PRIVACY NOTICE

1. About this Notice

This document is issued by AVDAUSON HEALTHTECH PRIVATE LIMITED, a company incorporated under the Companies Act, 2013. The Company owns and operates the "Aarog Health Records" mobile applications and the website www.aaroghealthrecords.com (together, "Aarog"). "Aarog" is a brand of the Company and is not a separate legal entity.

This Privacy Notice explains what personal data we collect through Aarog, why we collect it, how we use, share and protect it, how long we keep it, and the rights you have. It applies to the Aarog mobile applications, the website www.aaroghealthrecords.com and our customer support. Aarog is offered to people in India. You may ask us for this Notice in Hindi or any other language listed in the Eighth Schedule to the Constitution of India.

Please read this Notice together with our Terms of Use, Health Data & AI Consent, Family Member, Caregiver & Children's Data Policy, Data Retention Policy, Account Deletion Policy and Medical, AI & Emergency Disclaimer. If this Notice and any other Aarog document differ on how personal data is handled, this Notice applies, except where you have given a more specific consent in the app.

2. Who is responsible for your data

For personal data processed through Aarog – yours, and that of family members whose profiles you manage – the Company is the Data Fiduciary: we decide why and how the data is processed.

Service providers that process data for us on our written instructions (for example, our cloud host and our AI provider) are Data Processors. They may use the data only to provide their service to us. They are listed at www.aaroghealthrecords.com/sub-processors.

3. Laws we follow

We handle personal data in line with Indian law, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force, and the directions of the Indian Computer Emergency Response Team (CERT-In). We also follow the privacy requirements of the Apple App Store and Google Play.

4. Key terms

• Personal data means any data about an individual who can be identified from it.
• Health information means information about a person's physical or mental health, including medical records, prescriptions, reports, scans, bills, vitals, medicines, allergies and conditions. We treat all health information as sensitive.
• You means the person who has an Aarog account.
• Family member means any person whose profile you create or manage in Aarog.
• Child means a person below 18 years of age.
• Aarog AI means the optional artificial-intelligence features described in section 7.

5. What we collect, why, and for how long

We collect only what is needed for these purposes. We do not ask for government identity numbers unless a specific feature needs them and we tell you why. Where you upload a document that contains more information than we need (for example, an ID number printed on a bill), we store the document as you uploaded it and do not use that extra information for any other purpose.

We do not use your health information for advertising, and we do not sell it.

6. Consent and your choices

How we ask for consent. We process your health information only with your consent. We ask for it inside the app, on a separate screen, through a clear action such as ticking an unticked box or tapping "I agree". Each consent screen tells you what data is involved and why. Downloading, browsing or using Aarog does not by itself count as consent to process health information.

Separate choices. Storing and organising your records is needed for Aarog to work. AI features, AI-suggested reminders, product analytics and promotional messages are optional. Each has its own on/off choice, and refusing them does not stop you using the core app.

Withdrawing consent. You can withdraw any consent at any time in Settings > Privacy > Consents, or by writing to our Grievance Officer. Withdrawing is as easy as giving consent. Once you withdraw, we stop the related processing within 48 hours, and we erase the related data within 30 days unless the law requires us to keep it (see section 12). Withdrawal does not affect processing done before it. If you withdraw consent for the core service, we will help you export your records and then close your account.

Proof of consent. We keep a record of each consent and withdrawal (date, time, policy version and device) for as long as your account exists and for 3 years after that.

7. AI features and OpenAI

What Aarog AI does. Aarog offers optional AI features ("Aarog AI"). It reads and summarises documents you choose. It extracts medicine names, doses, dates and amounts from prescriptions, reports and bills. It suggests reminders from follow-up dates. It answers questions in the Aarog AI chat.

Who processes the data. These features use OpenAI OpCo, LLC ("OpenAI"), which acts as our Data Processor.

What is sent. Only what the feature needs. For document analysis, that is the document you select. For chat, it is the text you type, plus any record you choose to attach. We do not send your name, mobile number or email to OpenAI unless they appear inside a document you choose to analyse.

Your permission comes first. Before any of your information is sent to OpenAI, we ask for your explicit permission inside the app, separately for document analysis and for chat. Accepting the Terms of Use or this Notice is not that permission. If you do not give permission, nothing is sent to OpenAI and the rest of Aarog keeps working. You can switch AI off at any time in Settings > Privacy > AI features.

