TRUVA PRIVACY POLICY

Please read this Privacy Policy carefully. By downloading, registering on, or using the Truva mobile application and website (together, the “Platform”), you agree to be bound by the terms described below. If you do not agree with any part of this Policy, please do not access or use the Platform.

Beyoung Healthcare Private Limited (“Company”, “Truva”, “we”, “us”, or “our”) operates the Truva Platform, which allows users to compare and book diagnostic laboratory tests, upload and share prescriptions with partner labs, and upload diagnostic or medical reports for automated analysis and summarisation. This Policy is framed with reference to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

This Policy explains, point by point, what data we collect, how we collect it, why we use it, who we share it with, how long we keep it, where it is stored, and the choices and rights available to you.

1. What Data Do We Collect About You

• Identity & contact data: full name, email address, phone number, date of birth, gender, and residential/delivery address.
• Account data: username, password (stored in encrypted/hashed form), and account preferences.

Health and Diagnostic Information (collected depending on the services you use)

• For lab test booking: the test(s) selected, sample-collection date/time and address, and the resulting diagnostic report once your sample is processed.
• For prescription-based bookings: the prescription you upload, including medicines, dosage, and prescribing doctor where visible.
• For AI-Powered Smart Reports & Health Insights: the diagnostic/blood test report you choose to upload, the individual lab parameters extracted from it (for example, complete blood count, lipid profile, thyroid function, blood glucose), and the health score, trends, and plain-language insights we generate from it. This information is collected and processed only where you have given your explicit consent to use this feature (full detail in Section 10.2).
• Self-reported medical history: allergies, chronic conditions, or other health information you voluntarily enter into your profile.
• Financial data: billing name and transaction reference numbers. Card, UPI, and net-banking details are entered directly with our payment gateway partners and are not stored by Truva.
• Technical & usage data: device type and model, operating system and version, unique device or advertising identifiers, IP address, browser type, app version, and crash/diagnostic logs.
• Location data: collected only with your consent, to identify nearby labs and support home sample-collection logistics.
• Communications data: records of your interactions with customer support, including chat transcripts, emails, and call notes, and any feedback, ratings, or survey responses you submit.
• Marketing preferences: your choices regarding promotional emails, SMS, push notifications, and in-app offers.

Health and diagnostic information is classified as Sensitive Personal Data or Information under applicable law. What we collect depends on which services you use, and we only collect and process it after you give explicit, opt-in consent that is separate from your general acceptance of this Policy (see Section 10).

2. How We Collect Data

• Directly from you: when you register an account, complete your profile, upload a prescription or diagnostic report, book a lab test, respond to a survey, or contact support.
• Automatically: through cookies, SDKs, and in-app analytics each time you use the Platform (see Section 4).
• From partner laboratories and doctors: test results, report status updates, and consultation notes shared back with us once you have booked a service.
• From payment partners: transaction status and confirmation, to reconcile your order.
• From your device settings: location and notification permissions you grant through your phone’s operating system.

3. Data Shared By You

This is the data you actively and knowingly provide to us:

• Registration and profile details
• Diagnostic reports and prescriptions you upload for lab booking, or for AI-Powered Smart Reports & Health Insights
• Medical history and health questionnaire answers entered manually into the app
• Reviews, ratings, and feedback on labs or the Platform
• Messages you send to customer support or the Grievance Officer
• Consent choices, such as opting in to AI-Powered Smart Reports & Health Insights, location access, or marketing communications

4. Data That Is Collected Automatically

• Device and browser information (device type, OS version, unique identifiers)
• IP address and general network information
• App usage logs: screens viewed, features used, session duration, and timestamps
• Crash reports and diagnostic/performance data
• Location data, only where you have granted permission
• Cookies and similar tracking technologies, including essential, functional, and analytics cookies (see Section 12)

5. Our Use of Data

• Account creation & authentication: to register you, verify your identity, and keep your account secure.
• Service delivery: to display lab pricing, process bookings, coordinate sample collection, and route your prescription to the lab or pharmacy you select.
• AI-Powered Smart Reports & Health Insights: to generate plain-language summaries, flag abnormal values, and calculate your Truva Health Score from uploaded reports, based on your consent (full detail in Section 10).
• Personalisation: to recommend relevant tests, packages, and content based on your profile and history.
• Communication: to send booking confirmations, report-ready alerts, and respond to support queries, and, where you have opted in, promotional messages.
• Service improvement & quality assurance: to analyse aggregated, de-identified usage patterns and fix issues.
• Security & fraud prevention: to detect and prevent unauthorised access, abuse, or fraudulent bookings.
• Legal compliance & dispute resolution: to meet obligations under applicable law and respond to valid legal requests.

We do not use your health data for advertising, and we never sell your Personal Information to anyone, for any purpose.

6. Sharing of Data

• Partner diagnostic laboratories: only the information necessary to fulfil a booking (name, contact details, address, prescription, and test requested).
• AI-Powered Smart Reports & Health Insights providers: uploaded reports and extracted health values, shared solely to generate your summary and health score, under confidentiality and data-processing agreements (see Section 10).
• Cloud hosting, storage, and support tools: providers who operate the Platform’s infrastructure and customer-support systems, bound by confidentiality obligations and prohibited from using your data for their own purposes.
• Payment gateway partners: to process transactions securely; they receive only the data required to complete payment.
• Professional advisors: auditors, legal counsel, or accountants, where necessary and under confidentiality obligations.
• Legal and regulatory bodies: where required by law, court order, or government request, or to protect the rights, property, or safety of Truva, our users, or the public.
• Business transfers: if Truva is involved in a merger, acquisition, or asset sale, subject to this Policy continuing to apply.

