Terms and Conditions of Use

1. The Contractual Relationship, Entity Deployment, and Definitions

1.1 Binding Corporate Contract

These Terms and Conditions of Use (“Terms” or “Agreement”) constitute a legally binding, enforceable contract executed between you (whether acting individually as an end-user, or collectively as a parent, verified legal guardian, or authorized caregiver) and Nirmoha Private Limited, the corporate owner and proprietary operator of the “Vaulth AI” brand. The Company is duly incorporated under the provisions of the Companies Act, 2013, bearing Corporate Identification Number (CIN) U72900TG2016PTC109338, with its principal place of business and registered corporate office situated at Flat# 512, Raaganjali Apartments, Upparpally, Hyderabad, Telangana, India, 500048 (hereinafter referred interchangeably to as the “Company”, “Vaulth AI”, “we”, “us”, or “our”).

1.2 Scope of the Service Surface

This Agreement comprehensively governs your access to, interaction with, and technical utilization of the Vaulth AI software architecture. This includes, without limitation, our personal health record (PHR) custody layer, biometric tracking panels, subjective health diaries, Optical Character Recognition (OCR) processing pipelines, automated text summary models, data sharing modules, and the emergency unauthenticated QR code deployment surfaces (collectively referred to as the “Platform” or the “Services”).

1.3 Strict Launch-Blocking Integration

• Prerequisite for Platform Entry: These Terms are absolute launch-blocking parameters. Account creation, data upload, or API synchronization cannot occur without your explicit affirmation and click-wrap acceptance of this Agreement.
• Interlocking Corporate Policies: Your acceptance of these Terms explicitly incorporates the accompanying Vaulth AI Privacy Policy and any standalone product-enforced terms (such as Caregiver Terms or Dependent Migration Protocols).
• Express Refusal: If you do not agree to be contractually bound by each and every provision contained herein, you must immediately cease all access, exit the interface, and refrain from utilizing any Platform workflows.

2. The Compliance & Regulatory Boundary (The “Not” Posture)

2.1 Medical, Diagnostic, and Telemedicine Disclaimers

The architectural posture of Vaulth AI is built strictly around data custody and information comprehension. You explicitly acknowledge and agree to the following structural boundaries, which serve as the Company’s primary regulatory defense:

• Not a Clinical Establishment: Vaulth AI is not a diagnostic tool, not a provider of telemedicine, and not a clinical establishment as defined under the Clinical Establishments (Registration and Regulation) Act, 2010 or any regional state healthcare enactments.
• No Medical Practice: The Company does not practice medicine, render clinical judgements, provide professional medical treatments, formulate clinical prescriptions, or distribute formal medical advice.
• Informational Nature of Artificial Intelligence: The Platform leverages advanced large language models and inference engines (specifically utilizing enterprise implementations of Google Vertex AI Gemini 2.5 Flash) to parse medical images, extract text values from lab reports, and map pharmaceutical reference data. You explicitly agree that all AI-generated text narratives, biometric risk correlations, clinical tracking insights, and drug-to-drug interaction alerts are provided strictly for educational and informational comprehension purposes.
• Absolute Professional Deference: The Platform’s features do not constitute Software as a Medical Device (SaMD) under the Central Drugs Standard Control Organization (CDSCO) Medical Device Rules, 2017. The AI engine does not diagnose clinical conditions and explicitly defers to licensed human professionals. You represent and warrant that you will always consult a licensed medical professional for clinical interpretation, diagnosis, or treatment adjustments. You shall never disregard, override, or delay seeking professional clinical care due to any metrics, insights, or alerts displayed on the Platform.

2.2 Voluntary International Alignment Frameworks

• DPDP and HIPAA Discipline: The Platform is engineered and maintained strictly to be DPDP-aligned and HIPAA-aligned, not certified. No provision of these Terms or the accompanying Privacy Policy shall be construed as a claim of formal external compliance certification by the United States Department of Health and Human Services (HHS) or the Data Protection Board of India (DPBI).
• Operational Progress Stance: The Company voluntarily references the privacy and security administrative controls of the Health Insurance Portability and Accountability Act (HIPAA) as an operational benchmark for digital health record custody. Data compliance is approached as an active, evolving engineering practice rather than a static, completed fact.
• SPDI Transitional Stance: To the extent applicable during transitional phases, the Platform complies with the technical frameworks of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) pending the final phase-in of all DPDP Act obligations.

