PRIVACY POLICY

1. INTRODUCTION

Welcome to [INSERT LEGAL ENTITY NAME], a company incorporated under the Companies Act, 2013, operating under the brand "Aarog Health Records" ("Aarog", "Company", "we", "our", "us"). Aarog is a secure digital health record management platform designed to enable individuals and families to securely store, organize, manage, retrieve and share their healthcare records whenever required.

Your privacy is extremely important to us. Medical records are among the most confidential forms of personal information. Aarog is committed to maintaining the confidentiality, integrity and security of your Personal Data and Health Data while complying with all applicable laws of India.

This Privacy Policy explains:

• what information we collect;
• why we collect it;
• how we use it;
• how we protect it;
• who we may share it with;
• how long we retain it; and
• the rights available to you regarding your Personal Data.

This Privacy Policy forms an integral part of the Aarog Terms & Conditions and applies whenever you access or use our Website, Mobile Application, APIs, products or services.

2. LEGAL COMPLIANCE

This Privacy Policy has been prepared considering, among other applicable laws:

• Digital Personal Data Protection Act, 2023 (India)
• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules
• Applicable CERT-In Directions
• Google Play User Data Policy
• Apple App Store Privacy Requirements

If any applicable law changes, Aarog reserves the right to modify this Privacy Policy accordingly.

3. IMPORTANT DISCLAIMER

PLEASE READ THIS CAREFULLY.

Aarog is NOT

• a hospital;
• a clinic;
• a laboratory;
• a pharmacy;
• an insurance company;
• a telemedicine platform;
• a healthcare provider;
• a medical practitioner;
• a diagnostic centre.

Aarog DOES NOT

• diagnose diseases;
• prescribe medicines;
• provide treatment;
• interpret laboratory reports;
• provide emergency healthcare;
• replace professional medical advice.

Any healthcare decision must always be taken in consultation with a qualified medical professional.

4. DEFINITIONS

Unless the context otherwise requires, the following expressions shall have the meanings assigned below.

4.1 Aarog

"Aarog", "Company", "we", "our" or "us" means Aarog Health Records together with its affiliates, subsidiaries, successors and permitted assigns.

4.2 User

"User", "you" or "your" means any individual who accesses, browses, registers, downloads, installs or uses Aarog.

4.3 Personal Data

Personal Data means any information capable of identifying an individual directly or indirectly, including but not limited to:

• Name
• Mobile Number
• Email Address
• Date of Birth
• Gender
• Address
• Government Identification (if voluntarily provided)
• Profile Photograph
• Emergency Contact
• Device Identifiers
• IP Address
• Login Credentials

4.4 Health Data

Health Data means all information relating to the physical, mental or medical condition of a User including but not limited to:

• Medical Reports
• Laboratory Reports
• Diagnostic Reports
• Radiology Images
• Prescriptions
• OPD Records
• IPD Records
• Hospital Discharge Summaries
• Vaccination Records
• Medical Certificates
• Allergies
• Chronic Diseases
• Surgical History
• Medication History
• Doctor Notes
• Vital Signs
• Blood Pressure
• Blood Sugar
• Pulse Rate
• Weight
• Height
• BMI
• ECG Reports
• X-Ray Reports
• MRI Reports
• CT Scan Reports
• Ultrasound Reports
• Any other healthcare document uploaded by the User.

4.5 Family Member

Family Member means any person whose records are managed by the User through Aarog, including:

• Spouse
• Children
• Parents
• Grandparents
• Dependents
• Any other individual whom the User is legally authorised to manage.

4.6 Services

Services include every feature offered by Aarog including but not limited to:

• Digital Health Record Storage
• Medical Report Upload
• Health Record Organization
• Medical Document Retrieval
• Secure Sharing
• Family Health Management
• Health Timeline
• Health Reminders
• AI-powered categorization (where applicable)
• Future services introduced by Aarog.

4.7 Processing

Processing means any operation performed on Personal Data including:

• Collection
• Recording
• Storage
• Upload
• Retrieval
• Organisation
• Classification
• Viewing
• Encryption
• Backup
• Sharing
• Deletion
• Destruction

whether performed manually or electronically.

4.8 Device

Device means any smartphone, tablet, desktop, laptop, wearable or internet-enabled device through which Aarog is accessed.

4.9 Applicable Law

Applicable Law means every law, rule, regulation, notification, circular, governmental order or judicial decision applicable to Aarog from time to time.

5. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to:

• Aarog Mobile Applications
• Aarog Website
• Web Portal
• APIs
• Customer Support
• Future Aarog Services
• All Users located in India and other jurisdictions where Aarog is made available.

This Privacy Policy applies whether you:

• browse;
• register;
• create an account;
• upload documents;
• access records;
• manage family profiles; or
• otherwise interact with Aarog.

6. ACCEPTANCE OF THIS PRIVACY POLICY

By accessing or using Aarog, you acknowledge that:

• You have read this Privacy Policy.
• You understand this Privacy Policy.
• You voluntarily agree to this Privacy Policy.
• You consent to the collection, storage, processing and use of your Personal Data in accordance with this Privacy Policy.

If you do not agree, you must immediately discontinue use of Aarog.

7. USER CONSENT

You expressly consent to Aarog collecting, storing, processing, transferring and using your Personal Data and Health Data for providing the Services.

Your consent includes consent for:

• storing uploaded reports;
• organizing reports;
• encrypting reports;
• generating timelines;
• creating reminders;
• maintaining family profiles;
• providing customer support;
• improving security;
• preventing fraud;
• complying with legal obligations.

Consent may be withdrawn at any time by following the account deletion or data withdrawal procedures provided by Aarog, subject to applicable legal or regulatory retention requirements.

8. AGE REQUIREMENT

Aarog is intended for users who are legally competent to enter into a binding agreement under applicable law.

Users below the age of 18 years may use Aarog only through a parent or lawful guardian, who represents and warrants that they are authorized to create, manage, and control such account and any related Health Data.

9. INFORMATION WE COLLECT

Depending upon your use of Aarog, we may collect the following categories of information.

A. Information Provided by You

• Full Name
• Mobile Number
• Email Address
• Password (stored securely in encrypted/hashed form where applicable)
• Date of Birth
• Gender
• Blood Group
• Address
• Emergency Contact
• Family Member Details
• Profile Photograph
• Medical History
• Uploaded Health Records
• Notes entered by the User
• Health Reminders
• Communication Preferences
• Feedback, support requests, and other information voluntarily submitted by you.

B. Health Information Uploaded by You

You may choose to upload:

• Prescriptions
• Laboratory Reports
• Diagnostic Reports
• Hospital Bills
• Discharge Summaries
• Insurance Documents
• Vaccination Certificates
• Medical Certificates
• X-rays
• MRI Reports
• CT Scans
• ECG Reports
• Ultrasound Reports
• Any other healthcare documents that you voluntarily choose to upload.

You acknowledge that you are solely responsible for the accuracy, completeness, authenticity, and legality of the information you upload.

C. Information Collected Automatically

When you use Aarog, we may automatically collect technical information including:

• Device model
• Device operating system
• Browser type
• Application version
• IP address
• Device identifiers
• Crash logs
• Error reports
• Date and time of access
• Session duration
• Security logs
• Authentication logs
• Network information
• General location derived from IP address (where necessary for security or legal compliance).

This information helps us secure the platform, improve performance, investigate fraud, and maintain service reliability.

10. PROCESSING OF HEALTH DATA

10.1 Nature of Health Data

The Company recognizes that Health Data constitutes highly confidential and sensitive personal information requiring enhanced safeguards.

Health Data processed through Aarog may include, without limitation:

• Medical reports
• Diagnostic reports
• Laboratory reports
• Radiology reports
• Prescriptions
• Hospital records
• Discharge summaries
• Vaccination records
• Surgical history
• Medication history
• Allergy information
• Chronic disease information
• Medical images
• Health certificates
• Health reminders
• Health notes created by the User
• Any other health-related information voluntarily uploaded or entered by the User.

The Company shall process such information only for the purposes specified in this Privacy Policy or as otherwise authorized by the User or required by Applicable Law.

10.2 Voluntary Submission

The User acknowledges and agrees that uploading Health Data to Aarog is entirely voluntary.

The Company does not compel any User to upload any health-related information.

The User remains solely responsible for determining which information to upload, retain, share, modify, or delete.

10.3 Ownership of Health Records

All medical records, reports, prescriptions, healthcare documents, images, certificates, and other health information uploaded to Aarog shall remain the exclusive property of the User or the person lawfully entitled to such information.

