Arogya is a personal health records management application available at ayur-arogya.com. For all privacy matters, contact: support@ayur-arogya.com.
Under India's Digital Personal Data Protection Act 2023 (DPDP Act), Arogya is the Data Fiduciary — the party that decides what personal data is collected and why. You (the account holder) are the Data Principal.
When you upload a health document, we send it to an AI system (currently Anthropic, Google, or OpenAI depending on document type — see Section 5) for processing. The AI extracts:
This extracted data is stored on our servers and displayed on your health dashboard.
Under the DPDP Act 2023 and IT Act 2000 SPDI Rules 2011, we process your health data on the basis of your explicit consent given during onboarding. All health data is Sensitive Personal Data or Information (SPDI) under the SPDI Rules and receives the highest protection available under Indian law.
By creating a workspace and ticking the consent box, you confirm you have the authority to upload health records for yourself and the family members you add, and that you consent to Arogya processing this data for the purposes described in this policy.
| Purpose | Data used |
|---|---|
| Display your health records on the dashboard | Extracted metrics, findings, profiles |
| Answer health questions via the AI chat | Extracted metrics and findings for the queried member |
| Generate vaccination schedules and health alerts | Date of birth, vaccination history, flagged metrics |
| Send Telegram reminders | Reminder text, Telegram chat ID |
| Attribute uploaded documents to the right family member | Patient name on document, age, sex, family member profiles |
| Maintain your session and keep you logged in | Google account email, session token |
| Recommend relevant products and services to you | Extracted health data (used only within Arogya to select which recommendations to show; not shared with third-party ad networks) |
| Research and commercial analysis | Anonymised aggregate data (individual users cannot be re-identified from this dataset) |
| Detect and fix processing errors | Server logs (no health values) |
We share data only with the following processors, solely to provide the service:
| Processor | Role | What they receive | Their privacy terms |
|---|---|---|---|
| Anthropic, PBC | AI document extraction (PDFs) | The document you upload (image or PDF bytes) is sent to Anthropic's Claude API for text and data extraction. No extracted data is sent back to Anthropic beyond the API response. Called under Anthropic's standard commercial API terms (no training use of your data). | anthropic.com/privacy |
| Google LLC (Drive + Sign-In) | Authentication (OAuth) and file storage (Drive) | Your Google identity is used to sign in. Uploaded documents are stored in a dedicated "Ayur_Arogya_AI" folder in your own Google Drive — Arogya can only access files it created (drive.file scope). | policies.google.com/privacy |
| Google LLC (Gemini API) | AI document extraction (images) + chat | Images of health documents (photographed reports, scans) and the health-record context for AI chat answers are sent to Google's Gemini API. Called on a paid Google Cloud billing account under Gemini's paid-tier terms (Google does not use paid-tier prompts or responses to improve their products). | ai.google.dev/gemini-api/terms |
| OpenAI, Inc. | AI extraction for specific clinical document types | Images of a small set of document types — ECGs, echocardiograms, stress tests, and consultation / OPD notes — are sent to OpenAI's API because it currently produces better results for those specific document classes. Called under OpenAI's standard API terms (no training use of API data by default). | openai.com/policies/privacy-policy |
| Fly.io, Inc. | Server hosting | Our application server and database run on Fly.io infrastructure in the Mumbai, India region. Fly.io does not access your health data. | fly.io/legal/privacy-policy |
| Tigris Data, Inc. | Encrypted database backups (S3-compatible object storage) | Our live database is continuously replicated to Tigris using Litestream, so that a server-hardware loss doesn't destroy your data. The backups are private (server-side encrypted) and retained for 7 days on a rolling window. | tigrisdata.com/privacy |
| Functional Software, Inc. (Sentry) | Error monitoring | When the application crashes or logs an error, Sentry receives the error type, stack trace, and a build identifier so we can debug. We configure Sentry with send_default_pii=False and include_local_variables=False so that request bodies, user identities, and stack-frame values are not attached to events. A small number of internal error messages may still include short LLM output snippets used for debugging — we are working on removing these. |
sentry.io/privacy |
| Google LLC (Analytics) | Product usage analytics | Anonymised usage events — pages visited (with all personal identifiers removed from the address), approximate location from an anonymised IP, device type, and referring site. No health data, names, or document contents are sent, and Google's advertising / cross-device features are disabled. You can opt out in Settings → Privacy. | policies.google.com/privacy |
We do not sell or rent your identifiable data to third parties, and we do not use external advertising networks. If we introduce partner offers or share data with additional processors (for example, to deliver product recommendations described in Section 4), we will update this list before doing so.