3. User Eligibility, Registration, and Account Security

3.1 Age Thresholds for Standalone Access

To create an independent, standalone user account on the Platform, you must have attained the age of majority under Indian law, which is 18 years of age. Minors (individuals under 18) are completely barred from establishing unlinked, independent, or direct accounts on the Platform. Any account registered by an individual under 18 that is not nested within an adult custodian account constitutes a material breach of this contract and will be terminated immediately upon detection.

3.2 Technical Security and Credential Safeguards

• Cryptographic Hardening: Your account access is protected by industry-standard technical controls, including JSON Web Token (JWT) authentication, HttpOnly secure cookies, and 12-round bcrypt password hashing.
• User Accountability: You assume sole responsibility for maintaining the strict confidentiality of your account credentials, login tokens, and active sessions. You are entirely liable for all activities, data uploads, and permission grants executed through your account.
• Compromise Reporting: You must immediately notify our Data Protection Officer / Grievance Officer in writing if you suspect or detect unauthorized use of your credentials, session token leaks, or any other breach of account security.

4. Multi-Profile Operations: Family Circles & Minors (Rank 1 Risk Flag)

4.1 Structural Custody Hierarchy

The Platform includes advanced multi-profile capabilities enabling a primary adult user to establish a “Family Circle” and generate nested profile vaults for dependents, explicitly including minor children and elderly family members. Minors may only exist within the Platform database ecosystem as subordinate dependent profiles structurally bound to, and controlled by, the primary adult account holder.

4.2 Verifiable Parental Consent (VPC) Obligations

In strict compliance with Section 9 of the Digital Personal Data Protection (DPDP) Act, 2023, the processing of a minor’s health data triggers severe regulatory liabilities, with statutory penalties running up to ₹200 crore for processing violations. Accordingly, the following contractual mandates apply:

• Mandatory Flow Completion: Before populating, synchronizing, or viewing any personal or health data relating to a minor, the primary user must successfully complete Vaulth AI’s mandatory Verifiable Parental Consent Flow.
• Guardian Warranties: By creating a minor dependent profile, you explicitly covenant, represent, and warrant under penalty of law that you are the biological parent or the legally recognized, court-appointed lawful guardian of that minor. You warrant that you possess the absolute, unencumbered legal authority to authorize the collection, OCR parsing, AI analysis, and custody of that minor’s sensitive health information.
• Anti-Tracking and Behavioral Profiling Prohibitions: In accordance with Section 9(4) of the DPDP Act, Vaulth AI strictly isolates minor profiles within the backend database. The Company contractually guarantees that it will never engage in behavioral tracking, commercial profiling, targeted advertising, or market monitoring directed at minor profiles inside our system.
• Exemption Disclaimer: Vaulth AI does not rely on the statutory “healthcare services exemption” for children’s data under the DPDP Rules, 2025. Because we operate an informational custody layer rather than providing direct emergency clinical treatment, the execution of Verifiable Parental Consent remains a strict, non-negotiable prerequisite for all minor profiles.

4.3 Dependent Migration Protocol

When a minor dependent profile reaches 18 years of age, or when an adult dependent profile wishes to assume exclusive autonomous control over their personal health record, they may initiate the Platform’s Dependent Migration Flow.

• Complete Record Detachment: Upon formal identity verification of the migrating individual, their historical medical records, vitals logs, lab trends, and document folders are permanently detached from the original primary user’s account and transferred to a newly established independent account.
• Access Revocation: The primary user’s historical administrative permissions, viewing rights, and custody controls over that migrated data are instantly terminated by the system. Further access to that record can only be re-established if the migrating individual explicitly provisions a new, time-bound caregiver or family circle permission token.

5. Scoped Care-Deliverer Delegation Mechanisms

5.1 Caregiver Permissive Architecture

The Platform features a caregiver delegation layer allowing a primary user or legal custodian to grant scoped, time-limited administrative and viewing controls over their personal records or a dependent’s profile to an external third party (a “Caregiver”). These permissions are highly granular and allow users to toggle specific rights for reading/writing vitals, managing medication logs, and tracking appointments.

5.2 Caregiver Contractual Covenants

No caregiver invitation link shall become active, and no data access shall be provisioned, until the invited Caregiver registers an authenticated profile and accepts these Terms alongside our standalone Caregiver Terms. Caregivers contractually agree to the following:

• Purpose Limitation: They shall access and interact with the delegated health records strictly within the precise parameters and read/write scopes set by the primary custodian.
• Confidentiality: They are bound by absolute confidentiality and shall not download, screenshot, extract, or share the health data of the delegating party outside the Platform environment.
• Automated Expiration: Their access rights to the delegated vault will automatically terminate the moment the system clock matches the expiration timestamp set during the initial invitation flow. The entire authorization trail and access history are logged immutably within the user-visible audit log.

6. Unauthenticated Public Surfaces: The ICE Emergency Card

6.1 Unauthenticated Page Disclosure

The Platform provides an “In Case of Emergency” (ICE) medical card feature. When activated, this feature generates a physical QR code and a unique, unauthenticated public URL (/ice/[token]) designed to display critical, life-saving medical data (such as blood type, organ donor status, severe allergies, active medications, surgical implants, urgent medical conditions, and designated emergency contacts) to first responders.

6.2 Total Assumption of Risk and Liability Allocation

• Voluntary Data Exposure: BY ACTIVATING THE ICE CARD FEATURE AND TOGGLING THE STATUS TO “ACTIVE”, YOU EXPLICITLY ACKNOWLEDGE AND AGREE THAT THIS SPECIFIC SEGMENT OF YOUR HEALTH DATA WILL BECOME COMPLETELY PUBLIC AND UNAUTHENTICATED. Anyone who scans your physical QR code, obtains the specific web link, or intercepts the unique 64-character hexadecimal token will be granted immediate access to view the displayed health records without a login barrier.
• Third-Party Contact Indemnification: The ICE profile requires you to submit the names and active telephone numbers of your designated emergency contacts. You contractually represent and warrant that you have obtained the explicit, informed, and lawful consent of these third parties to publish their names and telephone numbers on an unauthenticated public page. You agree to fully indemnify, defend, and hold the Company, its directors, and its affiliates harmless against any civil claims, statutory complaints, or regulatory enforcement actions brought by your listed emergency contacts for the unauthorized public disclosure of their personal identifiable information (PII).
• System Safeguards: Vaulth AI protects the ICE public endpoint using a cryptographically random 64-character hex token, aggressive per-IP rate-limiting, and comprehensive access logs. However, the user assumes all liability for the misappropriation, sharing, or secondary exploitation of a live ICE link. Access can be instantly revoked and deactivated at any time within the Platform’s dashboard settings.

7. Third-Party Data Ingestion and API Rules

7.1 Meta / WhatsApp Business API Intake

Users may forward physical prescriptions, clinical scan reports, and lab results via the Platform’s integrated WhatsApp Business API link.

• Acceptance of Transiting Risks: By utilizing this ingestion method, you acknowledge that your personal health information (PHI) transits Meta’s API infrastructure and is subject to the standard corporate and business communication terms enforced by Meta.
• Document Integrity: You represent that you will only forward authentic, unaltered medical files belonging strictly to yourself or individuals for whom you hold verified legal guardianship.

7.2 Health App Integration (Apple Health, Health Connect, Google Fit)

• On-Device Stores: Apple Health (iPhone) and Health Connect (Android) are read on your device by the Vaulth AI app, only after you connect them and only for the data types you grant. Vaulth AI does not write to either store.
• OAuth Safeguards: Google Fit synchronization requires your explicit authorization through Google’s sign-in (OAuth); the resulting tokens are stored encrypted at rest.
• Adherence to Platform Rules: Vaulth AI strictly complies with third-party API developer terms (including Apple HealthKit, Health Connect, and Google Fit Developer Policies). The Company contractually guarantees that fitness and health data ingested via these APIs will never be used for marketing, advertising targeting, or commercial data brokering.

