Privacy Policy

Arogo (the “Arogo” mobile app and the website arogohealth.com, together the “Services”) is operated by KASH LIFESTYLE WELLNESS LLP, 6th Floor, Unit No. 603–604, Tower B, Bhutani Alphathum, Sector 90, Noida, Gautam Buddh Nagar, Uttar Pradesh – 201305, India (“we”, “us”, “our”).

For the personal data you give us, we are the Data Fiduciary and you are the Data Principal under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). This policy is our notice to you under Section 5 of the DPDP Act. To the extent they still apply, it is also published under Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Summary

• We collect only what the Services need: your account details, your health profile, and the records and readings you choose to add.
• We use your data only to provide the Services to you. We do not sell it. We do not use it for advertising and do not share it with insurers, employers or data brokers.
• Reports and prescriptions you upload are read by an AI service (Google Gemini) to extract values. See Section 4.
• Activity data from Health Connect (steps, calories, sleep, resting heart rate) is read only on your phone. It is never sent to our servers.
• Labs and clinics can see your records only if you turn on sharing. It is off by default. See Section 5.
• You can change your consent choices or delete your account in the app at any time (Settings → Privacy & Consent). You can also access and correct your data, nominate someone, and raise a grievance. See Sections 3, 9 and 15.

2. Personal data we collect and why

We collect the following personal data for the stated purposes only:

Health information is sensitive. Please add only what you are comfortable storing. Most fields in your health profile are optional. If you leave them out, some features will be less accurate.

3. Your consent and how to withdraw it

We process your personal data on the basis of the consent you give when you create an account and accept this policy. We also rely on the specific actions you take, such as uploading a report, adding a family member or granting Health Connect access. We may also process data without consent where the DPDP Act allows it (Section 7). Examples are complying with a legal obligation or court order, or responding to a medical emergency.

You can withdraw your consent at any time, as easily as you gave it:

• Health Connect: revoke Arogo's access in your phone's Health Connect settings. Nothing is stored on our side.
• AI analysis, and sharing with labs & clinics: turn either off in the app under Settings → Privacy & Consent.
• Individual records, readings or family members: delete them from within the app.
• All processing: delete your account in the app (Settings → Privacy & Consent → Delete Account), email grievance@arogohealth.com, or follow the steps on our Delete Your Account page. The Services cannot work without your data, so withdrawing all consent means closing your account.

Withdrawing consent does not make processing that took place before the withdrawal unlawful. Once you withdraw consent, we will stop processing your data and delete it as described in Section 7, unless the law requires us to keep it.

4. AI processing of your documents

When you upload a lab report or prescription, or ask for a diet plan, we send the document, or the relevant health details, to Google's Gemini API. It reads test names and values, medicines and dates, or drafts a diet plan. The results are saved to your account.

We send only what the feature needs, and only when you use that feature. Google processes this data under the Gemini API terms of service. You can turn AI analysis off at any time under Settings → Privacy & Consent. While it is off, features that depend on it will not work. These are reading uploaded reports and prescriptions, and generating diet plans. AI extraction can make mistakes. Always check values against your original report. Nothing generated by the Services is a diagnosis or medical advice.

5. Who we share your data with

We share personal data only with service providers (“Data Processors”). They process it on our behalf, only to run the Services, and under contractual confidentiality and security obligations:

Labs and clinics (only if you opt in). Individual users use the Arogo app. Labs, clinics and other healthcare businesses use a separate business dashboard on arogohealth.com, and only after we have verified and approved them. If you turn on Share with labs & clinics in Settings → Privacy & Consent, an approved business can find you by your mobile number or email. It can then see your name, contact details, blood group, gender, medical conditions, allergies and your uploaded reports.

This sharing is off by default. When you turn it off, businesses can no longer find you or open your records. Once a business has viewed your data, it is responsible for that data as a Data Fiduciary in its own right.

We may also disclose personal data:

• With you, or someone you choose: for example, when you download or share a report yourself.
• When required by law: to a court, regulator or government agency that is legally entitled to request it. We disclose only what the request requires.
• In a business transfer: if Arogo is merged or acquired, your data may move to the successor. It stays protected by this policy, and we will notify you in advance.

Apart from the opt-in sharing described above, we do not give doctors, labs, clinics, insurers or employers access to your records unless you share the records with them yourself.

6. Where your data is stored

Some of our service providers store or process data on servers outside India. The DPDP Act permits such transfers, except to countries the Central Government restricts. We will comply with any such restriction. We select providers that apply security standards at least as protective as those described in this policy.

7. How long we keep your data

• While your account is active: we keep your data so the Services can show your full health history. You can delete individual items at any time.
• When you delete your account: if you delete it in the app, we immediately and permanently delete your profile, records, files and logs from our live systems, including family-member entries. If you ask by email, we do the same within 30 days. Copies in encrypted backups are overwritten in the normal backup cycle.
• Logs: as required by the DPDP Rules, we keep security and access logs for at least one year. We use them only to detect and investigate misuse or data breaches.
• Legal requirements: we keep data longer only where a law requires it, and only for that purpose.

8. How we protect your data

All data is encrypted in transit (HTTPS/TLS). Access to your records requires an authenticated session tied to your account. Uploaded files are kept in private storage and opened only through short-lived signed links. Login and OTP requests are rate-limited to prevent abuse. We restrict internal access to people who need it to run the Services.

No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India without delay, as required by the DPDP Rules. We will tell you what happened, the likely consequences, what we are doing about it, the steps you can take to protect yourself, and whom to contact.

9. Your rights

Under the DPDP Act, you have the right to:

• Access: get a summary of the personal data we hold about you, how we process it, and the providers we have shared it with.
• Correction and erasure: correct, complete or update inaccurate data, and have data erased when it is no longer needed. You can edit or delete most data directly in the app, and delete your whole account under Settings → Privacy & Consent.
• Withdraw consent: as described in Section 3.
• Grievance redressal: raise a complaint with our Grievance Officer (Section 15).
• Nominate: name a person who can exercise these rights on your behalf if you die or become unable to act.

To use any right that is not available in the app, email grievance@arogohealth.com from your registered email address, or mention your registered mobile number. We may ask you to verify your identity before acting on the request. We will respond as soon as possible, and in any case within 90 days, as required by the DPDP Rules.

10. Your duties

Under Section 15 of the DPDP Act, you must give accurate information, must not impersonate anyone, and must not file false or frivolous complaints. Add a family member's data only if they have agreed, or if you are their parent or lawful guardian.

11. Children and family members

You must be 18 or older to create an Arogo account. A parent or lawful guardian may add a child, or a person with a disability in their care, as a family member. By doing so, the parent or guardian gives consent on that person's behalf. We do not track or behaviourally monitor children, and we do not direct advertising at them. If we learn that someone under 18 has created an account without a guardian's consent, we will delete it.

12. Health Connect

With your permission, Arogo reads steps, active calories burned, sleep and resting heart rate from Health Connect. It shows them only in the app, on your device. Arogo does not write to Health Connect, and Health Connect data is not uploaded to our servers or shared with anyone. Arogo's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

13. Website storage and cookies

When you log in on arogohealth.com, we store a login token in your browser's local storage to keep you signed in. We use no advertising or third-party tracking cookies and no analytics trackers.

14. Changes to this policy

We may update this policy when our Services or the law change. For significant changes, we will notify you in the app or by email before they take effect. Where a change requires fresh consent, we will ask for it. The date at the top shows when this policy was last updated.

15. Grievance Officer and contact

For any question, request or complaint about your personal data, contact our Grievance Officer:

Kapil Dev Sharma, Grievance Officer
KASH LIFESTYLE WELLNESS LLP
6th Floor, Unit No. 603–604, Tower B, Bhutani Alphathum, Sector 90, Noida, Gautam Buddh Nagar, Uttar Pradesh – 201305
Email: grievance@arogohealth.com

We will resolve your grievance as soon as possible, and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.