Where it is processed. OpenAI processes data outside India, currently in the United States. See section 11.

What OpenAI may do with it. Under our agreement, OpenAI may use your data only to provide the feature to us. It may not use your data to train its models. OpenAI may keep data for up to 30 days for abuse monitoring, and longer only where the law requires, and then deletes it.

AI results need your check. AI results are labelled "AI-extracted – please verify" until you confirm them. When Aarog AI is not confident about a medicine name, dose or value, it shows "We couldn't read this clearly – please check the original" instead of guessing. No reminder is created from an AI result until you confirm it.

What we never do. We do not use your documents, chats or AI results for advertising, and we do not use them to train any AI model, ours or a vendor's.

Aarog AI does not diagnose, prescribe or give medical advice. Please read our Medical, AI & Emergency Disclaimer.

8. Family members and children

You can manage health records for your family. Every adult family member has their own privacy rights. To manage an adult's records, you either invite them to give consent through the app or, if they cannot use a phone themselves, declare in the app that they have asked you to manage their records. Adult family members can see who manages their profile, take it over, limit access or remove it at any time.

Children cannot open their own Aarog account. A parent or lawful guardian may create and manage a child's profile after confirming in the app that they are an adult and the child's parent or lawful guardian; we keep a record of that declaration. We do not track or monitor a child's behaviour and we do not direct targeted advertising at children. When a child turns 18, they can take control of their own profile.

The full rules are in our Family Member, Caregiver & Children's Data Policy.

9. Medical ID, emergency contacts and sharing

Medical ID and Emergency Card. You decide what information appears on your Medical ID and who can see it. Anyone who has your phone or card can see what you put on it.

Emergency contacts. Please tell people before you add them as emergency contacts. We use their details only to show them on your Medical ID and on your public Medical ID / QR, and so you can call them from the app.

Sharing with doctors and others. When you share records through a link or Doctor QR, you choose the records, the expiry (default 24 hours, maximum 7 days) and whether the recipient can download them. You can revoke a share at any time and see when it was opened. Once a recipient has viewed or downloaded a record, they hold their own copy and are responsible for it.

10. Who we share data with

Service providers. We share personal data with service providers only to run Aarog, under written contracts that: (a) limit their use of the data to our instructions; (b) require security at least equal to ours; (c) require them to tell us promptly about any breach; (d) forbid selling the data or using it for advertising or to train AI models; and (e) require them to delete or return the data when their service ends. Our current list of providers – what each does, what data it receives and where it processes it – is at www.aaroghealthrecords.com/sub-processors. We will update the list at least 15 days before adding a provider that will receive health information.

People you choose. We share records with doctors, hospitals, family members or anyone else only when you instruct us to.

When the law requires it. We may disclose personal data where required by law, a court order or a lawful request from an authorised government agency, to prevent or investigate fraud or a cyber incident, or to protect someone's life or safety. Where the law allows, we will tell you before we disclose.

Business transfers. If the Company is merged, acquired or restructured, personal data may be transferred to the new owner, who must protect it as described in this Notice. We will tell you at least 30 days in advance, and you may delete your account before the transfer.

No sale. We do not sell, rent or trade your personal data or health information, and we do not share it with advertisers, insurers, pharmaceutical companies or data brokers.

11. Transfers outside India

Your records are stored on Amazon Web Services (AWS) servers in India, in the Mumbai region (ap-south-1). Some processing happens outside India: (a) Aarog AI, through OpenAI in the United States, only after you give permission (section 7); (b) Brevo, for service and support emails, in the European Union; (c) Google Firebase, for push notifications, crash reports and, only if you opt in, app-usage analytics; (d) Google Sign-In or Sign in with Apple, if you choose those login methods; and (e) AWS CloudFront, which may deliver your stored files through servers outside India. Text messages, including OTPs, are sent through Fast2SMS in India.

We transfer data only to providers bound by written contracts that protect it at least as well as this Notice and Indian law require, and only where the transfer is needed to provide a service you asked for or you have consented to it. We will stop any transfer to a country or territory that the Government of India restricts under section 16 of the Digital Personal Data Protection Act, 2023.

12. How long we keep data

We keep personal data only as long as it is needed for the purpose for which it was collected, or as long as the law requires. The main periods are set out in section 5 and in full in our Data Retention Policy. In summary:

• Your records stay until you delete them. When you delete a record or your account, we erase it from our live systems within 30 days and from our encrypted backups within 90 days.
• Security and audit logs are kept for 1 year in India.
• Invoices and payment records are kept for 8 years, as required by tax and company law.