All third parties who process data on our behalf are bound by written data-processing agreements requiring confidentiality and security consistent with this Policy. We do not sell your Personal Information under any circumstances.

7. Keeping Data Secure

• Encryption of data in transit (TLS) and at rest
• Role-based access controls restricting health data to authorised personnel on a need-to-know basis
• Secure, access-controlled server infrastructure with firewalls and intrusion-detection systems
• Regular security assessments, vulnerability scans, and periodic audits
• Staff confidentiality agreements and training on data protection obligations
• An incident-response process to investigate and, where required by law, notify you and regulators of any data breach

No method of transmission or storage is 100% secure, and while we work to protect your information, we cannot guarantee absolute security.

8. Retention of Data

• Account data: retained until you delete your account.
• Health reports and derived data: retained only while your account is active, and deleted or anonymised within 30 days of an account-deletion request.
• Booking and transaction records: retained for as long as required for accounting, warranty, or dispute-resolution purposes, and thereafter as required by law.
• Usage/log data: retained for up to 24 months for security and analytics purposes.
• Data held by our AI Smart Reports provider: retained only as long as necessary to generate a result, then deleted or de-identified.
• Backups: deleted data is removed from live systems immediately and purged from encrypted backups within a reasonable operational cycle, generally not exceeding 90 days.
• Legal records: retained for the period required under applicable law.

9. Where We Store Data

Your Personal Information, including health data, is primarily stored on secure servers located in India.

• Sub-processors: certain Service Providers, including our AI Smart Reports and cloud-infrastructure partners, may process data on servers located outside India.
• Safeguards: where data is processed or stored outside India, we ensure it is protected by contractual data-processing agreements and confidentiality and security obligations equivalent to those in this Policy.
• No undisclosed transfers: we do not transfer health data to any storage location or processor that is not disclosed in this Policy.

10. Processing Your Data

10.1 Legal Basis for Processing

We process your Personal Information on the basis of your explicit consent (required for all health and diagnostic data, and for AI-Powered Smart Reports & Health Insights), the necessity of processing to deliver a service you have requested (such as booking a test), and our obligation to comply with applicable law.

10.2 AI-Powered Smart Reports & Health Insights — How It Works

AI-Powered Smart Reports & Health Insights is an optional feature that automatically processes a diagnostic report you choose to upload, in order to generate a plain-language summary, health score, or trend view. This feature is available only based on your consent — it is switched on only if you explicitly opt in, and using the rest of the Platform does not require you to enable it. We set out the following so you understand exactly how it works:

• What happens to your report: once you opt in and upload a report, the file and the health values extracted from it are sent to our AI processing engine to generate your summary, health score, and trend view.
• No use for model training: your uploaded reports and derived health data are not used to train, fine-tune, or improve any AI model, unless you separately and affirmatively opt in to such use.
• Not a medical diagnosis: AI-generated summaries are informational only, are not reviewed by a physician unless you separately book a doctor consultation, and are not a substitute for professional medical advice.
• Data minimisation: only the data necessary to generate the summary is shared with the AI processing engine; it is not shared with partner laboratories or used for marketing.
• Your control: you may decline or later withdraw consent for AI-Powered Smart Reports & Health Insights at any time and still use price-comparison and test-booking features; declining does not affect your account (see Section 10.4).

10.3 Profiling and Personalisation

We use your health parameters and usage history to personalise recommendations, such as suggesting relevant follow-up tests. This personalisation does not result in any decision with legal or similarly significant effect on you, and you may opt out of personalised recommendations from within the app.

10.4 Withdrawing Consent

You may withdraw consent for any processing of your health data at any time from within the app under Settings → Privacy. Withdrawal stops future processing but does not affect processing already completed.

11. Your Rights and Choices

• Access, correction & portability: request a copy of your Personal Information, ask us to correct inaccurate data, or request it in a portable format, by writing to privacy@truva.health.
• Deletion, including in-app deletion: permanently delete your account and associated health data directly from the app via Settings → Account → Delete My Account, without needing to contact support. Deletion requests submitted by email are honoured within 30 days.
• Restriction and objection: ask us to restrict processing of your data, or object to specific processing activities, including personalisation.
• Opting out of AI-Powered Smart Reports & Health Insights: continue using price-comparison and test-booking features without ever enabling this feature.
• Managing communications: unsubscribe from promotional emails, SMS, or push notifications at any time from your account settings.
• Grievances: raise a complaint with our Grievance Officer (Section 16) if you believe your rights have not been respected.

We will acknowledge and respond to rights requests within the timeframe required by applicable law, generally within 30 days.

12. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

• Essential cookies: required for core functionality such as login and security.
• Functional cookies: remember your preferences and settings.
• Analytics cookies: help us understand usage patterns and improve the Platform.

You can control cookies through your browser or device settings; disabling non-essential cookies may limit some functionality but will not prevent you from using core booking features.

13. Children’s Privacy

The Platform is intended for users 18 years of age and older. We do not knowingly collect information from children under 18. If we learn we have inadvertently done so, we will delete it promptly.

14. Third-Party Links

The Platform may link to third-party websites or services. We are not responsible for their privacy practices and encourage you to review their policies separately.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified via in-app notice or email, and the “Last updated” date above will be revised. Continued use of the Platform after such changes constitutes acceptance of the updated Policy.

16. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder:

17. Contact Us

For any questions about this Privacy Policy, please contact: