Privacy Policy

Effective date: 15 October 2026

This Privacy Policy explains how Aasaanop Technologies Private Limited ("Aasaanop", "we") collects and uses personal data, including health data, across the Aasaanop website and apps. It is our notice under the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act"), and it follows the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and ABDM's Health Data Management Policy.

1. Our role

• For your Aasaanop account (sign-in, bookings, payments, orders, app settings) Aasaanop is the Data Fiduciary: we decide why and how this data is used.
• For records a hospital, clinic, lab or pharmacy creates about you (visit notes, prescriptions, test results, bills, admission records) that facility is the Data Fiduciary. Aasaanop processes those records on the facility's behalf, as its Data Processor, under a written agreement. Requests about them can go to the facility or to us; we will help the facility answer them.

2. What we collect

• Identity and contact: name, mobile number, email, age or date of birth, gender, address, photo, emergency contact, and details of family members you add.
• Health data: symptoms and reasons for visits, vital signs, allergies, conditions, medicines, prescriptions, test orders and results, reports, scans, discharge summaries, consultation notes, and ABHA number or address if you choose to add them.
• Bookings and orders: appointments, queue tokens, tests, medicine orders, companion trips, delivery addresses, ratings and reviews.
• Payments: amounts, payment references, UPI transaction IDs and refund details. Card details are handled by the payment gateway; we never see or store your card number or CVV.
• Location: your location when you search nearby or share it for a delivery or companion trip; for riders and companions, their location while they are online on a job.
• Audio: if a doctor uses the voice note (AI scribe) feature during your consultation, the recording of that consultation.
• Device and usage: IP address, device and browser type, app version, crash reports and push-notification tokens.
• For partners (riders, companions, doctors, facility staff): KYC and professional documents such as Aadhaar, PAN, driving licence, vehicle details, medical registration, bank account for payouts.

3. Why we use it

• To provide the service you ask for: bookings, queues, records, orders, deliveries, companion trips, payments, refunds and support.
• To let the Providers treating you see the information they need for your care, and to send them your booking.
• To send you OTPs, booking updates, reminders, reports and bills by SMS, email or push notification, and on WhatsApp only if you have opted in to WhatsApp messages (see section 6). Marketing messages are sent only if you opt in, and you can opt out at any time.
• To keep the Platform secure, prevent fraud and misuse, fix problems and improve features (using aggregated or de-identified data wherever possible).
• To meet legal obligations (tax, accounting, medical-record, consumer and regulatory requirements) and to respond to lawful requests from authorities (see section 7).

We rely on your consent for these purposes, given when you create an account or use a feature, and on the legitimate uses the DPDP Act allows (for example responding to a medical emergency or meeting a legal obligation). We do not sell your personal data, and we do not use your health data for advertising.

4. Children and dependents

Our accounts are for adults. A parent or lawful guardian may add a child (under 18) or a dependent adult under their own account and gives consent on their behalf; the guardian can see and manage that person's bookings and records. We do not knowingly track children or show them targeted advertising.

5. Who we share it with

• Providers you book with or are treated by, and only the information needed for your care or order.
• Delivery partners and companions: your name, phone (through masked or in-app contact where available), pickup and drop address and order details needed to complete the job.
• Service providers who process data for us under contracts that require them to protect it:
• Supabase (database, file storage and sign-in), hosted on Amazon Web Services in Mumbai, India;
• Vercel (website and app hosting);
• Razorpay and the facility's chosen gateway (payments, refunds and payouts);
• Twilio (SMS one-time passwords);
• Meta / WhatsApp (messages you agree to receive);
• Google Maps (maps, addresses and distances);
• Sarvam AI, India (transcribing a doctor's voice note);
• NVIDIA (AI features: transcribing a doctor's voice note when Sarvam is unavailable, writing the draft consultation note, reading uploaded prescriptions and stock invoices, and summarising notes);
• PostHog / Mixpanel (product analytics, only if you accept analytics cookies).

WhatsApp message content is never sent to AI or analytics providers. Only the AI features listed above use AI providers, and only for the data those features need.

• ABDM: only if you add your ABHA and, once our ABDM integration is live, only with the consent you give through ABDM.
• Authorities: where required by law, court order or to protect someone's life or safety.

Some of these providers process data outside India (for example AI and analytics services). We transfer data abroad only as the DPDP Act permits and never to a country the Government restricts. Your health records themselves are stored in India.

6. WhatsApp Business Platform

Aasaanop is a Meta Tech Provider. We use the WhatsApp Business Platform (Cloud API) in two ways:

• A facility's own number. A hospital, clinic, lab or pharmacy can connect its own WhatsApp Business Account to Aasaanop through Meta's Embedded Signup. Messages to its patients then come from its own number, and Meta bills the facility for them directly.
• The Aasaanop number. For facilities that have not connected a number, Aasaanop sends the same messages for them from Aasaanop's own WhatsApp Business number, using message templates approved by Meta.

What we receive from Meta. When a facility connects its account, and for messages on the Aasaanop number, we receive:

• the WhatsApp Business Account ID, phone number ID, display name, phone number and verified business name;
• an access token for that account (stored encrypted, used only by our servers);
• message delivery and read statuses, and message template statuses;
• the number's quality rating and messaging limit;
• messages patients send to that number (text, and any photos or documents they attach), with the sender's phone number and WhatsApp profile name.

