Privacy Policy

1. Collection of Personal Data

Aayu may collect and process the following categories of personal data:

• Identification and account data: including your name, contact number, email address, login credentials, and related information.
• Sensitive personal data (health data): including medical history, diagnostic results, treatment details, prescriptions, laboratory records, and other health-related information voluntarily uploaded or provided by you.
• Health and fitness readings from your phone and connected devices, through Health Connect (Android) or Apple Health (iOS), but only if you choose to connect them (see Section 3).
• Technical and usage data: including device identifiers, IP address, operating system, browser type, geolocation data (if enabled), and analytics relating to your interaction with the Services.
• Communication data: including inquiries, feedback, and records of interactions with Aayu for support or service-related purposes.

2. Google User Data

Aayu offers Google Sign-In as an authentication method through the Google OAuth platform. When you choose to sign in with Google, we request access to a limited set of data from your Google Account, with your consent. This section describes how we access, use, store, and share that Google user data.

Data we access. When you sign in with Google, we access the following Google user data:

• Basic profile information: your name and profile picture.
• Email address: the email address associated with your Google Account.
• Google Account identifier: a unique ID that Google assigns to your account and that we use to recognize you across sessions.

How we use this data. We use this Google user data solely to create and authenticate your Aayu account, to recognize you when you return, and to communicate with you about your account. We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.

How we store and retain it. Google user data is stored on our secured infrastructure, encrypted in transit and at rest, and retained only for as long as your account remains active or as needed to provide the Services. When you delete your account, this data is deleted in accordance with the "Retention of Data" and "Your Rights" sections below.

How we share it. We do not sell Google user data, and we do not share it with third parties except with infrastructure and service providers acting on our behalf to operate the Services, or where disclosure is required by applicable law.

Limited Use. Aayu's use and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Health Data from Health Connect and Apple Health

If you choose to connect Health Connect (Android) or Apple Health (iOS) to Aayu, we read a limited set of health and fitness data from your phone and connected devices, with your permission. This section describes how we access, use, store, and share that data. Connecting is optional, and the Services work without it.

Data we access. Depending on the permissions you grant, we read the following data types: steps, heart rate, respiratory rate, blood pressure, body temperature, oxygen saturation (SpO2), height, weight, and sleep (sleep sessions and, where available, light, deep and REM stages). Aayu only reads this data; it never writes to Health Connect or Apple Health. When you first connect, we may import up to six months of your existing readings so your history and trends are available from the start. After that, we read only new readings. If you grant background access, your phone may run this sync periodically while Aayu is closed so your record stays current; if you decline, Aayu syncs when you open it.

How we use this data. Before upload, readings are reduced on your device to one value per measurement per day; the raw high-frequency samples never leave your phone. The daily values become part of your Aayu health record and are used to show your latest vitals, your trends over time, your sleep and activity trackers, and your health-system summaries, and are included with the rest of your record in the AI processing described in Section 6. We do not use this data for advertising or marketing, to determine creditworthiness or insurability, or to train AI models.

How we store and retain it. Readings are stored in encrypted form on the same infrastructure as the rest of your health record (see Section 8) and retained as part of your record until you delete them or your account.

How we share it. We do not sell this data, and we do not share it with third parties except with the infrastructure and service providers named in Section 8 acting on our behalf, or where disclosure is required by applicable law. It is never shared with advertisers, data brokers, or information resellers.

Your controls.You can disconnect Health Connect or Apple Health in Aayu's Settings at any time; Aayu then stops reading, and readings already in your record remain until you delete them. You can also revoke individual permissions in Health Connect or the Health app on your phone, delete individual readings in Aayu, or delete your account, which deletes your data as described in Section 7.

4. Legal Basis and Consent

Processing of personal data is carried out in accordance with the DPDP Act, the UAE PDPL, and other applicable laws. Aayu may process data based on one or more of the following grounds:

• Consent: Your explicit, informed consent, particularly for sensitive personal data such as medical records.
• Contractual necessity: Where processing is required to provide the Services you have requested.
• Legal obligation: Where processing is required to comply with applicable laws.
• Legitimate interests: Where processing is necessary for security, fraud prevention, and service improvement, provided such interests are not overridden by your fundamental rights.

