Privacy policy

Introduction and data fiduciary identity

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Sah Business Family acts as the Data Fiduciary responsible for determining the purpose and means of processing your personal data on aiyuclinic.com.

This policy applies together with our Terms and Conditions and, where relevant, our Teleconsultation and Chat Policy.

Personal data we collect

• Account and contact details: name, phone number, email address, and login credentials.
• Identity and verification information: for practitioners, registration certificate, qualification certificate, and a government identity document submitted for verification; for all users, information generated during WhatsApp OTP-based phone verification.
• Booking and payment information: appointment details, consultation mode, amounts paid, and payment-gateway transaction references — we do not store full card or bank account numbers.
• Communication and device information: messages sent through in-app chat, consultation scheduling data, and standard technical information such as IP address and device or browser type.
• Health-related information you choose to share with a practitioner while booking or during a consultation.

Legal basis and purpose limitation

We process personal data on the basis of your consent, given through a clear, specific, and informed affirmative action, as required by Section 6 of the DPDP Act. We use personal data only for the purpose it was collected for: operating and securing the Platform, processing bookings and payments, verifying practitioner credentials and phone numbers, providing support, preventing fraud, meeting legal obligations, and improving the Platform. We do not sell personal data.

How we use Firebase and other service providers

• Firebase Authentication manages secure sign-in and session cookies.
• Cloud Firestore stores account, booking, and profile data; Firebase Storage stores uploaded documents and images; Firebase App Hosting runs the Platform — these are Google Cloud services engaged as our data processors.
• The WhatsApp Cloud API (Meta) delivers one-time passcodes for phone verification.
• Cashfree (Indian Rupee payments) and Stripe (other currencies) process online payments as independent payment processors.
• Google Calendar and Google Meet generate and host video-consultation links for practitioners who connect their calendar.

Public vs private profile information

Once a practitioner's profile is verified and published, their professional details — name, qualifications, offerings, availability, and profile photograph — are publicly visible so patients can make an informed choice. Supporting verification documents (registration certificate, qualification certificate, identity document) are never public; they are stored securely and accessible only to the practitioner and to our verification administrators.

Sharing and disclosure

We share personal data only: with the practitioner or patient relevant to a specific booking, with the service providers named above acting on our instructions, or with a court, regulator, or authority where required by law. We do not sell personal data to third parties for their own marketing purposes.

Cross-border data transfer

Some of our service providers, including Firebase/Google Cloud, Stripe, and WhatsApp/Meta, may process or store data outside India. Such transfers are made in accordance with Section 16 of the DPDP Act, which permits transfer of personal data outside India except to countries specifically restricted by the Central Government.

Data retention and security

We retain personal data only for as long as needed for the purpose it was collected, or as required by law (for example, for tax, accounting, or dispute-resolution purposes), after which it is deleted or anonymised, consistent with Section 8 of the DPDP Act.

We apply reasonable security safeguards, including role-based access control, authenticated access, encryption of data in transit, and Firestore/Storage security rules that restrict sensitive documents to the relevant practitioner and administrators.

Data breach notification

If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required under Section 8(6) of the DPDP Act and any rules issued under it.

Your rights as a Data Principal

The DPDP Act gives you the following rights over your personal data. To exercise any of them, write to us at business@sah.org.in; we may need to verify your identity before acting on the request.

• Access a summary of the personal data we hold about you and how it is being processed.
• Request correction, completion, or erasure of your personal data.
• Withdraw consent at any time, without affecting processing already carried out.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Raise a grievance about how we handle your personal data.

Children's and guardian consent

Where an appointment is booked for a person under 18, we rely on the parent or legal guardian who books the appointment to provide verifiable consent, consistent with Section 9 of the DPDP Act. We do not knowingly use a child's personal data for tracking, behavioural monitoring, or targeted advertising.

Grievance officer and updates

Questions or complaints about this Privacy Policy, including a request to exercise your rights, can be sent to our Grievance Officer (see our Grievance Redressal Policy), consistent with Section 13 of the DPDP Act. We may update this Privacy Policy from time to time; the version published on this page applies from its stated effective date.

Contact us

This policy is published by Sah Business Family, the operator of aiyuclinic.com. For questions about this policy, or to make a request under it, contact us at business@sah.org.in or +91 82889 92002 (also our WhatsApp number), or write to us at Ward 14, Village, Mauje Rd, Raxaul, Bihar 845305.

For a formal complaint, see our Grievance Redressal Policy, which sets out how to submit a grievance and our response timelines.