13. How we protect your data

We use security measures suited to health information, including: encryption of data in transit (TLS 1.2 or higher) and at rest; access to health data only for staff who need it, with multi-factor authentication and logged access; an app lock with biometrics or MPIN, and automatic lock after a period of inactivity; secure, expiring links for sharing; security testing before major releases and at least once a year; and an information-security programme based on IS/ISO/IEC 27001, reviewed at least once a year. Our AI provider, OpenAI, also encrypts data in transit and at rest. Our staff and vendors are bound by confidentiality obligations.

Face ID and fingerprint. These are handled by your phone's operating system. Aarog receives only a pass/fail result and never collects your biometric data.

Your part. Please keep your phone locked, do not share your OTP or MPIN, and tell us immediately if you think someone else has accessed your account.

No system is completely secure, so we cannot promise that a breach will never happen. If one does, we will act as described in section 14.

14. Personal data breach

If a breach affects your personal data, we will:

(a) tell you without delay, in the app and by SMS or email, in plain language: what happened and when, what data was involved, the likely impact on you, what we have done, what you should do to protect yourself, and whom to contact;

(b) report to CERT-In within 6 hours of noticing a reportable cyber incident, as required by the CERT-In Directions of 28 April 2022; and

(c) once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force, inform the Data Protection Board of India without delay, and send a detailed report within 72 hours or any longer period the Board allows.

We keep a record of every incident and the steps we took.

15. Your rights

You can exercise these rights free of charge, in the app or by writing to our Grievance Officer:

• Access: a summary of the personal data we hold about you, what we do with it, and who we share it with (Settings > Privacy > My data).
• Correction and updating: edit your data in the app, or ask us to correct it.
• Erasure: delete any record, or your whole account (see our Account Deletion Policy).
• Withdraw consent: see section 6.
• Nominate: name a person who can exercise your rights if you die or become unable to (Settings > Privacy > Nominee).
• Export: download all your records as PDF or ZIP.
• Grievance: see the end of this Notice.

We will act on your request within 15 days. If we need more time, up to 30 days in total, we will tell you why. We may ask you to verify your identity, but we will not ask for more information than we need.

Rights over a family member's data belong to that family member, or to the parent, guardian or nominee acting for them.

16. Cookies

Our website uses cookies as described in our Cookie Policy. The Aarog app does not use browser cookies; it uses secure session tokens stored on your device.

17. De-identified data

We may create statistics from data that has been irreversibly de-identified so that no person can be identified from it, for example to understand how many records are uploaded each month. We do not try to re-identify anyone, and we do not use health information for research without your separate consent.

18. Changes to this Notice

We may update this Notice. For material changes – new purposes, new kinds of data, new recipients of health information, or fewer rights for you – we will tell you in the app and by email at least 15 days before the change takes effect. Where a change needs your consent, we will ask for it, and we will not apply that change to you until you agree.

Grievance Officer and contact

If you have a question, complaint or request about this document or about your personal data, please contact our Grievance Officer:

• Name: Mr. Arpan Gupta
• Designation: Grievance Officer, AVDAUSON HEALTHTECH PRIVATE LIMITED
• Email: support@aaroghealthrecords.com (please write "Grievance" in the subject line)
• Phone: +91 98781 23696 (Monday to Saturday, 10:00 a.m. to 6:00 p.m. IST, except public holidays)
• Registered office: AVDAUSON HEALTHTECH PRIVATE LIMITED, 206, Tower 6, Millenium Garden, Zirakpur, Punjab 140603, India

How we handle your grievance. We will acknowledge your grievance within 24 hours and give you a ticket number. We will resolve it within 15 days of receipt. If a law that applies to your grievance sets a shorter period, we will follow that period. If we need more information from you, we will ask within 3 working days.

If you are not satisfied. You may ask for a review by our founder, Mr. Anurag Verma, by writing to support@aaroghealthrecords.com with "Review request" in the subject line. After using this grievance mechanism, you may approach the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, once the relevant provisions are in force. You may also use any other remedy available to you under law, including the Consumer Disputes Redressal Commissions.

Our full Grievance Redressal Policy is available at www.aaroghealthrecords.com/grievance.