Privacy Policy

Aarogya Sarathi
Version 2.0
Effective Date: July 5, 2026
Last Updated: July 5, 2026

This Privacy Policy describes how CASTLE ADVANCED TECHNOLOGIES AND SYSTEMS PVT. LTD. ("COMPANY", "we," "us," or "our") collects, uses, stores, discloses, transfers, protects, and otherwise processes personal wellness data through the Dr-T Healthcare Platform and the Aarogya Sarathi mobile application.

Aarogya Sarathi is the official mobile application of the Dr-T Healthcare Platform, developed and operated by COMPANY.

For clarity throughout this Privacy Policy:

COMPANY is the legal entity that develops, owns, and operates the relevant digital products and services.
Dr-T is the wellness and healthcare technology platform brand owned and operated by COMPANY.

This Privacy Policy is intended to support compliance with applicable legal and regulatory requirements, including the Digital Personal Data Protection Act, 2023 of India ("DPDP Act"), applicable rules framed thereunder, the Information Technology Act, 2000, generally accepted GDPR privacy principles as relevant to fair and transparent processing, and HIPAA-aligned and ISO 27001-aligned security and governance practices where applicable to the design and operation of our services.

This Privacy Policy is written in professional legal English and is intended for users, patients, caregivers, healthcare professionals, regulators, business partners and platform reviewers.

Aarogya Sarathi is a wellness and health record management application designed to help users organize health information, manage medications, monitor wellness activities, and securely maintain healthcare records.

The application is intended to support users in managing their healthcare journey and is not intended to replace professional medical advice, diagnosis, or treatment.

1. Scope of This Privacy Policy

This Privacy Policy applies to:

the Dr-T Aarogya Sarathi mobile application;
our website https://dr-t.ai to the extent it links to or supports Aarogya Sarathi;
our support resources located at https://dr-t.ai/support;
user interactions with us relating to registration, authentication, customer support, wellness tracking, health record management, medication logging, appointment support, nutrition tracking, uploaded medical documents, subscriptions, feedback, and related digital services.

This Privacy Policy applies when you:

create an account;
verify your mobile number or email address;
use patient, caregiver, or healthcare-provider linked features;
upload reports, prescriptions, scans, or other health documents;
use reminder, tracking, face scan, wearable, or connected device features;
contact support;
make payments for eligible services or subscriptions;

2. Important Identity and Ownership Statement

To ensure transparency regarding ownership and responsibility for the Platform, we expressly state the following:

COMPANY owns and operates the Dr-T Aarogya Sarathi wellness and healthcare platform.
References in this Privacy Policy to the "Platform," "Dr-T," "Aarogya Sarathi," "we," "us," or "our" refer to the services made available by or on behalf of COMPANY, unless the context expressly states otherwise.

3. What Aarogya Sarathi Is and Is Not

3.1 Nature of the service

Aarogya Sarathi is a digital healthcare and wellness support application. It is used for:

health record management;
wellness tracking;
medicine management;
medication reminders;
doctor-prescribed medication logging;
nutrition tracking;
water intake tracking;
sleep tracking;
exercise tracking;
appointment management;
uploading and organizing medical reports;
reviewing historical health information;
accessing selected connected health and wearable integrations;
obtaining wellness indicators generated through integrated third-party technology such as the CarePlix SDK.

3.2 What the application is not

Aarogya Sarathi:

is not a hospital;
is not a telemedicine provider in its own right;
is not an emergency response platform;
is not a diagnostic software product;
does not independently diagnose disease;
does not prescribe treatment;
does not replace licensed doctors or other qualified healthcare professionals;
does not provide emergency medical advice;
does not generate critical clinical decisions.

3.3 Medical disclaimer

All clinical decisions must be made by qualified healthcare professionals. Any information presented through Aarogya Sarathi is intended to support organization, tracking, communication, wellness monitoring, and user convenience. It is not a substitute for medical evaluation, diagnosis, treatment planning, or emergency intervention.

If you believe you may be experiencing a medical emergency, you must immediately contact local emergency services or a licensed medical professional and must not rely on the application for urgent care decisions.

4. Critical Health Data Source Clarification

We believe transparency is especially important in wellness and healthcare contexts. Accordingly, we clearly state that the application itself does not generate critical health information such as:

diagnoses;
prescriptions;
laboratory reports;
blood reports;
radiology reports;
clinical observations;
formal treatment orders;
discharge summaries;
physician-authored medical advice.

Such critical information comes only from:

medical documents uploaded by the user;
records provided by healthcare professionals or healthcare institutions;
doctor-prescribed medicines and related instructions;
connected health systems or external sources that the user or provider chooses to link;
third-party services operating under their own technical or legal responsibilities.

Except where expressly stated for a particular feature, Aarogya Sarathi primarily stores, organizes, displays, tracks, or transmits such information within the Dr-T ecosystem or to authorized parties.

5. Who This Privacy Policy Covers

This Privacy Policy applies to:

Individuals, care seekers and prospective Users;
family members, caregivers, and nominees who use the application lawfully;
healthcare professionals, clinics, and related staff where relevant features are used through the Aarogya Sarathi application;
visitors to our support or informational pages;
individuals whose data is submitted by an authorized user for family health management, dependent management, or care coordination, subject to applicable law.

5.1 Care seeker accounts

The application supports care seeker or personal-use accounts for individuals who use Aarogya Sarathi to manage their own health records, wellness data, nutrition logs, medications, appointments, face scan outputs, wearable integrations, and related digital health workflows.