Arogya's access to your Google account is limited to signing you in and to the
drive.file scope. drive.file lets the app create files in a dedicated
"Ayur_Arogya_AI" folder in your own Google Drive and read back only the files it created there.
Arogya cannot see, open, or access any other file in your Google Drive.
Arogya's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. The data we obtain through Google APIs is used only to provide and improve the user-facing features described in this policy; it is never sold, never used for advertising, and never transferred to others except as necessary to provide the service, to comply with applicable law, or in connection with a merger or acquisition. No human reads this data except with your explicit consent, for security purposes, or to comply with applicable law.
Note on backup: The live database is continuously replicated to Tigris (S3-compatible object storage) using Litestream. Backups are private, server-side encrypted, and retained on a rolling 7-day window — data you delete disappears from backups within that window. Your original uploaded documents also remain in your personal Google Drive.
| Data type | Retention period |
|---|---|
| Health records and extracted data for an active member | Retained while your account is active |
| Data for a deleted family member | Deleted within 30 days of member deletion |
| All data on account closure | Deleted within 30 days of account closure request |
| Server access logs | 30 days, then automatically purged |
| Audit events (no health data) | 12 months |
Arogya allows you to add family members who are under 18 years of age (minors). When you add a minor, you are required to confirm that you are their parent or lawful guardian and that you consent to Arogya processing their health records on their behalf.
We do not knowingly allow minors to create their own Arogya accounts. We do not track minors' behaviour, serve them advertising, or use their data for any purpose beyond organising their health records — the product-recommendation use described in Section 4 does not apply to minors' data. When a minor in the system turns 18, we will prompt the account admin to invite them to manage their own records.
This is consistent with the DPDP Act 2023 Section 9, which requires verifiable parental consent for the processing of personal data of children and prohibits behavioural monitoring of minors.
Under the DPDP Act 2023 and SPDI Rules 2011, you have the following rights:
| Right | How to exercise it |
|---|---|
| Access — view the data we hold about you | Your dashboard shows all extracted health data. Email support@ayur-arogya.com for a full data export. |
| Correction — fix inaccurate data | Edit member profiles via the web dashboard. For extracted metric corrections, contact support@ayur-arogya.com. |
| Erasure — delete your data | Delete individual members from the dashboard (data erased within 30 days). To close your account and delete all data, email support@ayur-arogya.com. |
| Withdrawal of consent — stop processing | Email support@ayur-arogya.com. We will close your account and delete all data within 30 days. |
| Grievance — complain about how we handle your data | Contact our Grievance Officer (details below). We will respond within 30 days. |
As required under the IT Act 2000 SPDI Rules 2011 (Rule 5(9)) and the DPDP Act 2023 (Section 13), we have designated a Grievance Officer to receive and resolve complaints about our data practices.
Arogya uses AI to extract structured data from uploaded health documents. This means the content of your uploaded document is sent to external servers for processing. The specific providers we use today are listed in Section 5; we may add or change providers over time as models evolve.
The AI providers we currently use (such as Anthropic and Google) publish Terms of Service stating that data submitted via their APIs is not used to train their models by default. We have reviewed their data processing terms and rely on them as our Data Processors. When we change providers we will update this policy to reflect the new list.
Note: Document processing by these AI providers occurs on servers outside India. We have assessed this as consistent with the DPDP Act's cross-border transfer provisions for processor relationships. We will update our practices if the Government of India issues specific localisation requirements for health data under the DPDP Rules.
Arogya uses a single authentication cookie (arogya_web) to keep you signed in.
This cookie is HttpOnly, Secure, and expires after 30 days. We do not use advertising cookies.
We use Google Analytics to understand how the app is used — which pages are visited, for how long, and where visitors arrive from — so we can improve it. It is configured to protect your privacy: your IP address is anonymised, page addresses are stripped of every personal identifier (member, document and record IDs are replaced with placeholders) before being sent, page titles are never sent, and Google's advertising and cross-device features are switched off. No health data — no names, conditions, medications, documents or metric values — is ever sent to Google Analytics. You can turn analytics off at any time from Settings → Privacy → Usage analytics; the app works exactly the same either way.
We will update this policy when our data practices change in a material way. We will notify you of significant changes by showing a notice in the app and, where possible, via email. The version number and effective date at the top of this page will be updated with each change. Continued use of Arogya after a policy update constitutes acceptance of the updated terms.
This policy is governed by the laws of India, including the Information Technology Act 2000, the IT (Reasonable Security Practices and Procedures and SPDI) Rules 2011, and the Digital Personal Data Protection Act 2023.