Nothing contained in this Privacy Policy shall be construed as transferring ownership of any Health Data to Aarog.

Aarog receives only a limited, revocable, non-exclusive authorization to store, organize, encrypt, retrieve, display, and process such Health Data solely for providing the Services.

10.4 No Medical Review

Unless specifically stated otherwise within the Services, Aarog does not review, verify, validate, certify, interpret, or medically evaluate any report or document uploaded by Users.

The Company assumes no responsibility for:

• incorrect reports;
• forged reports;
• altered reports;
• outdated reports;
• incomplete reports;
• duplicate reports;
• illegible documents; or
• inaccurate medical information uploaded by Users.

10.5 User Responsibility

The User represents and warrants that:

• all uploaded documents belong to the User or are uploaded with lawful authority;
• uploaded information does not violate any law;
• uploaded documents do not infringe any third-party rights;
• the information is accurate to the best of the User's knowledge.

The Company shall not be liable for any consequences arising from incorrect or misleading information uploaded by the User.

11. FAMILY ACCOUNTS AND DEPENDENT PROFILES

11.1 Family Health Management

Aarog permits Users to maintain health records for eligible Family Members for convenience and continuity of care.

Such Family Members may include:

• spouse;
• children;
• parents;
• grandparents;
• dependents;
• legal wards;
• persons for whom the User possesses lawful authority.

11.2 User Representation

The User represents and warrants that they possess all necessary legal authority, consent, or authorization to upload, manage, process, and share Health Data relating to any Family Member.

Where legally required, the User shall obtain valid consent from such Family Member before uploading any Personal Data or Health Data.

11.3 Minor Children

Where the Family Member is below the age of eighteen (18) years, the parent or lawful guardian shall be solely responsible for:

• creating the profile;
• managing records;
• granting consent;
• exercising privacy rights;
• requesting deletion;
• sharing records.

Upon attaining the age of majority, Aarog may require independent verification or consent before continued processing.

11.4 Elderly and Dependent Individuals

Where Users manage records for elderly parents, guardians, or dependents, Aarog relies upon the User's representation that appropriate authorization has been obtained.

The Company shall not independently verify guardianship or legal authority unless required by Applicable Law.

11.5 Revocation of Authority

If any Family Member withdraws authorization or disputes the User's authority, Aarog reserves the right to suspend access to the relevant profile until the matter is resolved to the satisfaction of the Company.

12. PURPOSE OF PROCESSING PERSONAL DATA

The Company processes Personal Data and Health Data solely for legitimate business and service-related purposes.

These purposes include, but are not limited to:

12.1 Account Management

• account registration;
• authentication;
• login security;
• password recovery;
• account administration.

12.2 Health Record Management

• secure storage;
• organization;
• indexing;
• categorization;
• retrieval;
• search;
• document viewing;
• secure sharing as instructed by the User.

12.3 Family Health Management

To facilitate centralized management of health records belonging to authorized Family Members.

12.4 Health Timeline

To organize medical history chronologically for the User's convenience.

12.5 Reminders

To provide reminders relating to:

• medicines;
• appointments;
• vaccinations;
• health checkups;
• follow-up consultations;
• document expiry;
• health monitoring activities.

Such reminders are informational only and do not constitute medical advice.

12.6 Customer Support

To respond to:

• support requests;
• complaints;
• technical issues;
• account recovery requests;
• security concerns.

12.7 Fraud Prevention

To detect, investigate, and prevent:

• fraudulent accounts;
• unauthorized access;
• impersonation;
• cyber incidents;
• misuse of Services.

12.8 Legal Compliance

To comply with:

• court orders;
• government directions;
• regulatory obligations;
• law enforcement requests;
• Applicable Law.

12.9 Service Improvement

To improve:

• user experience;
• application performance;
• security;
• reliability;
• system stability;
• future features.

Where feasible, analytics may be performed using aggregated or de-identified information.

12.10 Future Features

Where the User expressly consents, Aarog may process Health Data for additional features such as:

• intelligent document organization;
• automated categorization;
• duplicate detection;
• health timeline generation;
• AI-assisted document summaries;
• future wellness tools.

Any such features shall be informational only unless explicitly stated otherwise.

13. DATA SECURITY

13.1 Security Commitment

Protecting Health Data is a fundamental responsibility of Aarog.

The Company implements administrative, technical, physical, and organizational safeguards designed to protect Personal Data against:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• destruction;
• accidental loss;
• cyber threats.

13.2 Security Measures

Subject to evolving technology, Aarog may implement:

• encryption during transmission;
• encryption at rest;
• secure authentication;
• access controls;
• role-based permissions;
• audit logging;
• activity monitoring;
• firewall protection;
• malware protection;
• vulnerability assessments;
• secure cloud infrastructure;
• backup and disaster recovery mechanisms;
• multi-factor authentication (where available);
• periodic security reviews.

The Company may enhance or modify such measures from time to time without prior notice.

13.3 Password Security

Users are solely responsible for:

• maintaining password confidentiality;
• safeguarding OTPs;
• securing registered mobile numbers;
• preventing unauthorized device access.

The Company shall not be liable for losses arising from:

• password disclosure;
• OTP sharing;
• compromised devices;
• user negligence.

13.4 Device Security

Users are responsible for ensuring that devices used to access Aarog are reasonably secure.

The Company strongly recommends that Users:

• enable screen lock;
• use biometric authentication where available;
• install operating system updates;
• avoid rooted or jailbroken devices;
• avoid using public devices for accessing Health Data.

13.5 Data Transmission

While Aarog employs industry-standard encryption and security practices, no method of electronic transmission or storage can be guaranteed to be completely secure.

Accordingly, the Company does not warrant that unauthorized access, cyberattacks, or security breaches can never occur despite reasonable safeguards.

13.6 Security Incident Response

In the event of a suspected or confirmed security incident affecting Personal Data, the Company may take such actions as it deems appropriate, including:

• investigation;
• containment;
• suspension of affected accounts;
• password resets;
• restoration from backups;
• notifications where required under Applicable Law.

13.7 User Cooperation

Users agree to immediately notify Aarog if they become aware of:

• unauthorized account access;
• credential compromise;
• suspected misuse;
• fraudulent activity;
• accidental disclosure of Health Data.

Failure to promptly notify the Company may affect its ability to mitigate the impact of such incidents.

14. DATA SHARING AND DISCLOSURE

14.1 Our Commitment

Your medical records belong to you.

Aarog does not sell, rent, trade, license, or commercially exploit your Personal Data or Health Data.

Your Health Data will never be sold to advertisers, insurance companies, pharmaceutical companies, marketing agencies, or data brokers.

14.2 Sharing Only with Your Authorization

Except as expressly stated in this Privacy Policy or required by law, Aarog will share your Health Data only upon your explicit authorization.

Examples include:

• Sharing a prescription with a doctor.
• Sharing laboratory reports with a hospital.
• Sharing vaccination certificates.
• Sharing reports with a family member.
• Exporting reports to another healthcare provider.
• Downloading your own records.

You control:

• what is shared;
• with whom it is shared;
• for how long it is shared (where technically supported); and
• when access may be revoked.

14.3 Service Providers

Aarog may engage trusted third-party service providers to support its operations. These providers may process Personal Data strictly on Aarog's behalf and only to the extent necessary to perform contracted services.

Such providers may include:

• Cloud hosting providers
• Data storage providers
• Content delivery networks (CDNs)
• Authentication and identity verification providers
• SMS and OTP service providers
• Email delivery providers
• Push notification providers
• Customer support platforms
• Analytics providers
• Crash reporting services
• Payment gateway providers (if subscriptions are introduced)
• Cybersecurity and fraud detection vendors
• Backup and disaster recovery providers

All such providers are contractually required to implement appropriate confidentiality and security measures.

14.4 Legal and Regulatory Disclosures

Aarog may disclose Personal Data or Health Data where required by applicable law or where disclosure is reasonably necessary to:

• comply with court orders, warrants, subpoenas, or legal processes;
• respond to lawful requests from government authorities;
• comply with regulatory obligations;
• prevent fraud or cybercrime;
• investigate security incidents;
• protect the rights, property, or safety of Aarog, its users, or the public;
• enforce the Terms & Conditions or other agreements.

Where legally permissible, Aarog may notify the affected User before making such disclosure.

14.5 Business Transfers

If Aarog undergoes a merger, acquisition, restructuring, investment, sale of assets, or similar corporate transaction, Personal Data may be transferred as part of the transaction, subject to applicable law and appropriate confidentiality obligations.

The acquiring entity shall continue to process such data in accordance with this Privacy Policy or a policy providing substantially equivalent protection.

14.6 Aggregated and De-identified Information

Aarog may use aggregated, anonymized, or de-identified information for purposes such as:

• improving platform performance;
• research and analytics;
• product development;
• statistical reporting; and
• service optimization.

Such information will not reasonably identify any individual.

15. USER RIGHTS

Subject to applicable law, you may exercise the following rights regarding your Personal Data.

15.1 Right to Access

You may request access to the Personal Data and Health Data associated with your Aarog account.

15.2 Right to Correction

You may correct inaccurate or incomplete Personal Data maintained by Aarog.

15.3 Right to Update

You may update your profile information, contact details, and other account information through the application or by contacting Aarog support.

15.4 Right to Download

Where technically feasible, Aarog may provide functionality enabling Users to download or export their Health Records in commonly used electronic formats.

15.5 Right to Delete

You may request deletion of your account and associated Personal Data, subject to:

• legal retention obligations;
• fraud prevention requirements;
• security investigations;
• pending disputes; or
• other lawful grounds for retention.

Deletion requests shall be processed within a reasonable period, subject to verification of identity.

15.6 Right to Withdraw Consent

You may withdraw consent for future processing of your Personal Data by discontinuing use of the Services or submitting a withdrawal request.

Withdrawal of consent shall not affect processing already carried out lawfully before such withdrawal.

Certain Services may no longer be available after consent is withdrawn.

15.7 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you may contact Aarog’s Grievance Officer using the contact details provided in this Privacy Policy.

You may also exercise any rights available under applicable law before the appropriate regulatory authority.

16. DATA RETENTION

16.1 General Principle

Aarog retains Personal Data and Health Data only for as long as reasonably necessary to:

• provide the Services;
• comply with legal obligations;
• resolve disputes;
• enforce agreements;
• maintain system integrity; and
• protect against fraud and misuse.

16.2 User-Controlled Records

Medical records uploaded by Users will generally remain available until:

• deleted by the User;
• removed following account deletion;
• retained pursuant to legal obligations; or
• otherwise required for legitimate business or security purposes.

16.3 Backup Copies

For operational resilience and disaster recovery, encrypted backup copies may continue to exist for a limited period after deletion requests.

Such backup copies are retained solely for recovery and security purposes and are securely deleted in accordance with Aarog’s Data Retention Policy.

16.4 Audit Logs

Security logs, authentication records, and audit trails may be retained for a longer period where reasonably necessary to:

• investigate incidents;
• detect unauthorized access;
• comply with legal obligations; or
• protect the integrity of the Services.

16.5 Permanent Deletion

Where applicable and legally permissible, Personal Data will be securely deleted or anonymized using industry-standard methods after the applicable retention period expires.

17. ACCOUNT DELETION

Users may permanently delete their Aarog account through the application or by submitting a verified deletion request.

Before deletion, Users are encouraged to download copies of their Health Records.

Account deletion may result in the permanent loss of access to:

• uploaded reports;
• reminders;
• family profiles;
• preferences; and
• other associated information.

Certain information may continue to be retained where required by law or for legitimate security purposes.

18. COOKIES AND SIMILAR TECHNOLOGIES

18.1 Cookies

Cookies are small text files stored on your device to improve functionality and user experience.

Aarog may use cookies and similar technologies on its Website and web-based services.

18.2 Types of Cookies

Aarog may use:

Essential Cookies

Required for authentication, login, account security, and core functionality.

Preference Cookies

Used to remember language preferences, accessibility settings, and other user choices.

Security Cookies

Used to detect fraudulent activity, unauthorized access, and protect user accounts.

Performance Cookies

Used to improve application performance and understand system usage.

Analytics Cookies

Used to measure usage trends, identify technical issues, and improve user experience.

Where required by law, analytics cookies will only be used after obtaining appropriate consent.

18.3 Third-Party Cookies

Certain integrated third-party services may place cookies on your device. Such cookies are governed by the respective third-party privacy policies.

Aarog does not control the practices of such third parties.

18.4 Managing Cookies

Most web browsers allow Users to:

• block cookies;
• delete cookies;
• disable cookies; or
• receive notifications before cookies are stored.

Disabling cookies may affect certain features of the Services.

19. DATA PORTABILITY

Where technically feasible and permitted by law, Aarog may provide Users with the ability to obtain copies of their Personal Data in a structured, commonly used, and machine-readable format.

20. SECURITY INCIDENTS

If Aarog becomes aware of a material security incident affecting Personal Data, it shall take reasonable steps to:

• contain the incident;
• investigate the cause;
• mitigate potential harm;
• comply with applicable legal obligations; and
• notify affected individuals or authorities where required by applicable law.

21. NO SALE OF PERSONAL DATA

Aarog does not sell Personal Data or Health Data to third parties.

Any future change to this practice shall only occur in compliance with applicable law and, where required, with your explicit consent.

22. MEDICAL DISCLAIMER

22.1 Aarog is a Technology Platform

Aarog is solely a digital technology platform designed to enable Users to securely store, organize, access, manage, retrieve, and share their health records.

Aarog is not:

• a hospital;
• a clinic;
• a nursing home;
• a pathology laboratory;
• a pharmacy;
• an insurance provider;
• a medical practitioner;
• a healthcare establishment;
• an emergency medical service; or
• a substitute for professional healthcare.

22.2 No Medical Advice

Information displayed, organized, categorized, summarized, or otherwise presented through Aarog is provided solely for informational and record-management purposes.

Nothing available through Aarog shall be construed as:

• medical advice;
• diagnosis;
• treatment;
• prescription;
• medical opinion;
• health certification;
• emergency assistance; or
• professional healthcare advice.

Users must always consult a qualified medical practitioner before making any healthcare decision.

22.3 No Doctor–Patient Relationship

Use of Aarog shall not create any:

• doctor-patient relationship;
• hospital-patient relationship;
• fiduciary healthcare relationship; or
• professional advisory relationship

between Aarog and any User.

22.4 Emergency Situations

Aarog shall not be used during medical emergencies.

If you believe you or another person is experiencing a medical emergency, immediately contact:

• local emergency services;
• the nearest hospital; or
• a licensed medical professional.

Aarog shall not be responsible for any delay in obtaining emergency medical treatment.

23. USER RESPONSIBILITY

Each User expressly represents and warrants that:

• all uploaded documents are lawfully obtained;
• all uploaded records belong to the User or the User has lawful authority to upload them;
• information uploaded is accurate to the best of the User's knowledge;
• uploaded documents do not infringe any third-party rights;
• the User has obtained all legally required consents before uploading another person's information.

Users remain solely responsible for the authenticity, legality, completeness, and accuracy of all uploaded information.

24. LIMITATION OF LIABILITY

24.1 General Limitation

To the fullest extent permitted under applicable law, Aarog, its promoters, directors, shareholders, officers, employees, consultants, licensors, affiliates, service providers, contractors, successors, and assigns shall not be liable for any direct, indirect, incidental, consequential, exemplary, punitive, special, or economic loss arising out of or in connection with:

• use or inability to use the Services;
• reliance on stored information;
• delayed access to records;
• deletion of records by the User;
• incorrect or incomplete information uploaded by Users;
• unauthorized access caused by User negligence;
• service interruptions;
• technical failures;
• software bugs;
• cyberattacks;
• viruses or malware;
• internet failures;
• telecommunications failures;
• cloud service outages;
• third-party service failures;
• force majeure events; or
• any healthcare decisions made by the User or any third party.

24.2 Medical Decisions

All medical decisions are solely the responsibility of the User and the treating healthcare professional.

Aarog shall not be responsible for:

• delayed treatment;
• incorrect diagnosis;
• incorrect prescriptions;
• medication errors;
• healthcare outcomes;
• loss of life;
• personal injury; or
• any medical consequences resulting from reliance on records stored within Aarog.

24.3 Maximum Liability

Except where prohibited by law, Aarog's total aggregate liability arising out of or relating to the Services shall not exceed:

• the total subscription fees actually paid by the User to Aarog during the twelve (12) months immediately preceding the event giving rise to the claim; or
• INR 5,000, whichever is greater.

Nothing in this Privacy Policy excludes or limits liability where such exclusion is prohibited by law.

25. DISCLAIMER OF WARRANTIES

The Services are provided on an "AS IS" and "AS AVAILABLE" basis.

Aarog expressly disclaims all warranties, whether express, implied, statutory, or otherwise, including any implied warranties of:

• merchantability;
• fitness for a particular purpose;
• uninterrupted availability;
• accuracy;
• reliability;
• compatibility;
• completeness;
• non-infringement; and
• error-free operation,

except to the extent such disclaimers are prohibited by applicable law.

26. INDEMNITY

The User agrees to defend, indemnify, and hold harmless Aarog and its affiliates, directors, officers, employees, consultants, licensors, agents, and service providers from and against any claims, losses, liabilities, damages, penalties, costs, or expenses (including reasonable legal fees) arising from or relating to:

• breach of this Privacy Policy or the Terms & Conditions;
• misuse of the Services;
• unauthorized access to another person's data;
• infringement of intellectual property rights;
• upload of false, misleading, illegal, or fraudulent content;
• violation of any applicable law;
• negligence, fraud, or wilful misconduct by the User.

27. FORCE MAJEURE

Aarog shall not be liable for any delay or failure in performing its obligations where such delay or failure results from events beyond its reasonable control, including but not limited to:

• natural disasters;
• floods;
• earthquakes;
• fires;
• epidemics or pandemics;
• war;
• terrorism;
• civil unrest;
• government restrictions;
• internet outages;
• power failures;
• cyberattacks;
• failures of cloud infrastructure or telecommunications networks.

28. CHANGES TO THIS PRIVACY POLICY

Aarog reserves the right to modify, amend, or update this Privacy Policy at any time to reflect:

• changes in applicable law;
• technological developments;
• new Services or features;
• operational requirements; or
• business needs.

Where changes are material, Aarog shall make reasonable efforts to notify Users through the Website, Mobile Application, email, or other appropriate means.

Continued use of the Services after the effective date of the revised Privacy Policy shall constitute acceptance of the updated Privacy Policy.

29. INTELLECTUAL PROPERTY

All rights, title, and interest in and to the Aarog platform, including its software, source code, databases, algorithms, trademarks, logos, designs, graphics, user interfaces, documentation, and other proprietary materials, are owned by or licensed to Aarog and are protected by applicable intellectual property laws.

Nothing in this Privacy Policy transfers ownership of Aarog's intellectual property to any User.

Users retain ownership of the medical records and other content they upload, subject to the limited rights granted to Aarog to host, process, secure, and display such content solely for providing the Services.

30. SEVERABILITY

If any provision of this Privacy Policy is held by a court or competent authority to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

31. WAIVER

Failure by Aarog to enforce any provision of this Privacy Policy shall not constitute a waiver of that provision or of any other provision.

Any waiver shall be effective only if made in writing by an authorized representative of Aarog.

32. ENTIRE AGREEMENT

This Privacy Policy, together with the Terms & Conditions and any other policies expressly incorporated by reference, constitutes the entire agreement between the User and Aarog concerning the processing of Personal Data and supersedes all prior understandings relating to the same subject matter.

33. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by and construed in accordance with the laws of India.

Subject to the arbitration provisions (if applicable in the Terms & Conditions), the courts having jurisdiction over Aarog's registered office shall have exclusive jurisdiction over disputes arising from or relating to this Privacy Policy.

34. GRIEVANCE REDRESSAL

Aarog is committed to addressing User concerns promptly and fairly.

Any complaint, request, or grievance regarding this Privacy Policy or the processing of Personal Data may be submitted to the designated Grievance Officer.

Grievance Officer

• Name: Arpan Gupta
• Email: support@aaroghealthrecords.com
• Registered Office: 206, Millenium Garden, Peer Muchalla, Zirakpur, Punjab

Aarog will acknowledge and address grievances within the timelines required under applicable law.

35. CONTACT US

For questions regarding this Privacy Policy or the Services, please contact:

Aarog Health Records

• Email: support@aaroghealthrecords.com
• Website: https://aaroghealthrecords.com

36. EFFECTIVE DATE

This Privacy Policy shall become effective on the date specified at the beginning of this document and shall remain in force until amended or replaced by Aarog.

37. ACKNOWLEDGEMENT

By creating an account, accessing, or using the Aarog platform, you acknowledge that:

• You have read and understood this Privacy Policy.
• You voluntarily consent to the collection, processing, storage, and use of your Personal Data and Health Data as described herein.
• You agree to comply with this Privacy Policy and all applicable terms governing the use of the Aarog platform.