5.2 Family members, dependents, caregivers, and nominees

The application also supports lawful use by family members, caregivers, nominees, guardians, or other authorized persons, who manage or assist with another person's profile, records, reminders, medications, documents, appointments, or consent settings.

Where one user manages another person's data, that managing user must have legal or valid authority to do so. This may include:

parental or guardian authority for minors;
lawful caregiver or family management authority;
nominee-based rights recognized by applicable law;
user-authorized profile management or record sharing;
healthcare coordination roles initiated by the relevant user or patient.

5.3 Doctors, providers, clinics, hospitals, diagnostic centers, and labs

Based on available platform features, Aarogya Sarathi may support not only patients but also healthcare-side participants, including:

individual doctors;
clinics;
hospitals;
diagnostic centers or laboratories;
provider organization administrators;
receptionists;
lab technicians;
support staff or practice team members.

Such users may interact with profile, credentialing, appointment, patient-list, prescription, note, schedule, service, fee, payment, verification, and practice-management features made available through the Dr-T Healthcare Platform.

5.4 Organization and role-based users

Some accounts may operate under role-based access arrangements, including organization, clinic, or practice-team structures. In such cases, a user's access to information may depend on:

assigned role;
organizational permissions;
patient authorization;
data-sharing settings;
operational necessity within the relevant workflow;
applicable law and platform governance rules.

6. Data Fiduciary / Controller Information

For purposes of applicable Indian privacy law, COMPANY acts as the primary entity responsible for determining the purposes and means of platform-level processing carried out through Aarogya Sarathi and the Dr-T Healthcare Platform.

Where provider-side users such as doctors, clinics, hospitals, diagnostic centers, laboratories, or other healthcare professionals create, upload, maintain, review, or disclose records in the course of their own professional activities, they may also bear independent legal and professional responsibilities for that handling under applicable law, regulatory obligations, or their own privacy terms.

Accordingly:

this Privacy Policy governs the platform-level processing carried out by or on behalf of Castle Advanced Technologies and Systems Pvt. Ltd. (COMPANY) through Aarogya Sarathi;
certain provider-generated records, disclosures, or professional workflows may also be subject to the obligations of the relevant healthcare professional or institution;
nothing in this Privacy Policy transfers clinical responsibility or professional recordkeeping responsibility away from a healthcare professional or institution where such responsibility arises independently under law. Company Name: Castle Advanced Technologies and Systems Pvt. Ltd. (COMPANY)
Application: Aarogya Sarathi
Website: https://dr-t.ai
Support Website: https://dr-t.ai/support
Support Email: info@cats-global.com
Country of Operation: India

6.1 Data Controller

COMPANY acts as the Data Controller responsible for determining the purposes and means of processing personal information collected through the Aarogya Sarathi application.

Where healthcare professionals, hospitals, laboratories, or clinics upload or manage patient records, they remain responsible for the accuracy, completeness, and legality of the information they contribute.

7. Categories of Personal Data We Process

Depending on how you use the application, we may process the following categories of data.

7.1 Account and identity data

full name;
date of birth;
age;
gender;
phone number;
email address;
user ID or patient ID;
login credentials or authentication artifacts;
device-level secure access settings such as app PIN enrollment state;
profile photos or identification attributes if voluntarily provided.

7.2 Verification and security data

OTP verification records;
mobile number verification status or email verification status;
app access PIN status;
language preference;
security setting preference;
device identifiers;
session metadata;
fraud prevention signals;
sign-in timestamps;
audit logs relating to account access and security events;
biometric-authentication enablement signals provided by your device, such as Face ID or Touch ID gating where enabled locally.

7.3 Demographic and profile data

blood group;
ethnicity, where provided;
lifestyle habit information;
family name or surname, where collected;
dietary preferences;
height;
weight;
body measurements;
activity preferences;
wellness goals;
smoking status;
self-declared health background such as diabetes, hypertension, or heart disease indicators;
cuisine preferences;
food dislikes, intolerances, or allergies;
family or dependent profile information entered by an authorized user.

7.4 Wellness and health data

medication schedules;
medicine adherence logs;
medication reminder history;
PRN or as-needed medication usage information;
prescriptions entered or uploaded by users or healthcare professionals;
provider-generated prescription records or prescription metadata, where such workflows are used;
clinical notes, visit notes, or medical notes created, viewed, or stored through supported workflows;
symptoms, notes, or self-reported wellness inputs;
water intake logs;
sleep tracking information;
exercise and activity logs;
nutrition logs;
meal information;
weight management information;
non-diagnostic wellness metrics;
health history information stored by or for the user;
appointment-related health context;
self-assessment inputs;
health assessment entries and user-added overview data;
device- or platform-imported health data such as steps, heart-related metrics, blood pressure, distance, calories burned, sleep, exercise, weight, or other supported wellness records;
connected device or wearable data, where enabled;
HealthKit or similar platform-sourced wellness data, where the user authorizes such access.

7.5 Logging / Aggregating wellness health documents and files

uploaded lab reports;
scanned prescriptions;
imaging reports;
discharge summaries;
medication photos;
food images submitted for nutrition-related analysis or logging;
provider verification documents;
clinic, facility, or practice photographs;
insurance or support documents if submitted;
file names, metadata, folders, timestamps, previews, and associated records;
document reprocessing, analysis, or classification outputs where such features are used.

7.6 Care provider, organization, and practice-management data

Where provider-facing or organization-facing features are used, we may process:

account type;
provider role;
professional biography or "about you" text;
years of experience;
languages spoken;
education records;
awards and certifications;
professional memberships;
registration or license number;
issuing authority;
registration type and expiry information;
verification type and verification status;
facility or organization name;
facility type;
established year;
number of doctors or beds, where applicable;
practice website;
organization description;
service areas;
specializations;
services offered;
consultation modes;
insurance tie-ups;
fee schedules;
working hours, break hours, or appointment duration settings;
maximum appointments per day or availability-mode data;
payment modes, UPI ID, payment link, and related business-profile payment data;
team-member and organization-staff information;
practice-profile completeness, verification, and onboarding status information.

7.7 Device, technical, and usage data

IP address;
operating system;
app version;
device model;
language and locale settings;
crash reports;
diagnostic data;
feature interaction logs;
performance analytics;
support diagnostics;
timestamp and request logs.

If enabled, we may process:

approximate or precise location data;
background location-related signals where permitted and necessary for a user-enabled feature;
Bluetooth-related connection status or nearby device interaction signals. We do not treat location access as mandatory for all users. We seek access only when relevant to a feature, workflow, or user request.

7.9 Contacts and communications data

If you grant permission, we may process:

contact selections for user-requested features;
support messages;
feedback submissions;
communication preferences;
customer-service correspondence;
appointment or reminder communications;
voice-to-text search inputs if speech recognition features are used.

7.10 Payment and subscription data

If paid services, subscription plans, or in-app billing features are used, we may process:

plan selection information;
subscription status;
billing cycle information;
transaction references;
payment status;
invoices or billing history;
limited payment-related metadata returned by payment processors.

We do not intentionally store full raw card numbers or equivalent full payment credentials unless such storage is handled by a compliant payment processor under its own secure systems and tokenization controls.

We may also process payment-adjacent information in connection with:

provider onboarding payment profiles;
UPI verification state;
medication receipts and medication cost records;
family medication spend summaries;
subscription usage or entitlement status.

7.11 Health, biometric, and other data

Because Aarogya Sarathi operates in a healthcare context, some of the data we process may be highly sensitive in practical terms, including:

health information;
medical records;
prescriptions;
document uploads containing clinical information;
wellness metrics;
certain identity verification attributes;
device-derived health data;
temporary facial scan input used for CarePlix-enabled wellness analysis.

For clarity, references in this Privacy Policy to "sensitive," "highly sensitive," or similar terms are descriptive and operational. They are intended to reflect the seriousness of healthcare, biometric-adjacent, financial, identity, and wellness data handling. They should not be read as asserting that the DPDP Act necessarily creates a separate statutory category for all such data in the same manner as older legal frameworks or other jurisdictions.

8. Data We Collect Directly from You

We collect data directly from you when you:

register for an account;
verify a phone number or email address;
complete onboarding or profile screens;
enter height, weight, blood group, or lifestyle details;
log meals, medications, water intake, sleep, or exercise;
upload medical reports or prescriptions;
scan documents;
upload provider credentials, facility photographs, clinic photographs, or related onboarding materials;
use the camera for a face scan or image capture;
request support;
submit feedback;
connect health or wearable integrations;
purchase or manage subscriptions;
add reminders, appointments, or related information;
create or edit meal logs, health-assessment inputs, self-assessment responses, medical notes, or provider-side practice information;
grant, review, edit, revoke, request, or scan consent-based sharing permissions.

9. Data We Collect Automatically

We may collect certain data automatically when you use Aarogya Sarathi, such as:

app event logs;
crash data;
device and OS information;
timestamps and session activity;
fraud and security monitoring data;
network request and service reliability data;
feature usage patterns needed to maintain, secure, and improve the application.

10. Data We Receive from Third Parties

We may receive data from third parties when necessary to provide the service you request, including:

OTP or communications service providers;
cloud hosting and storage providers;
payment processors;
healthcare professionals or clinics using Aarogya Sarathi workflows;
wearable or connected health integrations;
Apple Health / HealthKit or analogous mobile health frameworks where the user grants access;
document scanning or file-processing providers;
customer-support platforms;
the CarePlix SDK for generated wellness metrics;
health-data ecosystem providers such as Health Connect or Apple Health / HealthKit infrastructure;
appointment, prescription, clinical-note, or provider-workflow services used within the Dr-T Aarogya Sarathi application;
analytics, performance, or security service providers acting on our behalf.

11. Lawful Basis and Legal Grounds for Processing

Depending on the applicable jurisdiction and context, we process personal data on one or more of the following bases:

your consent;
performance of a contract or steps taken at your request before entering a service relationship;
compliance with legal obligations;
legitimate and proportionate business and security purposes, where permitted by law;
medical or safety-related necessity in exceptional circumstances, where allowed by applicable law;
user-directed sharing, storage, or transfer actions initiated through the application.

Under the DPDP framework, we generally rely on clear notice and consent, or lawful uses otherwise permitted by applicable law.

