the app and on the documents provided to us.

9. What happens to family profiles when an account is deleted

• If another person co-manages the family profile, it stays with them.
• Adult family members who consented are told and can take over their own profile.
• A child's profile is deleted unless the other parent or guardian co-manages it.

Full details are in our Account Deletion Policy.

10. Responsibility for false declarations

If you create or manage a family member's profile without the authority you declared, you are responsible for the consequences, as set out in section 26 (Indemnity) of our Terms of Use.

11. Changes to this Policy

We may update this Policy. We will tell you in the app at least 15 days before a material change takes effect. Where a change needs fresh consent, we will ask for it.

Grievance Officer and contact

If you have a question, complaint or request about this document or about your personal data, please contact our Grievance Officer:

• Name: Mr. Arpan Gupta
• Designation: Grievance Officer, AVDAUSON HEALTHTECH PRIVATE LIMITED
• Email: support@aaroghealthrecords.com (please write "Grievance" in the subject line)
• Phone: +91 98781 23696 (Monday to Saturday, 10:00 a.m. to 6:00 p.m. IST, except public holidays)
• Registered office: AVDAUSON HEALTHTECH PRIVATE LIMITED, 206, Tower 6, Millenium Garden, Zirakpur, Punjab 140603, India

How we handle your grievance. We will acknowledge your grievance within 24 hours and give you a ticket number. We will resolve it within 15 days of receipt. If a law that applies to your grievance sets a shorter period, we will follow that period. If we need more information from you, we will ask within 3 working days.

If you are not satisfied. You may ask for a review by our founder, Mr. Anurag Verma, by writing to support@aaroghealthrecords.com with "Review request" in the subject line. After using this grievance mechanism, you may approach the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, once the relevant provisions are in force. You may also use any other remedy available to you under law, including the Consumer Disputes Redressal Commissions.

Our full Grievance Redressal Policy is available at www.aaroghealthrecords.com/grievance.