AYKA Privacy Policy

AYKA Clyvora Private Limited, a company incorporated under the Companies Act, 2013, bearing Corporate Identification Number U62099UP2025PTC223390 and registered under the Startup India initiative vide certificate DIPP206218, having its registered office at 5/1115, Khalapar Mohalla, Memaran, Saharanpur, Uttar Pradesh — 247001, India (hereinafter referred to as "AYKA", "the Company", "we", "our", or "us") is committed to protecting the privacy and personal data of all persons who access or use its digital platforms and services.

This Privacy Policy ("Policy") constitutes a legally binding document between the Company, acting as the Data Fiduciary, and you, the Data Principal, governing the collection, storage, use, processing, disclosure, and protection of your Personal Data in connection with your use of the following platforms operated by AYKA Clyvora Private Limited:

• AYKA Life — a cloud-based clinic management Software-as-a-Service platform designed for clinics, hospitals, and healthcare institutions, offering appointment scheduling, electronic medical records (EMR), billing, patient communication, and franchise operations management;
• AYKA Expert — a telemedicine Software-as-a-Service subscription platform for registered medical practitioners to conduct online consultations, manage patient records, and issue digital prescriptions;
• AYKA Care — a patient-facing teleconsultation platform enabling individuals to book medical appointments, consult registered doctors through digital channels, access personal health records, and manage their healthcare journey; and
• AYKA Alliance — a three-tier franchise network (City, District, and State levels) enabling business partners to distribute, market, and support AYKA products within their respective geographies.

(Each of the above, individually and collectively, referred to as the "Platform(s)" or "Services".)

This Policy is published in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Information Technology Act, 2000 ("IT Act"), and all other applicable laws and regulations of India.

This Policy applies to:

• all users of the AYKA Life, AYKA Expert, AYKA Care, and AYKA Alliance platforms, including but not limited to registered medical practitioners, clinics, hospitals, patients, franchise partners, and visitors to our websites;
• all Personal Data and Sensitive Personal Data collected through our websites, mobile applications, application programming interfaces (APIs), and any other digital touchpoints operated by the Company;
• all processing activities carried out by AYKA Clyvora Private Limited whether as a Data Fiduciary (when processing data for its own purposes) or as a Data Processor (when processing data on behalf of its business clients such as clinics and hospitals); and
• data collected from third-party integrations including payment gateways, the Ayushman Bharat Digital Mission (ABDM) ecosystem, DigiLocker, MeriPehchaan, and third-party analytics and communication service providers.

This Policy does not apply to the practices of third-party websites, applications, or services that may be linked to or from our Platforms. We encourage you to review the privacy policies of any third-party services you access through our Platforms.

In this Policy, unless the context otherwise requires, the following terms shall have the meanings ascribed to them below, which are aligned with the definitions provided under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000:

We collect the following categories of Personal Data, depending on the Platform you access and your role as a user:

We collect and process your Personal Data solely for the following specified, clear, and lawful purposes:

• Account Registration and Authentication: to create, verify, and maintain your user account on the Platform, including identity verification and credential management;
• Provision of Services: to deliver the healthcare, telemedicine, clinic management, or franchise services you have subscribed to or requested, including facilitating online consultations, generating prescriptions, managing appointments, and processing transactions;
• Health Record Management: to create, store, retrieve, and share your health records and consultation history in accordance with your instructions and applicable telemedicine regulations;
• Payment Processing and Financial Administration: to process subscription fees, consultation charges, franchise commissions, and payouts, and to generate GST-compliant invoices;
• Communication and Notifications: to send you appointment reminders, prescription confirmations, service updates, billing notifications, and other transactional communications essential to your use of the Platform;
• Customer Support and Grievance Redressal: to respond to your queries, complaints, and grievances in accordance with applicable law;
• Platform Improvement and Research: to analyse aggregated and anonymised usage data for the purpose of improving our Platforms, features, and user experience;
• Safety, Security, and Fraud Prevention: to detect, investigate, and prevent fraudulent transactions, unauthorised access, and other illegal or prohibited activities;
• Legal and Regulatory Compliance: to comply with applicable laws, court orders, regulatory directions, or enforceable governmental requests including under the IT Act, DPDP Act, and healthcare regulations;
• ABDM Compliance: to enable sharing of health records through the ABDM ecosystem with your explicit consent, in accordance with the Health Data Management Policy of the National Health Authority;
• Marketing and Promotional Communications: to send you information about new features, products, or offers where you have provided consent or where such communication is permitted under applicable law. You may opt out at any time; and
• AI and Algorithm Improvement: to use anonymised and pseudonymised data for training, testing, and improving our artificial intelligence and machine learning features, subject to your consent and the provisions of our AI Usage and Disclaimer Policy.

We process your Personal Data on the following legal bases, as provided under the Digital Personal Data Protection Act, 2023:

Health Data and other Sensitive Personal Data or Information collected through our Platforms receive the highest level of protection under this Policy and applicable law.

We undertake the following obligations in relation to Health Data:

• Explicit Consent: We collect Health Data only with your explicit, informed, and written consent, obtained through a clear and specific consent mechanism at the time of or prior to collection. Consent for Health Data is separate from general registration consent.
• Purpose Limitation: Health Data is used exclusively for the purpose for which consent was obtained — primarily, to facilitate your telemedicine consultation, enable access to your health records, and support the clinical functions of the AYKA Expert and AYKA Care platforms. Health Data will not be used for commercial purposes, advertising, or profiling without your explicit additional consent.
• Restricted Disclosure: We will not transfer or disclose your Health Data to any third party except: (a) to the consulting doctor with whom you have scheduled a consultation; (b) to our authorised data processors (such as cloud infrastructure providers) who are contractually obligated to maintain equivalent standards of data protection; (c) to government authorities or healthcare regulators where required by law; or (d) in a genuine medical emergency where disclosure is necessary to protect your life or health.
• ABDM Integration: If you choose to link your ABHA ID and participate in the ABDM health records ecosystem, your health records will be shared only in accordance with your consent artefact issued through the ABDM consent manager. You may modify or revoke such consent through the ABDM consent manager at any time.
• Security Measures: We implement technical and organisational security measures appropriate to the sensitivity of Health Data, including encryption at rest and in transit, role-based access controls, and audit logging. See Section 15 for details.
• Retention: Health Data is retained for the period specified in Section 10 of this Policy, consistent with the record-keeping requirements of the Telemedicine Practice Guidelines, 2020.

We do not sell, rent, or trade your Personal Data to any third party. We share Personal Data only in the following circumstances and with the following categories of recipients:

AYKA Clyvora Private Limited stores and processes all Personal Data, and in particular all Health Data and Sensitive Personal Data, on servers and infrastructure located within the territory of India, in compliance with applicable data localisation requirements.

To the extent that any cross-border transfer of Personal Data becomes necessary for operational reasons (such as the use of a foreign-headquartered cloud service provider or analytics tool), such transfer shall be undertaken only to countries notified by the Central Government of India as permissible destinations for the transfer of Personal Data under the DPDP Act, 2023, and subject to appropriate contractual safeguards including standard contractual clauses or equivalent data protection agreements.

We retain Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law, whichever is longer. The following retention periods apply:

• Account and Registration Data: retained for the duration of your active account and for a period of three (3) years following account deletion or deactivation, to address any post-termination queries, disputes, or legal claims;
• Health Data and Consultation Records: retained for a minimum period of seven (7) years from the date of the consultation or last interaction, consistent with the record-keeping obligations under the Telemedicine Practice Guidelines, 2020 and applicable medical records law;
• Financial Transaction Data: retained for a period of eight (8) years from the date of transaction, in compliance with the requirements of the Income Tax Act, 1961 and GST law;
• Communication Logs and Customer Support Records: retained for a period of two (2) years from the date of the communication or resolution of the support ticket;
• Usage and Analytics Data: retained in anonymised form for a period of up to five (5) years for platform improvement and statistical purposes; and
• Legal Hold: where Personal Data is subject to an ongoing legal proceeding, regulatory investigation, or dispute, we may retain relevant data beyond the above periods until the matter is resolved.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction. You may request deletion of your Personal Data at any time in accordance with Section 12.3 (Right to Erasure), subject to any overriding legal retention obligations.

Our Platforms are designed for use by adults. We do not knowingly collect Personal Data from children (individuals below the age of eighteen (18) years) without verifiable parental or guardian consent.

Where a parent or legal guardian seeks to register a child as a patient on AYKA Care or to obtain teleconsultation services on behalf of a child, the following requirements apply:

• The parent or guardian must create and maintain the account; the child may not independently create or hold an account;
• The parent or guardian must provide verifiable consent for the collection and processing of the child's Personal Data and Health Data at the time of registration;
• Health Data relating to the child will be associated with the parent or guardian's account and will not be processed for any purpose beyond provision of the requested healthcare services; and
• The parent or guardian may, at any time, withdraw consent for the processing of the child's data, access the child's records, or request deletion of the child's data, by contacting our Grievance Officer.

We have implemented age verification measures at the time of registration. If we discover that we have inadvertently collected Personal Data from a child without verifiable parental consent, we will take immediate steps to delete such data. If you believe we may have collected data from a child without appropriate consent, please contact us immediately at the details provided in Section 19.

Under the Digital Personal Data Protection Act, 2023, you, as a Data Principal, have the following rights in relation to your Personal Data processed by us:

To exercise any of the rights set out in Section 12, or to ask questions or raise concerns about our data processing practices, you may contact our Grievance Officer using the details provided in Section 17. Your request should include:

• your full name and registered email address or mobile number;
• the specific right you wish to exercise and the Personal Data to which your request relates; and
• any supporting information or documentation relevant to your request.

We will acknowledge your request within forty-eight (48) hours and will endeavour to respond substantively within thirty (30) days of receipt. Where additional time is required due to the complexity of the request, we will notify you of the reason for delay and the expected resolution timeline.

We may request additional information to verify your identity before processing requests relating to Personal Data, to ensure the security and privacy of our users.

Our websites and Platforms use cookies, web beacons, pixel tags, and similar tracking technologies to enhance user experience, analyse platform usage, and deliver relevant communications.

We use the following categories of cookies:

• Strictly Necessary Cookies: essential for the basic functioning of our Platforms, including authentication, session management, and security. These cannot be disabled without affecting your ability to use core features.
• Functional / Preference Cookies: used to remember your preferences, language settings, and personalisation choices to improve your experience.
• Analytics and Performance Cookies: used to collect anonymised information about how users interact with our Platforms, enabling us to improve performance and user experience. These include tools such as Google Analytics operating under data processing agreements.
• Marketing and Targeting Cookies: used only with your explicit consent to deliver targeted communications and measure the effectiveness of our marketing campaigns. These include third-party tools such as the Meta Pixel and Google Ads tags.

You can manage your cookie preferences through your browser settings or through the cookie consent banner displayed on our websites. Please refer to our Cookie Policy for a complete list of cookies used, their duration, and instructions for managing preferences.

We implement robust technical and organisational security measures to protect your Personal Data from unauthorised access, accidental loss, alteration, or destruction. Our security framework includes:

Notwithstanding the foregoing, no method of electronic transmission or storage is one hundred percent secure. We cannot guarantee the absolute security of your Personal Data and encourage you to exercise caution when transmitting sensitive information online. You are responsible for maintaining the confidentiality of your account credentials.

In the event of a Personal Data Breach, we will follow the procedure set out below in compliance with Section 8(6) of the DPDP Act, 2023 and the directions of the Data Protection Board:

• Detection and Containment: upon detection of a breach, our security team will immediately initiate containment measures to limit the scope and impact of the breach;
• Assessment: we will assess the nature, scope, and likely consequences of the breach, including the categories and approximate number of Data Principals affected;
• Notification to Data Protection Board: we will notify the Data Protection Board of India of the breach in the form, manner, and within the timeframe prescribed by the Board, providing details of the nature of the breach, the Personal Data affected, and the remedial measures taken or proposed;
• Notification to Affected Data Principals: we will notify each affected Data Principal of the breach in clear and plain language, including the nature of the data compromised, the likely impact, and the steps we are taking to address the breach and protect affected individuals; and
• Remediation: we will implement remedial measures to address the vulnerabilities that gave rise to the breach and to prevent recurrence.

We maintain an incident response plan and conduct regular breach simulation exercises to ensure preparedness. All breach notifications to Data Principals will be delivered through the contact details registered with the Platform.

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Rule 5 of the SPDI Rules, 2011, we have designated a Grievance Officer to receive and resolve grievances from Data Principals regarding the processing of their Personal Data.

We will acknowledge your grievance within forty-eight (48) hours of receipt and will aim to resolve it within thirty (30) days. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India at www.dpb.gov.in.

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our business practices, technology, legal requirements, or regulatory developments.

In the event of a material change to this Policy — including any change that affects the purposes for which Personal Data is processed, the categories of data collected, or the rights of Data Principals — we will provide you with at least thirty (30) days' prior notice through one or more of the following channels:

• a prominent notice on our Platform or website;
• an email notification to the address registered with your account; or
• an in-app notification.

Your continued use of our Platforms following the effective date of the revised Policy shall constitute your acceptance of the updated terms. If you do not agree to the revised Policy, you must discontinue use of our Platforms and may request deletion of your account and Personal Data.

We recommend that you review this Policy periodically to stay informed of how we protect your information. The version history and effective date of each version are maintained at the footer of this Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact us at:

This Privacy Policy is published by AYKA Clyvora Private Limited in compliance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and all other applicable laws of India.