12. Purposes for Which We Use Personal Data

We may process personal data for the following purposes:

to create and manage user accounts;
to verify identity and contact details;
to enable secure sign-in and fraud prevention;
to support registration, onboarding, and post-onboarding profile completion for patients and provider-side users;
to provide health record management features;
to provide patient, family, dependent, and multi-profile management features;
to allow users to upload, store, organize, and retrieve documents;
to scan, preview, classify, reprocess, or otherwise manage supported documents and files;
to support medicine logging, reminders, and adherence tracking;
to support medication cost management, receipts, family medication-spend tracking, and related assistance workflows;
to enable nutrition, water, sleep, and exercise tracking;
to support patient meal logging, provider-created meal plans, nutrition goals, compliance review, and food-related analysis workflows;
to show wellness trends and summaries;
to enable authorized caregiver or dependent support workflows;
to manage appointment-related functions;
to support provider schedules, working hours, appointment-slot management, and related operational workflows;
to create, display, store, update, or share prescriptions, visit notes, medical notes, or clinical documentation where such features are enabled;
to enable connected device and wearable integrations where consented;
to generate or display face-scan-based wellness metrics through CarePlix integration;
to support consent-based data sharing, QR-based sharing flows, review and modification of access permissions, and access dashboards;
to support provider practice-profile, facility, verification, fee-schedule, payment-profile, insurance-network, media, and team-management features;
to generate summaries, reports, PDFs, exports, or dashboard views connected with supported features;
to provide customer support and respond to inquiries;
to send transactional communications such as OTPs, verification messages, reminders, service notices, and account alerts;
to process subscription and billing transactions;
to maintain audit trails, system logs, and platform integrity;
to protect users, detect misuse, and investigate security incidents;
to improve application performance, features, accessibility, and reliability;
to comply with legal, regulatory, contractual, and risk-management obligations.

12.1 User ownership of health information and records

Users retain ownership of their uploaded medical records and health information.

The Company processes such information solely to provide the services requested through the Dr-T Healthcare Platform and the Aarogya Sarathi application, including storage, organization, display, sharing under user-controlled permissions, and feature-specific processing described in this Privacy Policy.

Users can request deletion of their account and associated data, subject to applicable legal, security, accounting, fraud-prevention, clinical-record, or other retention requirements described in this Privacy Policy.

Where consent is the basis for processing, we aim to provide clear and specific notices at or before the time of collection. By choosing to proceed with a feature after being presented with the relevant notice, you consent to the processing necessary for that feature.

Examples include:

account registration and verification;
profile completion;
document upload;
provider onboarding and verification;
family or dependent profile management;
wearable integration;
HealthKit or device-health access;
notifications and reminders;
consent-based sharing and QR-based access;
face scan wellness analysis;
location or camera access.

13.2 Granular feature permissions

We aim to seek permissions in a granular way. For example, access to camera, photos, microphone, location, calendar, health data, contacts, Bluetooth, or speech recognition is requested only when relevant to the feature you choose to use, subject to your device settings and operating system controls.

When you provide contact details, you consent to receiving service-related communications reasonably necessary to operate your account or provide requested services, including OTPs, verification messages, reminder alerts, support follow-ups, billing notices, and important service announcements. These communications may be sent by SMS, phone, email, in-app notification, WhatsApp, push notification, or similar channels where permitted.

You may withdraw consent for particular processing activities at any time, subject to legal or operational limitations. Withdrawal of consent does not affect the lawfulness of processing already undertaken before withdrawal.

If you withdraw consent for a feature that depends on particular data, that feature may become unavailable or function only in a limited way.

13.5 Refusal of optional permissions

If you decline optional permissions, you may still use core parts of the application, but some feature-specific functions may not work. For example:

declining camera access may prevent face scan analysis or document capture;
declining HealthKit or wearable permissions may prevent health data import;
declining calendar access may prevent adding reminders to your device calendar;
declining microphone or speech access may prevent voice-based search or input;
declining location or Bluetooth access may limit device- or location-based features;
declining contacts access may limit selected contact-based sharing or communication workflows;
declining notification- or alarm-related permissions may limit scheduled reminders or follow-up alerts.

14. CarePlix Face Scan Technology

14.1 Dedicated integration statement

The application integrates the CarePlix SDK to support face-scan-based wellness indicators.

14.2 Role allocation

The Face Scan feature uses the device camera and CarePlix technology to generate face-scan-based wellness outputs.

Face scan processing is performed using CarePlix. In that workflow:

Aarogya Sarathi provides the interface through which you initiate the scan;
the camera is opened on your device for the scan;
temporary camera input is processed to extract signal-derived scan data needed for wellness analysis;
relevant scan-related data and associated account or session information are transmitted to COMPANY backend systems and, where required for this feature, to CarePlix for processing;
Aarogya Sarathi then retrieves, displays, and stores the resulting wellness metrics or related outputs made available through that integration.

14.3 No storage of facial photographs

We state this clearly:

facial photographs, video recordings, and raw camera-frame files from the Face Scan flow are not intended to be persistently stored as part of the user-facing health record;
the Platform may temporarily process technical scan inputs required to generate the Face Scan output;
the Platform stores or displays the resulting session records, summary metadata, wellness metrics, and linked Health Log or health-data entries made available through the Platform, subject to account settings, retention rules, and applicable law.

14.4 No diagnostic or emergency use

CarePlix-enabled outputs made available through Aarogya Sarathi are intended for wellness and informational support only. They are not intended to independently diagnose illness, prescribe treatment, or replace professional clinical assessment.

14.5 Face scan data flow

The face scan workflow may generally occur as follows:

The user chooses the face scan feature.
The device camera opens for the scan.
Temporary camera input is processed to derive the signals needed for the Face Scan analysis. No videos or photos of the user are stored during this temporary processing.
Relevant scan-related data and associated session or profile information are transmitted securely, where required, to COMPANY systems and CarePlix for processing.
CarePlix processing generates wellness metrics or related outputs.
The application stores or displays the resulting wellness metrics, summaries, session records, or linked wellness information entries needed to present the feature to the user.