8. Prohibited Platform Use and Acceptable Behavior

You contractually agree that you will not, under any circumstances, engage in the following prohibited activities:

• Malicious Payloads: Upload, post, or inject via our document intake lines, WhatsApp forwarders, or internal PaddleOCR containers any files containing viruses, Trojan horses, worms, time bombs, or software components designed to damage or disrupt our cloud infrastructure.
• Medical Fraud: Forge medical records, alter diagnostic values, modify prescription dates, or impersonate medical practitioners, parents, or guardians to manipulate the Platform’s data layers.
• Security Circumvention: Attempt to scrape, reverse-engineer, decompile, or bypass the security controls implemented on the Platform, including per-endpoint rate limiters, Helmet HTTP hardening layers, Joi input validation schemas, or the CORS allowlist.

9. Intellectual Property and Data Ownership

9.1 User Retains Absolute Data Ownership

You retain absolute intellectual property rights, copyright, and ownership over the raw text data, photographic images, PDF medical scans, and health records that you commit to your personal vault. Vaulth AI claims no ownership stake, licensing rights, or property interest in your personal health information, and will never sell or monetize your medical files.

9.2 Proprietary Platform Rights

All software source code, user interface designs, mathematical AI parsing models, text summarization layouts, branding elements, trademarks, and corporate logos associated with the “Vaulth AI” brand are the exclusive property of the Company and are protected by applicable intellectual property laws of the Republic of India.

10. Warranty Disclaimers, Limitation of Liability, and Indemnification

10.1 Absolute Limitation of Clinical Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE COMPANY, ITS PARENT ENTITY, ITS DIRECTORS, EMPLOYEES, OR SHAREHOLDERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, LOSS OF LIFE, PERSONAL INJURY, WORSENING OF MEDICAL CONDITIONS, OR WRONGFUL CLINICAL MANAGEMENT ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF, OR INABILITY TO USE, THE PLATFORM, ITS INFORMATIONAL AI INSIGHTS, LAB COMPREHENSION NARRATIVES, OR DRUG-INTERACTION CHECKS.

10.2 Statutory Penalty Caps vs. Civil Liability

• Statutory Framework: The DPDP Act, 2023 establishes structural administrative penalties for Data Fiduciaries (ranging up to ₹250 crore for severe security safeguard failures) payable directly to the Data Protection Board of India.
• Civil Cap: Contractually, between you and the Company, Vaulth AI’s total aggregate civil liability to an individual user for breach of contract, negligence, tort, or data mismanagement under these Terms shall not exceed the total amount paid by that user to Vaulth AI for the specific software services during the twelve (12) months immediately preceding the event giving rise to liability.

11. Governing Law and Seat of Jurisdiction

11.1 Governing Law

These Terms, their formation, performance, construction, and any legal actions or claims arising from them shall be governed, interpreted, and construed exclusively in accordance with the laws of the Republic of India, without regard to conflict of law principles.

11.2 Exclusive Seat of Jurisdiction

Any legal dispute, suit, arbitration, or formal proceeding arising under this Agreement shall be subject to the exclusive jurisdiction of the competent civil courts situated in Hyderabad, Telangana, India.

12. Contractual Termination and Data Erasure

12.1 Voluntary Account Closure

You may terminate this contract at any time by executing the self-serve “Delete Account” function inside the Platform’s account settings.

12.2 Purging Timelines across Environments

Upon contract termination or valid withdrawal of consent, Vaulth AI initiates automated erasure sequences across all production servers, object containers (GCS), and internal backups in accordance with the strict timelines set forth in our Privacy Policy. Data committed to production environments is completely and permanently wiped within 48 hours, and copies persisting in cryptographic backup volumes are overwritten dynamically within a standard retention cycle not exceeding 30 days.

12.3 Corporate Right of Account Suspension

The Company reserves the right to suspend or permanently deactivate your account immediately, without prior notice or judicial intervention, if you commit a material breach of these Terms, violate third-party API restrictions, or engage in activities that expose the Platform to regulatory liabilities under Section 9 of the DPDP Act.

13. Data Protection Officer & Formal Notices

In accordance with mandatory statutory provisions, any formal contractual notices, legal complaints, or data grievances under this Agreement must be routed directly to our designated officer:

• Attention: Data Protection Officer / Grievance Officer
• Name of Appointed Officer: Rishi Krishna Ginikunta
• Contact Email: rishi@vaulthai.health
• Corporate Office Address: Flat# 512, Raaganjali Apartments, Upparpally, Hyderabad, Telangana, India, 500048