This Privacy Policy (“Policy”) is being issued by Hospido Private Limited (“Hospido”, “aiqa”, “We”, “Our”, “Us”), the owner and operator of the mobile application “aiqahealth” (the “Application” or “App”), and the website available at https://aiqahealth.com/ (opens in a new tab), collectively referred to as the “Platform” for the purpose of this Policy.
This Policy is issued in accordance with the Applicable Laws (as defined below) and governs the collection, use, processing, storage, disclosure, transfer, retention and protection of data, including Personal Data, by Hospido in connection with the Platform and the Services made available through it, and applies to all Users (as defined below) who access or use the Platform or otherwise interact with Hospido through any online or offline channel(s) including its social media pages and advertising campaigns.
Users are advised to read this Privacy Policy carefully before accessing or using the Platform or availing any Services through the Platform. By accessing or using the Platform, a User acknowledges that they have read, understood and agreed to the collection and Processing of their Personal Data in accordance with this Privacy Policy.
Definitions and Interpretations
- “Applicable Laws” means all applicable data protection and privacy laws, rules, and regulations in force in the relevant jurisdiction governing the Processing of Personal Data, including, where applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India, as may be amended from time to time.
- “Personal Data” / “Personal Information” (“PI”) means any data or information about an individual who is identifiable by or in relation to such data, including data capable of identifying a natural person directly or indirectly in combination with other information.
- “Sensitive Personal Data or Information” (“SPDI”) has the meaning assigned to it under the SPDI Rules, and includes passwords, financial information, physical, physiological and mental health condition, sexual orientation, medical records and history, and biometric information.
- “Processing” means any operation performed on Personal Data, whether automated or not, including collection, recording, storage, use, sharing, disclosure and erasure.
- “Services” means the products, features and healthcare-related services offered by Hospido through the Platform.
- “User/You/Your” means any natural person who accesses, browses, registers on, or uses the Platform or avails of, or seeks to avail of, any Services through the Platform, or otherwise interacts with Hospido through any online or offline channel, including its social media pages and advertising campaigns.
In the event that any information provided or uploaded by a User violates this Privacy Policy, the Terms and Conditions, or any Applicable Laws, Hospido reserves the right to remove such information and suspend, restrict or terminate the User's access to the Platform, without prejudice to any other rights or remedies available to Hospido under Applicable Laws or the Terms and Conditions.
Information We Collect
We collect the following categories of information about You, whether directly from You, automatically through Your use of the Platform, or from third parties, in order to register You and enable You to avail the Services through the Platform.
| Purpose of Processing | Personal Data Collected | Purpose |
|---|---|---|
| User Registration and Account Management | Name, mobile number, email address, username, password, age/date of birth and gender | To create and manage Your account, verify Your identity, authenticate access to the Platform and maintain Your User profile. |
| Personalised Healthcare Services | Name, age/date of birth, gender, address (city, State and PIN code), occupation, medical history, symptoms, diagnoses, medications, allergies, laboratory and diagnostic reports, consultation records, connected device data (where enabled) and other information voluntarily shared by You | To provide teleconsultations and other healthcare Services, personalise care, facilitate clinical assessment, treatment, prescriptions, follow-up care and healthcare recommendations. |
| Device Permissions and Platform Access | Information and data accessed through device permissions enabled by You, including location/GPS, camera, microphone, storage/photos and media, Bluetooth, activity recognition, notifications and SMS/OTP, as applicable to the functionality used | To enable specific Platform functionalities that require access to Your device, including location-based services, uploading reports or images, teleconsultations, connecting compatible wearable or Bluetooth-enabled devices, activity tracking, authentication and service notifications. You may manage or withdraw applicable device permissions through Your device settings; however, disabling certain permissions may affect the availability or functionality of corresponding Platform features. |
| Wearable and Connected Device Data | Data obtained from connected/wearable devices or health platforms, such as activity and exercise data, step count, heart rate, sleep data, calories burned, distance, device identifiers and other health or fitness information, where You expressly enable the relevant device or platform connection and permissions | To provide and personalise healthcare, wellness and fitness-related Services, track health and activity trends, provide insights and recommendations, and support monitoring and improvement of Your health and wellness, in accordance with the permissions granted by You. |
| Communication and Service Delivery | Name, mobile number, email address and communication preferences | To send appointment reminders, consultation updates, prescriptions, diagnostic report notifications, service-related communications and, where You have provided consent, promotional communications. |
| Clinical Quality, Compliance and Record Management | Consultation records, medical records, chat communications, correspondence and audio/video consultation recordings (where separately consented to) | To maintain clinical records, monitor and improve the quality of healthcare Services, investigate complaints or disputes, ensure patient safety and comply with Applicable Laws and respond to lawful governmental or regulatory requests. |
| Technical Operations, Analytics and Platform Security | IP address, device identifiers, browser and operating system information, cookies, log data, usage analytics, approximate location and other technical information | To operate, secure, maintain and improve the Platform, troubleshoot technical issues, monitor Platform performance, analyse usage trends and prevent fraud or unauthorised access. |
| Customer Support and Grievance Redressal | Name, contact details, correspondence, support requests, feedback and other information voluntarily shared while seeking assistance | To respond to queries, provide customer support, resolve complaints and grievances, and improve the quality of Our support services. |
| Payment Processing | Payment method details, masked payment instrument details, transaction reference, billing information and payment history | To process payments, refunds and billing through authorised payment service providers and maintain transaction records. We do not store complete card or banking credentials on Our servers. |
| Research, Analytics and Service Improvement | Anonymised or de-identified information derived from Personal Data, such as user statistics, consultation trends and Platform usage information | To conduct research, analytics, product development and improve the quality, effectiveness and functionality of the Platform and the Services without identifying any individual. |
| Marketing and Promotional Communications | Name, mobile number, email address, marketing preferences and Platform usage information (excluding medical records, consultation records, diagnoses, prescriptions and other health-related information), and non-health identifiers and usage events such as page views, button clicks, campaign identifiers, click identifiers, cookies and hashed contact identifiers, where applicable | To send promotional communications, personalised offers and updates and measure the effectiveness of marketing campaigns, understand user engagement and conduct marketing analytics through authorised advertising and analytics partners, where required, only with Your consent and in accordance with Applicable Laws. |
We may use third-party advertising, analytics and marketing technologies, including tools provided by platforms such as Meta (Facebook and Instagram), to measure the effectiveness of Our advertising campaigns, understand User engagement and improve Our marketing efforts. Such third-party tools may collect or receive limited information relating to Your interaction with the Platform or Our advertisements, as provided above. Third-party platforms may process information collected through their tools in accordance with their own privacy policies and terms. Users may review and manage their preferences directly through the settings provided by such third-party platforms, where applicable.
Wearable & Connected Device Data: Where You choose to connect a wearable device, fitness band, or health-tracking application (including but not limited to Apple Health/HealthKit, Google Fit, and Google Health Connect) to the Platform, We may collect and store data transmitted from such device or application to Our App, including step count, heart rate, sleep patterns, distance travelled, calories burned, blood pressure, and other physiological or activity data (‘Wearable Data’). Such access is read-only, optional, and may be granted or revoked by You at any time through Your device settings. Wearable Data is used solely to enable relevant features of the Platform (such as health tracking, personalised insights, and wellness programmes) and forms part of Your Personal Data/Sensitive Personal Data or Information for the purposes of this Policy.
We handle such data in accordance with the applicable developer/data-use policies of Apple and Google. Where You choose not to grant such access, certain features of the Platform may be limited or unavailable, but Your ability to use the Platform's core Services shall not be affected.
Advertising and analytics technologies are used only in relation to non-health information. We do not share, disclose, transmit or otherwise use Your medical records, consultation details, diagnoses, prescriptions, laboratory reports or other health-related information for advertising, audience targeting or marketing purposes. Any sharing of information with third-party service providers shall be undertaken in accordance with this Privacy Policy and Applicable Laws.
Integration with Apple Health (HealthKit) and Google Fit
- In the event that You elect to share data originating from the Apple Health application, Apple HealthKit, or Google Fit with the Platform, such data shall, upon such sharing, constitute Personal Data for the purposes of, and shall be governed in all respects by, this Privacy Policy.
- All data received by Us from the Apple Health application and HealthKit shall be Processed in compliance with the developer guidelines prescribed by Apple Inc., as set out at https://developer.apple.com/app-store/review/guidelines/#health-and-health-research (opens in a new tab).
- All data received by Us from Google Fit shall be Processed in compliance with the Google Fit Terms of Service, as set out at https://developers.google.com/fit/terms (opens in a new tab).
- “Apple,” “iPhone,” “Health,” and “HealthKit” are registered trademarks of Apple Inc., and any reference thereto in this Policy is solely for the purpose of identifying the relevant integration and does not imply any affiliation with, or endorsement by, Apple Inc.
- “Google Fit” and “Google” are registered trademarks of Google LLC, and any reference thereto in this Policy is solely for the purpose of identifying the relevant integration and does not imply any affiliation with, or endorsement by, Google LLC.
User Account
- Account usage - Users are advised to exercise caution when sharing Personal Data, particularly login credentials, with any person or Third Party. Hospido shall not be liable for any loss, damage, or unauthorized access resulting from the User’s voluntary disclosure or sharing of Personal Data with any third party.
- User Content: Users are solely responsible for the accuracy, completeness and legality of the information, records, documents and other content (including Personal Data) that they upload, submit or share through the Platform. Hospido does not verify or endorse such content and shall not be responsible for any consequences arising therefrom.
- Account Deletion - Where You choose to delete Your account, Hospido shall process such request in accordance with this Privacy Policy and Applicable Laws. Certain Personal Data may continue to be retained where required for legal, regulatory, contractual, clinical record-keeping, fraud prevention, dispute resolution or other lawful purposes.
- You may opt out of interest-based Facebook/Instagram advertising directly through Your Meta account’s Ad Preferences, or through industry tools such as the Digital Advertising Alliance’s opt-out page;
- Consequences of Not Providing Personal Data: We collect Personal Data only to the extent necessary to fulfil the purposes outlined in this Privacy Policy, provide our Services and fulfil our legal obligations (if any). However, if you choose not to provide certain information, some or all of the functionalities or Services on the Platform may be limited or unavailable to you.
Data Retention and Deletion
a) We retain Personal Data only for the duration necessary to fulfil stated purposes or as legally required. Our standard retention schedule is:
| Category of Personal Data | Retention Period |
|---|---|
| Account Data (Name, contact, demographics) | Life of account + 90 days, following account deletion, personal data will be deleted or anonymised within 90 days, unless retention is required or permitted under applicable law. |
| Consent Records | Life of account + 7 years or such period as is reasonably necessary to demonstrate, administer or defend the lawfulness of the relevant Processing, or as otherwise required under Applicable Laws |
| Healthcare Records (Consultations, diagnostics, prescriptions) | As required for applicable clinical, statutory, regulatory and professional record-keeping requirements, and otherwise only for as long as reasonably necessary for the relevant healthcare purpose, legal claims, dispute resolution and continuity of care. |
| Connected Device Data | Life of account, or until device disconnection, followed by deletion or anonymisation within 90 days, unless otherwise required by applicable law. |
| Payment & Billing | 7 years or such longer/shorter period as required under applicable tax, accounting, financial, regulatory or legal requirements. |
| Grievance & Support | Active resolution period + 24 months or longer where reasonably necessary for legal claims, regulatory requirements or dispute resolution. |
| Technical Logs (Server, IP) | 180 days, unless a longer period is required for security, fraud prevention, investigation, legal compliance or resolution of an incident. |
| Analytics & Usage | 14 months, thereafter permanently anonymised. |
Where Personal Data has been made available to or processed by a data processor on Our behalf, We will take reasonable steps to request deletion or return of such Personal Data, as applicable, when the relevant Processing purpose has been fulfilled or when deletion is otherwise required, subject to Applicable Laws and any lawful retention requirements.
b) You may request account deletion or Personal Data erasure through Platform settings or by contacting the Grievance Officer. Upon a valid request or consent withdrawal, We will erase Your data—including health records and connected device data—across all active systems.
- Confirmation: You will receive a deletion receipt; a log of this event is retained solely for compliance.
- Backups: Data in secure system backups is purged within thirty-five (35) days.
- Exceptions: We retain specific data post-deletion only if strictly mandated by Applicable Laws for clinical record-keeping, regulatory compliance, or dispute resolution.
User Rights
Users have certain rights in relation to their Personal Data in accordance with Applicable Laws, which include:
- to obtain a summary of the Personal Data We hold about You and the processing activities undertaken;
- to review/update/rectify/correct/complete inaccurate Personal Data and ensure it is accurate, true, updated, and complete (right to rectification);
- to erase/delete your Personal Data (right to erasure; right to be forgotten);
- to raise a grievance in accordance with the "Customer Grievance" section below; and
- to make a complaint with the appropriate authority.
Disclosure and Sharing of Information
Hospido does not sell or rent Your Personal Data. We may disclose Your Personal Data, on a need-to-know basis, to Our care team and Registered Medical Practitioners ("RMPs"), empanelled laboratories and healthcare providers, payment service providers, cloud hosting and technology service providers, channel partners, corporate clients, insurers or authorised programme partners, advertising and analytics service providers (limited to non-health data), professional advisors, and government authorities or law enforcement agencies where required under Applicable Laws.
Commitment to Privacy
The Platform is committed to safeguarding the privacy of all Users, whether registered or merely visiting the Platform. It is recommended that Users fully comprehend the types of Personal Data being collected. The Platform utilizes Personal Data only for the purpose of providing Services and to the extent necessary to fulfil the purposes expressly set out in this Privacy Policy, and ensures such Personal Data is not utilized for any other purposes except those specified in this Privacy Policy. We implement reasonable technical, organisational and administrative safeguards to protect Your Personal Data, including, where appropriate, encryption, access controls, secure storage, and the anonymisation or de-identification of Personal Data, to prevent unauthorised access, use, disclosure, alteration or destruction.
Hospido implements reasonable technical, organisational and administrative safeguards to protect Personal Data, including encryption, role-based access controls, segregation of Health Data, access restrictions, secure storage and appropriate vendor/third-party processing controls. Health Data is subject to enhanced access and processing controls and is not used, shared, disclosed or otherwise made available for advertising, marketing or audience targeting purposes in any form, including through third-party advertising or analytics tools. We periodically review and update these safeguards in accordance with Applicable Laws and evolving security risks.
We retain Your Personal Data only for as long as necessary to provide the Services, fulfil the purposes set out in this Privacy Policy, comply with Applicable Laws, resolve disputes, and enforce Our legal rights and obligations. Upon expiry of the applicable retention period, Your Personal Data will be deleted, anonymised or securely archived, as required under Applicable Laws.
Children’s Data
Our Platform is intended for individuals who are 18 years of age or older, or for use by a parent or lawful guardian on behalf of a child or dependent. We do not knowingly collect or process the Personal Data of a child without the verifiable consent of their parent or lawful guardian, except where such information is provided by the parent or lawful guardian to obtain healthcare Services for the child. We do not carry out targeted advertising directed at individuals below the age of 18. Where required under Applicable Laws, We obtain the verifiable consent of the parent or lawful guardian before processing such Personal Data.
Indemnity
You agree and undertake to indemnify and hold harmless Hospido from third party claims and liabilities arising from Personal Data you voluntarily disclose to independent third parties (including Consultants, external websites, apps, or services not acting on Hospido behalf) through or outside the Platform, and from your use and access of such third-party resources, to the extent permitted by applicable law. We assume no liability for any actions of such third parties with regard to Your Personal Data which You may have disclosed to such third parties.
Grievance Redressal
For any grievances or concerns related to the Platform, or any breaches of the Privacy Policy, or other policies, please contact our designated Grievance Officer (by whatever name called under Applicable Laws).
Name/Title: Anurag Pandey (Grievance Officer)
Email: care@aiqahealth.com
Address: 5th Floor, SAS Tower, Tower A Sector 38, Gurugram, Haryana 122001, IndiaDays and Timing – Monday to Friday, 10:00AM to 6:00 PM, excluding public holidays in India.
The Grievance Officer will acknowledge and address your complaint in accordance with applicable legal requirements and within the timelines prescribed thereunder.
If you are located in India, this section applies to you and supplements the other provisions of this Privacy Policy. Hospido handles your Personal Data in accordance with Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India, as may be amended from time to time.
Your Rights:
- You have a right to access your Personal Data held by us, our Processing activities, and the Third Parties with whom Personal Data has been shared, along with a description of such data (right to access);
- You have a right to review/update/rectify/correct/complete inaccurate Personal Data and ensure it is accurate, true, updated, and complete (right to rectification);
- You have a right to erase/delete your Personal Data (right to erasure; right to be forgotten);
- You have a right to withdraw/revoke your consent at any time, without affecting the lawfulness of the Processing based on such consent before its withdrawal;
- You have a right to nominate another individual to act on your behalf in the event of death or incapacity;
- You have a right to raise grievance with us regarding your processing of Personal Data by us; and
- You have a right to make a complaint with the appropriate authority.
You may exercise these rights by contacting us in accordance with the Customer Grievance section of this Privacy Policy. We try to respond to all legitimate requests at the earliest within the timelines as per Applicable Law and will contact you if we need additional information from you in order to honour your request. For your protection, we may require that the request be sent through the registered details (including phone number, name etc.) associated with your account, and we may need to verify your identity before implementing your request.
The provisions contained in this section are specifically applicable to you. However, all other terms and clauses set forth in the main Privacy Policy shall continue to apply in full force and effect. This section is intended to supplement, and not replace, the main Privacy Policy.