Privacy Policy

This Privacy Policy describes how Amrutahar and its authorised care partners ("we", "us", "our") collect, use, share, and protect personal data through the Amrutahar clinical platform at clinical.amrutahar.com -- the client care portal and the care-team workspace (together, the "Service").

This policy is specific to the Service. It is separate from, and covers different data than, the privacy policy published for the Amrutahar food and e-commerce store at amrutahar.com, which governs orders, shipping, and payments for physical products and does not describe how health data is handled here.

Identity and contact details: your mobile number (used to sign in via one-time password), name, date of birth, sex at birth, and other profile details you provide during intake.

Health and clinical information: your intake responses (symptoms, history, goals); lab orders and any lab reports or images you upload; biomarker values and indices derived from them; notes, assessments, and plans from your care team; consultation and appointment records; and reports we generate for you, including your Health Map.

Payment information, where applicable: for paid consultations or packages, the purpose and amount of a charge and a payment provider's reference IDs for it. Card and bank details are handled directly by our payment processor (Razorpay, where enabled) -- we do not receive or store your full card or bank account numbers.

Communications: the content and delivery status of one-time passwords, appointment and care reminders, and service messages we send to your registered mobile number by SMS or WhatsApp.

Technical and session information: the session cookies described in section 7 below, basic request metadata (such as IP address and timestamps) used for security and abuse prevention, and, if something goes wrong, limited technical error information used to diagnose and fix it.

To provide and coordinate your care: intake, scheduling, diagnostics, care-team review, and preparing and releasing clinical and nutrition outputs to you.

To communicate with you: one-time passwords for sign-in, and care-related reminders or updates by SMS or WhatsApp.

To process payments for paid consultations or packages, where applicable.

For safety, security, and audit: preventing unauthorised access, investigating misuse, and maintaining the audit trail our care-quality and compliance processes require.

For quality improvement and, only where you separately opt in, de-identified research -- see the Research Consent section presented at signup, which this policy does not modify.

We do not sell your personal data, and we do not use it for third-party advertising.

We process your information on the basis of the consent you give when you create an account and proceed past the Terms & Conditions and (for the clinical-use section) mandatory consent screens at signup, and, for research use, the separate optional consent described there.

Where permitted by applicable law, we may also process limited information without consent for purposes such as legal compliance, safety, or the establishment or defence of legal claims.

Your care team: panelists and staff involved in your care can see the clinical information needed to care for you, consistent with a shared-care-team model.

Service providers who process data on our instructions, under contractual confidentiality obligations, and only for the purposes described here -- for example: cloud database and file storage for your records and lab uploads; SMS/WhatsApp providers for OTPs and notifications; a payment processor for paid consultations, where applicable; error-monitoring tooling that helps us detect and fix problems; and, for lab report and document processing, an AI provider used under its API terms, which do not use the data submitted through the API to train its models.

We do not share your personal or health data with advertisers, or with the Amrutahar food store's systems, except where you separately interact with that store as its own customer.

We may disclose information where required by law, to protect rights, property, or safety, or as part of a business transfer, subject to this policy or a successor notice.

If you upload lab reports or images, they may be processed automatically -- including AI-assisted extraction of values -- to support your care team. Automated outputs are reviewed by qualified staff before they inform clinical decisions or are released to you, consistent with the Terms & Conditions you agreed to at signup.

The Service uses session cookies to keep you signed in and to protect your session -- there are no third-party advertising or tracking cookies.

Your sign-in cookie is set HttpOnly and Secure, so it cannot be read by page scripts and is only ever sent over an encrypted connection. A second, paired cookie supports CSRF protection (confirming that requests changing your data genuinely came from this site). Signing out, or an admin-initiated "sign out everywhere" action, invalidates these immediately rather than only clearing them locally.

We retain clinical records for as long as your care episode is active and afterward for the period required by applicable clinical record-keeping, legal, and operational requirements -- the same retention basis described in our Terms & Conditions.

Shared report links (for example, a link to your released Health Map) are time-limited and expire automatically rather than remaining valid indefinitely.

When you request deletion (section 9), we do not immediately hard-delete clinical records that a medical-record retention obligation requires us to keep. Instead your identifying details are removed or pseudonymised and your account is closed to further sign-in, while the underlying clinical record is retained for the required period as the law and clinical practice require.

The Digital Personal Data Protection Act, 2023 gives you rights over your personal data, including to access it, have it corrected, and request its erasure, subject to the retention and legal limits described above.

Access: you can download a copy of the data associated with your account from within the client portal at any time.

Correction: contact us (section 11) to correct inaccurate profile or intake information; some fields can also be updated directly in the portal.

Erasure: you can request account deletion from within the client portal. This is reviewed by our care team against the medical-record retention policy described in section 8, rather than actioned instantly, and you can cancel a pending request at any time before it is completed.

Withdrawing consent: you may withdraw consent for clinical-use processing described in our Terms & Conditions, though doing so may mean we can no longer continue your care episode; withdrawing the separate, optional research consent does not affect your clinical care and does not affect data already used in completed, aggregated research where permitted by law.

We may need to verify your identity before acting on a request, and some requests may take time to complete, particularly where a clinical record must be retained.

The Service is intended for use by adults managing their own care, or by a parent, guardian, or authorised caregiver managing care on behalf of a dependant, consistent with applicable law. If you believe a child's account has been created other than through such a caregiver, contact us using the details in section 11.

For questions about this policy, to exercise a right described above, or to raise a privacy grievance, contact us at sripuppala@amrutahar.com or at the address published in the Service footer.

We aim to acknowledge privacy requests and grievances promptly and to resolve them within the timeframe applicable law requires.

We may update this policy from time to time. When we make a material change, we will publish a new version identifier here (for example, "v2026-09") and, where required by law, notify you through the Service.

Effective version: 2026-09.

This policy covers the Amrutahar clinical platform (clinical.amrutahar.com) only. See amrutahar.com/privacy for the separate policy covering the Amrutahar food and e-commerce store.