Consent, once given, may be withdrawn at any time by contacting us at the details below, without affecting the lawfulness of processing carried out before such withdrawal.

5. Purpose of Processing

Personal data is collected and processed strictly for the following purposes:

• • Registering, authenticating, and managing your account.
• • Structuring, securing, storing, and retrieving your medical records.
• • Enabling authorized access to your data, subject to your consent.
• • Improving, personalizing, and developing the Services.
• • Ensuring system security, fraud detection, and misuse prevention.
• • Providing customer service, communication, and notifications regarding the Services.
• • Complying with legal, regulatory, or judicial obligations.

6. AI Processing of Your Health Data

To convert your uploaded medical records into structured digital health data and to generate summaries and insights from your health information (your "Aayu AI Report"), Aayu uses AI models on Google Cloud's Gemini Enterprise Agent Platform. Your medical records are not used by Google to train or improve its AI models.

When you upload a medical document such as a laboratory report, prescription, or discharge summary, that document is transmitted over an encrypted connection to Google Cloud, where it is read by these AI services to extract its contents. Health information already in your record, such as diagnoses, medications, and laboratory or vital values, together with profile details you provide, such as age, sex, and known conditions, may also be processed by the same services to generate summaries and health insights shown in the app.

An uploaded document is sent for AI processing only after you give explicit consent in the app at the time of upload. If you do not consent, the document is not uploaded and nothing is sent. You can review each AI-generated result in the app before it is saved to your record.

Google acts as our data processor for this purpose and handles your data in accordance with the Google Cloud Data Processing Addendum and the enterprise terms governing our use of Google Cloud.

We do not sell your personal data, and we do not share it with any third-party AI provider for that provider's own use. Google Cloud is the AI data processor for the Services and processes your data solely on our behalf.

• Google Cloud Data Processing Addendum
• Google Cloud data governance for generative AI

AI-generated content can contain mistakes. Always review AI-generated results in the app, and refer to the Medical Disclaimer for the limits of the information the Services provide.

7. Retention of Data

Aayu shall retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy or as required under applicable law. Health and medical data shall be retained strictly for the duration required to provide the Services or comply with legal obligations. Upon account deletion or a valid request for erasure, Aayu shall delete or anonymize personal data, except where continued retention is mandated by law.

8. Disclosure and Transfer of Data

Aayu may disclose personal data in limited circumstances, including to:

• • Third-party service providers engaged for hosting, storage, analytics, communication, or technical support, subject to strict contractual safeguards — including Google Cloud, on whose encrypted storage your uploaded medical documents are held and which provides the AI processing described in Section 6, and Amazon Web Services, which hosts our services and databases, where your structured health data is stored in encrypted form.
• • Healthcare professionals or institutions, but only with your explicit consent.
• • Governmental, regulatory, or judicial authorities, where disclosure is required by applicable law.

Where data is transferred outside India or the United Arab Emirates, Aayu shall ensure that appropriate safeguards, including standard contractual clauses or equivalent measures, are in place to guarantee adequate protection.

9. Security of Processing

Aayu employs appropriate organizational and technical measures to ensure a level of security appropriate to the risk, including encryption in transit and at rest, strict access controls, regular monitoring and audits, and adherence to the principles of privacy by design and privacy by default. Sensitive personal data is processed with enhanced safeguards to protect confidentiality, integrity, and availability.

10. Your Rights

You retain the following rights under applicable laws:

• • Right to access and obtain a copy of your personal data.
• • Right to correct inaccurate or incomplete data.
• • Right to deletion of personal data, subject to legal limitations.
• • Right to restrict or object to processing in certain circumstances.
• • Right to withdraw consent at any time, where processing is based on consent.
• • Right to data portability, where technically feasible.
• • Right to lodge a complaint with the competent data protection authority in India or the United Arab Emirates.

11. Amendments

Aayu reserves the right to amend or update this Policy at its discretion and at any time. Any material changes will be communicated by appropriate means, including publication on our website or in-app notifications. Continued use of the Services following such changes shall constitute your acceptance of the revised Policy.

12. Contact

For all questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact Aayu at: