Privacy Policy

1. Introduction, Engagement Entity, and Scope

1.1 Overview

This Privacy Policy (“Policy”) governs the collection, storage, processing, transfer, and erasure of personal data and sensitive personal data by Vaulth AI. Vaulth AI is a proprietary product brand owned and operated by Nirmoha Private Limited, a company incorporated under the laws of India, with Corporate Identification Number (CIN) U72900TG2016PTC109338 and having its registered office at Flat# 512, Raaganjali Apartments, Upparpally, Hyderabad, Telangana, India, 500048 (hereinafter referred to as the “Company”, “Vaulth AI”, “we”, “us”, or “our”).

1.2 Core Product Nature & Non-Diagnostic Boundary

Vaulth AI operates strictly as a consumer and family Personal Health Record (PHR) and data custody layer. The platform allows users to store, organize, trend, and securely share their own and their family members’ medical data on a time-bound basis, utilizing artificial intelligence (AI) to assist in the comprehension of such data.

CRITICAL REGULATORY BOUNDARY: Vaulth AI is not a diagnostic tool, not a telemedicine platform, and not a clinical establishment. We do not provide medical treatment, clinical prescriptions, or formal medical advice. The platform does not function as a data broker: we do not sell, trade, rent, or lease health data, nor do we utilize health data for advertising targeting. The AI engine is strictly informational, does not diagnose clinical conditions, and explicitly defers to licensed medical professionals in all instances.

1.3 Regulatory Alignment and Non-Certification Discipline

• DPDP Act 2023 & DPDP Rules 2025: This Policy is drafted to comply with the itemized notice requirements of Section 6 and Section 8 of the Digital Personal Data Protection (DPDP) Act, 2023, read alongside the DPDP Rules, 2025 (notified November 13, 2025). The Company operates primarily as a Data Fiduciary under the Act.
• Voluntary Global Alignment (HIPAA & SPDI): Vaulth AI is an India-first consumer PHR. It is structurally established to be DPDP-aligned and HIPAA-aligned. The Company explicitly states that it is not formally certified by any third-party agency under HIPAA, nor does it claim compliance as an immutable completed fact. Alignment with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security standards is maintained voluntarily as an operational best-practice framework for data custody. To the extent applicable during transitional phases, this platform also operates in alignment with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

2. Personal Data Inventory & Categorization

We process several categories of personal data, the vast majority of which constitutes highly sensitive health data. This data is collected directly from you, generated by your use of the platform, or ingested via authorized third-party integrations.

3. Purposes of Processing and Lawful Basis

Vaulth AI processes your personal data strictly under valid lawful bases as prescribed by the DPDP Act, 2023.

3.1 Lawful Basis: Explicit, Informed Consent

Except where specified otherwise, the primary lawful basis for processing personal data is your explicit, revocable, specific, and informed consent. Consent is sought via standalone, clear consent notices prior to data processing and is never buried within our broader Terms & Conditions.

3.2 Specified Purposes

We process personal data exclusively for the following technical and functional purposes:

1. Providing, maintaining, and optimizing the Personal Health Record (PHR) custody layer.
2. Executing Optical Character Recognition (OCR) and processing text summaries via internal self-hosted containers and specialized sub-processors to make your documents searchable and readable.
3. Generating non-diagnostic AI insights, cross-referencing potential drug-to-drug interactions, and formatting lab trend readouts.
4. Facilitating user-initiated, time-bound sharing mechanics to designated medical professionals and family members.
5. Compiling and serving the public-facing In Case of Emergency (ICE) dashboard upon explicit toggle activation by the user.
6. Fulfilling statutory audit logging requirements and security monitoring under Indian law.

4. Children’s and Dependents’ Data (High-Risk Protocols)

The processing of minors’ (individuals under the age of 18) and disabled persons’ health data is an intentional, core capability of the Vaulth AI platform. Due to the high sensitivity of this workflow and the statutory liabilities under Section 9 of the DPDP Act, 2023 (carrying non-compliance risks up to ₹200 crore), the following frameworks apply:

4.1 Age Limits & Account Hierarchy

• Independent Accounts: The absolute minimum age to open an independent account on Vaulth AI is 18 years. Minors are strictly prohibited from maintaining standalone, unlinked accounts.
• Dependent Profiles: Minors may only exist on the platform as subordinate profiles nested within the primary account of a parent or verified lawful guardian.

4.2 Verifiable Parental Consent (VPC)

Before any data relating to a minor can be uploaded, synchronized, or processed within a Family Circle, the primary account holder must execute our mandatory Verifiable Parental Consent Flow. This mechanism requires the parent/guardian to:

1. Formally declare legal guardianship.
2. Complete an out-of-band verification step (such as Aadhaar-based e-KYC or mobile OTP verification linked to a declared parent identity).
3. Explicitly consent to the itemized data collection checklist for that minor.

4.3 Behavioral Monitoring and Exemption Stance

• Absolute Restrictions: In strict adherence to Section 9(4) of the DPDP Act, Vaulth AI prohibits any form of behavioral tracking, targeted advertising, profiling, or monitoring directed at minor profiles within our system.
• Healthcare Services Exemption Analysis: While the DPDP Rules, 2025 outline certain exceptions for “essential services such as healthcare” regarding rigid parental consent steps, Vaulth AI does not explicitly rely on this exemption for its primary flows. Because Vaulth AI is an informational custody layer rather than a direct clinical emergency provider, we enforce strict Verifiable Parental Consent as our baseline rather than assuming an exempt healthcare status.

5. Feature-Specific Legal Disclosures

5.1 ICE Emergency Card (Public, Unauthenticated Access)

The ICE feature allows users to generate a public QR code and an unauthenticated URL (/ice/[token]) to display critical medical data during emergencies.

• Informed Risk Acceptance: By activating this feature, you acknowledge and agree that this specific set of health data will become completely public and unauthenticated. Anyone who scans the physical QR code or obtains the specific web link will gain access to the data without logging in.
• What the Card Shows: Your name, date of birth and gender always appear on the public card. Every other detail — blood group, allergies, medicines, implants, organ-donor status and emergency contacts — appears only if you choose to include it, and you can change that choice at any time.
• Third-Party Contact Data: When listing emergency contacts, you represent and warrant that you have obtained the lawful consent of those third parties to display their names and phone numbers on your public ICE page.
• Revocation: You retain the right to instantly deactivate the ICE link within your dashboard, which invalidates the active token and blocks further public access.

5.2 Caregiver Delegation

Users may delegate read/write administrative controls over their profile (or a dependent’s profile) to an external caregiver.

• The Consent Chain: The primary account holder explicitly authorizes the delegation, defining the scope (e.g., medication management only) and an expiration date.
• Caregiver Acceptance: The invited caregiver must accept our standalone Caregiver Terms before access is provisioned. The delegation and every change to it — the invitation, its acceptance, changes to permissions, and revocation — are recorded in our audit log, whose records cannot be deleted.

5.3 Family Circles & Dependent Migration

• Data Scoping: Family members within a circle retain separate authorization permissions. You can only view or manage data for which clear, system-validated permissions have been granted.
• Migration Protocol: When a minor dependent turns 18, or when an adult dependent wishes to claim independent custody of their record, Vaulth AI supports a Dependent Migration Flow. Upon validation of the identity of the migrating individual, their complete historical medical record is detached from the original custodian’s account and transferred to their new independent account. The original custodian’s access is automatically terminated unless explicitly re-authorized by the migrated individual.

5.4 Doctor Profiles (Third-Party PII)

Users routinely input their treating physicians’ professional information into the platform.

Lawful Basis for Processing: The processing of this third-party personal data (Doctor PII) is executed under the lawful basis of the primary user’s legitimate use for organizing their personal health records, or under the structural framework where the user acts as the primary instigator of the data record. Vaulth AI does not use this doctor data for external marketing or public directory compilation without the explicit consent of the respective healthcare professional.

6. Sub-Processors and Third-Party Data Flows

To deliver our services, data is shared with the following third-party sub-processors. We maintain strictly audited Data Processing Agreements (DPAs) with each entity ensuring identical or superior data protection standards.

7. Data Retention, Erasure, and Breach Response Protocols

7.1 Retention Schedule By Data Category

Data is kept only as long as necessary to fulfil the purposes defined in Section 3 or to satisfy statutory obligations under Indian law, as set out below.

• Active Account Data: All categories of medical records, vitals, journals, and AI insights are retained for the active lifecycle of your account.
• System Audit and Processing Logs: Kept for at least 1 year, as the DPDP Rules, 2025 require. We do not currently delete them after that period: they are held under restricted access, and our database does not allow them to be deleted. We will update this section when a retention limit is in place.
• Documents Being Scanned: Documents passing through our own scanning service are processed in an isolated environment, and nothing from that step is kept once the result is saved to your record.
• Device Push Tokens: Deleted when you sign out, when the push service reports them invalid, or when you delete your account.

7.2 Account Deletion and Consent Withdrawal

• Self-Serve Purging: Users can trigger full account deletion directly within the dashboard settings.
• Erasure Execution Windows: Upon account closure or formal withdrawal of consent, Vaulth AI initiates a systematic deletion protocol across all production databases, object storage buckets (GCS), and analytical pipelines. Complete purging from active systems occurs within 48 hours.
• Backup Copies: Copies of deleted data that remain in backups — earlier versions of stored files, and database backups — are permanently deleted within 30 days.

7.3 Statutory Breach Notification Mandates

In the event of a confirmed or suspected data breach affecting personal or sensitive health data:

• To the Board: Vaulth AI will submit a comprehensive, formal incident report to the Data Protection Board of India (DPBI) within 72 hours of detecting the anomaly.
• To the Affected Users: The Company will notify all impacted data subjects without undue delay, outlining the nature of the breach, the specific data categories exposed, immediate remediation steps taken, and contact details for our Data Protection Officer.
• Readiness Stance: Our technical teams operate a continuous breach-detection internal protocol to bridge systemic monitoring gaps prior to official service launch.

8. Technical and Organisational Security Measures

Vaulth AI enforces strict, multi-layered security safeguards to ensure the integrity, confidentiality, and availability of your health records:

• Signing In & Sessions: Passwords are stored only as a slow, salted hash — never in plain text. Sessions are held in secure cookies that scripts on a web page cannot read. Logging out, or changing your password, ends every session on every device immediately.
• Protection Against Abuse: Limits on sign-in attempts and other sensitive actions; browser security protections on every response; strict checking of everything sent to our servers; and requests from other websites are refused unless we explicitly allow them.
• Encryption: Everything sent between your device and Vaulth AI is encrypted (TLS), and stored data is encrypted at rest by our cloud provider. Third-party connection tokens (Google Fit and Sign in with Apple) and cloud infrastructure keys are additionally encrypted at the application layer using AES-256.
• Isolated Document Processing: Text is extracted from your documents by our own scanning service, which runs in an isolated environment with no access to the internet. Every file is checked to be the type it claims to be before it is read.
• Access Governance: Whenever anyone other than you reads or changes your data, we check — on that request — who owns the record, family-circle membership, and exactly what a caregiver has been granted.
• Emergency Link: The public ICE emergency link is long and randomly generated so it cannot be guessed. It is rate-limited, every view is logged, and you can revoke it instantly.

9. User Rights and Transparency

Under the DPDP Act, 2023, you possess comprehensive rights over your personal data, which Vaulth AI operationalizes transparently:

• Right to Access and Summary: You have the right to receive a concise summary of all personal data being processed, the processing activities performed, and a list of all sub-processors with whom your data has been shared.
• Visibility of Access: For each share link, you can see how many times it has been opened and when it was last opened. You can see each time your emergency card was viewed. A record of your own account activity is included when you export your data from Settings.
• Right to Correction, Completion, and Erasure: You can update inaccurate records, complete partial fields, or request complete erasure of your files at any time.
• Right to Grievance Redressal: You have the right to file a formal complaint regarding any perceived data processing violation directly with our designated officer, as detailed below.

10. Governing Law, Jurisdiction, and Significant Data Fiduciary (SDF) Assessment

10.1 Governing Law

This Privacy Policy, the relationship between you and the Company, and all data processing workflows executed within the platform are governed exclusively by the laws of the Republic of India, specifically the Digital Personal Data Protection Act, 2023, its accompanying rules, and applicable provisions of the Information Technology Act, 2000.

10.2 Seat of Jurisdiction

Any dispute, controversy, or claim arising out of, or relating to this Privacy Policy—including its formation, interpretation, or breach—shall be subject to the exclusive jurisdiction of the competent civil courts located in Hyderabad, Telangana, India.

10.3 Significant Data Fiduciary (SDF) Corporate Stance

Under Section 10 of the DPDP Act, the Government of India may notify certain entities as Significant Data Fiduciaries based on factors like data volume and sensitivity.

• Current Assessment: Given our specialized operational scale at launch, Vaulth AI does not automatically trigger the statutory baseline criteria of an SDF.
• Future Readiness Stance: However, recognizing that digital health platforms are continuously flagged in regulatory commentary as likely candidates for designation, Vaulth AI maintains an active readiness architecture. If the Company is formally notified as an SDF, we are prepared to immediately activate our secondary compliance framework, which includes conducting an annual Data Protection Impact Assessment (DPIA), appointing an independent external data auditor, and formalizing additional reporting tracks.

11. Data Protection Officer (DPO) & Grievance Redressal

In compliance with the mandatory provisions of the DPDP Act, 2023, the Company has appointed a dedicated Grievance Officer / Data Protection Officer to oversee all data governance workflows and address user issues.

If you have any questions, wish to exercise your statutory data rights, or want to file a formal complaint regarding data handling, please contact our officer directly:

• Attention: Data Protection Officer / Grievance Officer
• Name of Appointed Officer: Rishi Krishna Ginikunta
• Contact Email: rishi@vaulthai.health
• Corporate Office Address: Flat# 512, Raaganjali Apartments, Upparpally, Hyderabad, Telangana, India, 500048

We are committed to acknowledging your grievance within 24 hours and resolving valid data protection complaints within the statutory timelines prescribed under the DPDP Rules, 2025. If you remain unsatisfied with our internal resolution, you retain the statutory right to escalate your complaint directly to the Data Protection Board of India (DPBI).