14.6 User choice

Use of the face scan feature is optional. You should not use the feature if you do not consent to the temporary processing necessary to generate the wellness output.

15. Wellness, Medical Documents, Reports, Prescriptions, and Uploaded Content

15.1 User-initiated uploads

You may choose to upload documents such as:

prescriptions;
lab reports;
discharge summaries;
scans and imaging records;
nutrition or wellness records;
photos of medicines;
provider verification records;
facility or clinic photographs;
other health-related files.

15.2 Purpose of storage

We use uploaded content to:

store and organize your records;
allow retrieval and review by you;
enable document management and foldering;
support care coordination where authorized;
associate documents with your account, profile, or workflow;
allow clinicians or authorized participants to review relevant records when you choose to share them.

15.3 Document scanning, previews, folders, and reprocessing

Where supported by the application, documents may also be:

captured using a document-scanning workflow;
previewed inside the application;
assigned a user-edited file name;
placed into folders or sub-collections;
viewed later by authorized users;
reprocessed, reanalyzed, or reclassified through supported internal workflows.

Where document reprocessing or analysis is used, such processing may generate metadata, structured outputs, summaries, or feature-linked results associated with the uploaded or scanned file.

15.4 Your responsibility

You are responsible for ensuring that you have the legal authority to upload any document you submit, including data relating to another person, and that such submission complies with applicable law and any consents required from that person.

15.5 Reports, PDFs, and exports

Certain features may allow generation, rendering, or viewing of reports, summaries, PDFs, or export-like outputs, including clinical, adherence, health, or billing-related summaries. If you choose to download, export, forward, print, or otherwise share such outputs outside the application, their handling may no longer be fully controlled by COMPANY or Aarogya Sarathi.

16. Wellness, Medication, Nutrition, Wellness, and Tracking Features

Aarogya Sarathi supports users in tracking:

prescriptions and medicines;
adherence and reminder history;
medication plans and plan history;
medication receipts, cost records, and family medication-spend summaries;
food and nutrition information;
meal logs;
nutrition goals;
provider-created meal plans and nutrition calculations where such provider features are used;
water intake;
exercise activity;
sleep;
body measurements;
wellness goals;
related health routines.

These features are intended to support organization, adherence, and self-management. They do not replace direct medical supervision.

16.1 Patient and provider nutrition workflows

The Platform supports both patient-side and provider-side nutrition workflows. Depending on feature use, this includes:

food searches and catalog interactions;
meal-log entries;
food-image or food-data analysis;
nutrition preferences and macro targets;
provider-generated meal plans;
patient compliance or progress review;
nutrition summaries displayed in dashboards or reports.

16.2 Assessments, notes, and wellness entries

The Platform also supports self-assessment, health-assessment, overview data, and note-taking workflows, including user-entered wellness records, structured health data entries, and provider- or user-generated notes associated with a profile or visit.

16.3 Appointments, clinical notes, and prescriptions

The Dr-T Healthcare Platform supports appointment workflows for both patient-side and provider-side users. Depending on how the feature is used, we process:

appointment requests and bookings;
provider search or discovery inputs;
waitlist participation;
appointment status and timing information;
slot and schedule availability;
working hours and break schedules;
patient visit metadata;
clinical or medical notes;
prescription records;
prescription attachments or related documents;
medication data associated with a visit;
appointment-linked communications and reminders. Where provider-side workflows are used, records such as notes, prescriptions, schedules, and appointment details may be created, updated, reviewed, or exported by authorized healthcare-side participants according to the relevant workflow, permissions, and applicable law.

16.4 Family, dependent, caregiver, and nominee access

The Platform supports multi-profile or family-linked use cases, including management of another person's profile, documents, medications, appointments, or consent settings by an authorized user.

In such cases:

the managing user must have authority to act for the relevant individual;
access may be limited by role, age, legal relationship, nomination status, patient authorization, or feature design;
some actions may be available only to the primary user, legal guardian, or authorized representative;
access may be reviewed, changed, or withdrawn depending on the relevant feature or legal basis.

For minors, guardian or parent controls may apply. For adults, any family, caregiver, or nominee access should be understood as limited to what is lawfully authorized or user-approved.

16.5 Doctors, providers, clinics, hospitals, labs, and organization users

The Platform supports doctors and other provider-side participants, including clinics, hospitals, diagnostic centers, laboratories, reception staff, administrative users, and team members. In that context, we process provider-side information for purposes such as:

onboarding and verification;
facility and practice setup;
service listing and specialization management;
scheduling and working hours;
patient-list and patient-engagement workflows;
prescription and note creation;
fee and payment-profile management;
insurance or network profile handling;
team and staff management;
public-profile or practice-profile presentation;
ongoing compliance, support, security, and operational administration. Where provider-side users interact with patient information through authorized Dr-T workflows, such access is governed by the relevant permissions, consents, role assignments, operational settings, and applicable law.

17. Wearables, Connected Devices, and Health Platform Integrations

17.1 Optional integrations

The Platform may, with your explicit consent, import, receive, process, store, and display wellness or health-related data from:

wearable devices;
smart watches;
fitness bands;
mobile phone health frameworks;
connected wellness devices;
Apple Health / HealthKit;
Android health frameworks or equivalent ecosystems;
other approved integrations made available through Dr-T.

17.2 Types of data

Depending on the integration, this may include the following that is illustrative and not exhaustive:

steps;
activity;
energy expenditure;
sleep records;
heart-related wellness metrics;
heart rate;
blood pressure;
active calories burned;
exercise sessions;
distance;
weight;
VO2 max;
oxygen or other wellness indicators made available by the source;
body measurements;
other imported wellness records that you authorize from time to time.

17.3 User control

No wearable or mobile health ecosystem data is intentionally imported without your authorization. You may disconnect integrations through application settings, platform permissions, or device controls, subject to technical limitations.

17.4 Third-party terms

Data imported from Apple Health, HealthKit, or another ecosystem may also be subject to the privacy terms, platform rules, and permissions frameworks of that third party. We encourage you to review those terms separately.

17.5 Apple Health / HealthKit statement

Apple Health / HealthKit data is imported only after explicit user permission. Where Apple Health / HealthKit data is accessed, it is used only for features requested by the user. HealthKit data is never used for advertising.

18. Device Permissions and Why We Request Them

Depending on your device and the features you use, Aarogya Sarathi may request access to:

Camera: for face scans, food capture, medication capture, or medical document capture;
Photo Library / Storage: to upload food images, medical records, reports, or other files selected by you;
Microphone: for voice input, voice search, or other user-enabled audio features;
Speech Recognition: to convert voice into text for search or app interactions where supported;
Calendar: to add appointments or medication reminders to your calendar when you request it;
Contacts: to enable user-selected contact-based features;
Location: for selected location-based functions, if any;
Bluetooth: to connect with permitted devices or accessories;
Health Data Access: to read or write health and wellness records from authorized health platforms;
Notifications / Exact Alarm / Background Reminder Controls: to schedule and restore medication or appointment reminders and service alerts where supported by the device and operating system;
Biometric Device Authentication: to help secure access to sensitive areas of the application when enabled on your device. You may manage these permissions through your device settings. Denying access may disable the relevant feature.

19. Children and Minors

We do not knowingly process personal data of children in violation of applicable law. If Aarogya Sarathi is used by or for a minor:

the account or data submission must be handled by a parent, legal guardian, or otherwise authorized adult where required by law;
we may seek parent, guardian, or authorized-adult involvement where required or appropriate;
we may restrict, review, or suspend particular requests if we believe additional authorization is required. If you believe that a child has provided personal data inappropriately, please contact us so that we may review and take appropriate action.

The Platform may also support parent-, guardian-, or authorized adult-managed profiles for minors or dependents. In such cases, rights, access controls, correction requests, and sharing choices may be handled through the relevant authorized adult, subject to legal requirements.

Where age or guardian authorization becomes relevant, we may rely on information such as date of birth, profile details, account context, user declarations, support review, or additional verification steps that we may introduce from time to time. We do not represent that every workflow currently uses the same verification mechanism.

We do not sell personal data, including personal health data, to third parties. We may share personal data only in limited circumstances such as the following:

with service providers and processors acting on our behalf under contractual controls;
with cloud hosting, infrastructure, analytics, security, support, communication, document, or storage providers;
with payment processors for transaction handling;
with appointment, prescription, clinical-note, patient-management, document, wearable, consent, and other service providers supporting the Dr-T Healthcare Platform;
with healthcare professionals, clinics, caregivers, or family members when you authorize access or request a workflow that requires it;
with CarePlix for the face scan processing function, as necessary for that feature;
with wearable, health-data, or ecosystem partners where you connect such services;
with regulators, law enforcement, courts, or government authorities where required by law or legal process;
in connection with prevention, detection, or response to fraud, abuse, security incidents, or threats to rights, safety, or property;
in relation to a corporate transaction such as merger, restructuring, financing, acquisition, sale of assets, or transfer of business, subject to applicable confidentiality and legal safeguards.

Where the Platform offers consent-based sharing features, we may allow users to:

select an entity or recipient;
choose particular data types or categories for sharing;
grant or request access;
review access before submission;
update or edit existing access;
use QR-based or similar workflows to facilitate authorized sharing;
view sharing dashboards or recipient summaries;
revoke or limit access where the relevant workflow supports it.

The precise scope, duration, and effect of a sharing permission may depend on the feature design, recipient type, technical configuration, and legal requirements applicable to the shared data.

21. Processors, Vendors, and Third-Party Service Providers

We engage vendors and service providers to support the operation of Aarogya Sarathi. These may include providers of:

cloud hosting;
data storage;
monitoring and logging;
communications and OTP delivery;
document or file handling;
consent and access-management tooling;
appointment and scheduling support;
prescription, notes, or healthcare workflow support;
identity, people, patient, and profile-management infrastructure;
wearable or health-platform sync infrastructure;
payment and subscription infrastructure;
analytics, report-generation, or summary-generation support;
analytics and diagnostics;
subscription and billing support;
customer support tooling;
wellness or health feature integrations;
identity and security controls.

Where appropriate, such providers are bound by confidentiality obligations, data-processing restrictions, technical security requirements, or similar contractual safeguards.

22. International Transfers and Data Localization

22.1 Primary operating geography

COMPANY is based in India and Aarogya Sarathi is primarily intended for Indian healthcare and wellness use cases.

22.2 Storage and processing locations

Your data may be stored or processed in India and, where necessary for service delivery, in other jurisdictions through carefully selected service providers, subject to applicable law, contractual controls, and reasonable security measures.

22.3 Restricted transfer handling

Where personal data is transferred across borders, we seek to do so in a lawful manner, taking into account:

applicable Indian law;
governmental restrictions on transfer destinations, if any;
contractual safeguards;
necessity for service delivery;
security and confidentiality controls.

22.4 Sensitive data consideration

Because the Platform may process health-related and other sensitive information, we apply heightened review to architecture, vendor selection, access controls, and storage arrangements.

23. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and as required for service delivery, legal compliance, dispute resolution, fraud prevention, audit, security, and legitimate clinical or user record continuity where applicable.

Retention periods vary by data category. Typical examples include:

support requests: up to 180 days, unless a longer period is required for dispute resolution or compliance;
crash logs and technical diagnostic logs: up to 90 days, unless needed for active investigation;
security logs and fraud-monitoring records: up to 180 days, unless a longer period is required for incident response, audit, or legal compliance;
analytics and product-usage data: up to 12 months in identifiable or service-linked form, unless a shorter or longer period is required for legitimate operational reasons;
health records: until deleted by the user or retained as required by applicable law;
medication logs: until deleted by the user or retained as required by applicable law;
wellness metrics: until deleted by the user or retained as required by applicable law;
appointment records: until deleted by the user or retained where legally required;
medical documents: until removed by the user or retained according to applicable law;
prescriptions, notes, and visit-linked records: until deleted by the user or retained where legal, professional, or regulatory obligations apply;
provider onboarding, verification, and practice-profile records: for the duration of the provider relationship and thereafter as required for legal, security, operational, credentialing, or audit purposes;
consent records and access-sharing artifacts: for as long as needed to evidence permissions, revocations, access changes, and compliance history;
payment history and subscription records: for as long as required by tax, accounting, fraud-prevention, contractual, or legal obligations;
AI processing data: not retained after processing by the AI processing system itself, except for structured outputs required by the application;
face scan images or temporary visual inputs: not retained by COMPANY as stored face-image records;
face scan wellness metrics: stored in the user's Health Log or related health record view until deleted by the user or retained as required by applicable law.

Actual retention may vary depending on legal requirements, technical needs, dispute handling, fraud-prevention obligations, healthcare recordkeeping requirements, or other legitimate operational factors.

When data is no longer required, we delete, anonymize, de-identify, aggregate, or securely isolate it, subject to legal and technical constraints.

24. Account Deletion and Data Deletion Requests

You may request deletion of your account or specific personal data, subject to applicable law and operational necessity. Upon a valid request, we may:

delete data;
de-identify data;
retain limited records needed for legal compliance, fraud prevention, security, tax, accounting, or dispute resolution;
preserve backups for a limited period until overwritten in the ordinary course of secure systems operation.

If deletion of particular information would materially impair lawful recordkeeping, security, or service integrity, we may retain only what is strictly necessary for those purposes.

25. Security Safeguards

We implement administrative, technical, organizational, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, destruction, loss, or misuse.

These safeguards may include:

encryption in transit;
encryption at rest where appropriate;
role-based access controls;
secure authentication workflows;
audit logging;
secure software development practices;
environment segregation;
secret and credential management;
vendor security review;
periodic access review;
monitoring and incident response procedures;
backups and resilience planning.

While we seek to apply HIPAA-aligned and ISO 27001-aligned security practices where applicable, no system can guarantee absolute security. Users should also protect their devices, credentials, and access methods.

26. Incident Response and Breach Handling

If we become aware of a personal data breach affecting Aarogya Sarathi, we will investigate and take actions we consider appropriate under the circumstances, which may include:

containment;
technical remediation;
forensic review;
internal escalation;
notification to affected users where required or appropriate;
notification to regulators or authorities where legally required.

Timing, scope, and content of any notification may depend on the facts of the incident, applicable law, and law-enforcement or regulatory considerations.

27. Data Accuracy

We rely in part on the information that users choose to provide. You are responsible for ensuring that the data you submit is accurate, complete, and updated to the extent necessary for your use of the service.

If you upload inaccurate, outdated, or incomplete medical or personal information, the records displayed through the application may also be inaccurate or misleading.

28. User Rights

Subject to applicable law, you may have the right to:

obtain information about the personal data we process about you;
request access to or a summary of your personal data;
request correction, completion, or updating of inaccurate data;
request erasure of personal data in appropriate circumstances;
withdraw consent for specific processing activities;
object to or restrict certain processing, where such rights apply;
request information regarding categories of recipients with whom data has been shared;
request grievance redressal;
nominate another individual to exercise rights on your behalf in the event of death or incapacity, where applicable under Indian law.

We may need to verify your identity before fulfilling a request.

29. DPDP Rights Statement

For users in India, and subject to the DPDP Act and related rules, you may have rights as a Data Principal, including:

the right to receive clear notice;
the right to access information regarding processing;
the right to correction and erasure;
the right to grievance redressal;
the right to nominate another person to exercise your rights in certain circumstances;
the right to withdraw consent.

We will handle such requests in accordance with applicable law and our verification procedures.

Although Aarogya Sarathi is primarily operated from India, we design this Privacy Policy and related practices to reflect widely recognized GDPR privacy principles where relevant, including:

lawfulness, fairness, and transparency;
purpose limitation;
data minimization;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.

This statement does not mean that every aspect of GDPR necessarily applies in every situation, but it reflects our effort to align our data governance approach with strong international privacy expectations.

31. HIPAA-Aligned and Healthcare-Security Practices

Where applicable to our operations and vendor design, we aim to maintain security and privacy measures aligned with healthcare-sector best practices, including:

least-privilege access;
sensitive-data handling controls;
auditability;
secure storage and transmission;
incident response readiness;
appropriate confidentiality obligations for personnel and vendors.

This statement means our practices are designed with healthcare sensitivity in mind. It should not be interpreted as a representation that every user interaction or integration constitutes a regulated HIPAA-covered transaction or that COMPANY is necessarily a covered entity or business associate in every context.

32. AI-, Analytics-, and Feature-Improvement Processing

Some application functions may involve automated processing, analytics, or AI-assisted functionality for organizing, presenting, summarizing, or interpreting user-provided or device-provided information. Such processing is used to:

improve usability;
generate wellness summaries or insights;
extract structured information from uploaded medical documents;
support document understanding and health parameter extraction;
provide chat assistance;
provide wellness guidance;
support daily activity tracking;
provide medication assistance;
provide nutrition assistance;
provide appointment support;
provide reminder support;
support food or document analysis workflows where applicable;
support chat-based, message-based, or content-based analysis workflows where applicable;
assist in structuring or presenting uploaded document information;
strengthen security and reliability;
support internal debugging and quality improvement.

AI processing is transient and is used only to provide the requested application feature or structured result.

AI systems do not permanently retain uploaded content after processing. AI systems do not use customer information for model training. Uploaded medical reports are not retained by AI systems after processing.

Only the structured outputs, extracted parameters, summaries, or feature-linked results required by the application are stored in the user's Health Log, health record view, or other relevant feature context.

Unless expressly stated otherwise in a feature-specific notice, such processing is not intended to replace licensed medical judgment.

33. Communications, Notifications, and Support

We may contact you for:

authentication and security;
OTP verification;
onboarding completion;
reminder functionality;
appointment or medication notifications;
consent-sharing and access-change notifications where relevant;
provider onboarding, verification, practice-profile, or operational follow-ups where relevant;
subscription and billing notices;
support responses;
policy or service changes;
legal or safety notices.

You may be able to manage some communication preferences in-app or via device settings. However, essential transactional and security communications are generally not optional while you maintain an active account using those services.

34. Cookies and Similar Technologies

Where our websites or support pages use cookies, SDKs, pixels, or similar technologies, such technologies may help:

maintain sessions;
improve website functionality;
analyze usage;
enhance security;
support customer service.

Any web-specific cookie notice or banner on our website may supplement this Privacy Policy.

35. Third-Party Links and External Services

Aarogya Sarathi, Dr-T, or our support resources may contain links to third-party websites, services, healthcare providers, device ecosystems, or support tools. We are not responsible for the privacy practices of third parties acting under their own terms and policies.

We encourage you to review the privacy policies of any third-party service you choose to use.

36. Transparency and Privacy Commitment

COMPANY is committed to maintaining transparency in the collection, use, storage, sharing, and protection of personal information processed through the Dr-T Healthcare Platform and the Aarogya Sarathi application.

We follow the principles of privacy by design, data minimization, security by design, and responsible handling of health information while complying with applicable laws.

37. Grievance Redressal

If you have a question, complaint, or grievance about this Privacy Policy or our handling of personal data, you may contact us at:

Grievance Officer
Name: Milind Joshi
Designation: Grievance Officer
Email: m.joshi@cats-global.com

Support / Privacy Contact
Email: info@cats-global.com
Website: https://dr-t.ai/support

We will make reasonable efforts to acknowledge and address grievances within a commercially reasonable timeframe and in accordance with applicable law.

38. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect:

changes in law or regulation;
product updates;
new integrations;
updated security practices;
operational changes. If we make material changes, we may notify you through the application, website, email, or another appropriate method. Your continued use of Aarogya Sarathi after an updated Privacy Policy becomes effective will be subject to the revised version, to the extent permitted by law.

39. Contact Us

If you have questions about this Privacy Policy or Aarogya Sarathi's privacy practices, you may contact:

Castle Advanced Technologies and Systems Pvt. Ltd.
Application: Aarogya Sarathi
Website: https://dr-t.ai Support: https://dr-t.ai/support Email: info@cats-global.com

40. Short-Form Transparency Summary

For convenience only, and without limiting the full legal effect of the detailed provisions above:

Aarogya Sarathi is the official mobile application developed and operated by COMPANY.
The app supports patient, family/dependent, and provider-side healthcare workflows, including records, documents, medications, appointments, nutrition, consent-based sharing, wearables, and practice-related features.
The app is not a hospital, not an emergency platform, not a diagnostic engine, and not a substitute for licensed medical care.
Critical medical information shown in the app generally comes from user uploads, healthcare providers, connected systems, or third-party integrations, not from independent clinical diagnosis by the app itself.
CarePlix-powered face scan processing is used for wellness metrics; raw camera-frame files are not intended to be persistently stored as part of the user-facing health record, while resulting wellness metrics, summaries, and related session records may be stored.
We use permissions such as camera, photos, calendar, health data, Bluetooth, microphone, notifications, and location only for relevant user-enabled features.
Users may contact info@cats-global.com for privacy-related questions or grievances.

By creating an account, using Aarogya Sarathi, uploading information, enabling permissions, or continuing to interact with the Dr-T Healthcare Platform through the Aarogya Sarathi application, you acknowledge that you have had an opportunity to review this Privacy Policy.