How we use it. Only to send and receive WhatsApp messages for that facility (booking confirmations, appointment reminders, reports, bills and replies to patients), to show the facility its inbox, message health and how many messages it sent, and to keep the service secure. For these messages the facility is the business on WhatsApp and Aasaanop acts as its processor. We do not:

• sell this data or share it with data brokers;
• use it for advertising, ad targeting, or to build profiles of patients;
• send WhatsApp message content to AI or analytics providers;
• use it for any purpose other than providing the service to the facility and its patients.

Who can see the messages. Only the facility's staff whose role allows it (for example, receptionists of a hospital cannot open its WhatsApp inbox, and a doctor sees only their own patients' chats), and Aasaanop staff when needed to support the facility or keep the service safe.

Opt-in for every WhatsApp message. A patient receives WhatsApp messages from a facility only after opting in to WhatsApp messages from that facility, for example at its registration desk, or in the Aasaanop app (Profile → WhatsApp messages). This applies to all messages, including booking updates and reports, not only marketing. Patients can stop them at any time by replying STOP to any message, or by switching WhatsApp messages off in Profile.

No medicine sales on WhatsApp. Medicines are ordered only inside the Aasaanop app. WhatsApp is used only for updates, reminders, reports and replies.

Disconnecting and deletion. A facility's owner or admin can disconnect WhatsApp in the portal (Integrations → WhatsApp → Disconnect WhatsApp). We then unsubscribe from the facility's account at Meta and delete its access token immediately. We delete its WhatsApp messages, conversations, queued messages and Meta event logs 30 days later, unless it reconnects first or the law requires us to keep them. Patients' WhatsApp choices are kept. Anyone can ask us to delete their WhatsApp data; see the Data Deletion Instructions at aasaanop.com/data-deletion. When Meta sends us a data deletion request for a person, we delete their data in the same way.

Where it is kept and who processes it for us. Data we receive from Meta is stored and processed only in our database and server functions run by Supabase, Inc., on Amazon Web Services in Mumbai, India. No other service provider receives it.

Meta processes WhatsApp data under the WhatsApp Privacy Policy (whatsapp.com/legal/privacy-policy) and the WhatsApp Business terms.

7. Requests from government authorities

We disclose personal data to a government or law-enforcement authority only when the law requires it. For every request we:

• review its legality, including whether the authority has the power to make it;
• challenge it when we consider it unlawful, unclear or overly broad, including through the courts where appropriate;
• disclose only the minimum data the request lawfully requires;
• document it: the request, our response, the legal reasoning and the people involved.

Unless the law forbids it, we tell the affected facility (and, where appropriate, the person) about the request.

8. How long we keep it

• Account data: while your account is active. When you ask us to delete your account we do so within 30 days, keeping only what the law requires or what is needed to finish a pending order, refund or complaint.
• Health records created by a facility: as long as the law requires the facility to keep them (for example at least three years for inpatient records under medical council regulations, and longer where other laws or the facility require), after which they are deleted or anonymised.
• Payment, invoice and tax records: eight years, as accounting and tax law requires.
• Security logs: 180 days, as CERT-In directions require.
• WhatsApp data of a facility that disconnects: access token deleted at once; messages and logs deleted 30 days later.
• Consultation audio used for the AI scribe: deleted automatically after 90 days.

9. Your rights

Under the DPDP Act you can:

• Access a summary of your personal data and how it is used, and the list of who it has been shared with;
• Correct, complete or update it;
• Erase it, where we no longer need to keep it by law. Use "Delete Account" in your Profile or write to us;
• Withdraw consent at any time (this stops future use and may stop the service; it does not undo lawful use before);
• Nominate someone to exercise these rights if you die or become unable to;
• Raise a grievance with our Grievance Officer, and, if you are not satisfied, complain to the Data Protection Board of India.

To use these rights, go to your Profile in the app or write to grievance@aasaanop.com. We will reply within the time the law sets.

10. How to delete your data

• Patients: in the Aasaanop app open Profile → Delete Account and confirm. Or email grievance@aasaanop.com with the subject "Delete my data" from your registered email, or write from your registered mobile number to +91 89856 82548 on WhatsApp or by SMS. We confirm the request, delete your account and personal data within 30 days, and email or message you when it is done. Records a hospital, clinic or lab must keep by law stay with that facility, and payment records are kept as tax law requires.
• To stop WhatsApp messages only: reply STOP to any message, or switch off WhatsApp messages in Profile.
• Facilities: disconnect WhatsApp under Integrations (see section 6), and ask us to close your account at support@aasaanop.com. You can export your data for 60 days before it is deleted (Facility Terms).
• Doctors, riders and companions: ask through Support in your app or at grievance@aasaanop.com.

11. Security

• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Access is limited by role: facility staff see only what their role needs, and doctors see only their own patients.
• Files are shared through short-lived signed links.
• Access is logged, backups are encrypted and restores are tested.

No system is perfectly secure. If a personal data breach happens we will inform the Data Protection Board and affected users as the DPDP Rules require, and report it to CERT-In within six hours.

12. Cookies

We use essential browser storage to keep you signed in and remember your preferences, and optional analytics only with your consent. See the Cookie Policy.

13. Changes

We will update this policy as the Platform or the law changes, and tell you in the app before significant changes.

14. Contact

Aasaanop Technologies Private Limited · 16-7-24/2, 2nd Floor, Viraraghavula Veedhi, Sharaf Bazar, Tenali, Guntur, Andhra Pradesh 522201 · CIN U86200AP2026PTC128248 · support@aasaanop.com · +91 89856 82548

Grievance Officer: [Name to be added] · grievance@aasaanop.com · +91 89856 82548 · 16-7-24/2, 2nd Floor, Viraraghavula Veedhi, Sharaf Bazar, Tenali, Guntur, Andhra Pradesh 522201