Privacy Policy

1. Who We Are & How to Contact Us

unTaboo (“Company”, “we”, “us”, “our”) is a healthcare technology company registered under the Companies Act, 2013, providing a telemedicine and healthcare CRM platform that connects patients with doctors, therapists, and health coaches.

• Registered Address: House No. 4075, Sector 68 Mohali, SAS Nagar, Punjab. PIN code - 160062, India
• Data Protection Officer: [DPO Name], dpo@untaboo.com, +91 [Phone]
• Privacy Enquiries: privacy@untaboo.com
• CIN: U21003PB2024PTC060910

This Privacy Policy applies to all users of the Platform including patients, doctors, therapists, health coaches, staff, HR administrators, finance teams, and any other registered users. Different categories of data are collected depending on your role.

2. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

“Data Principal”

The individual to whom Personal Data relates — in most cases, you, the user.

“Data Fiduciary”

The Company — the entity that determines the purpose and means of processing your Personal Data.

“Personal Data”

Any data about an individual who is identifiable by or in relation to such data, including name, contact details, financial information, and health information.

“Sensitive Personal Data or Information (SPDI)”

Personal data defined as sensitive under Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including passwords, financial information, physical/physiological/mental health conditions, biometric data, and medical records.

“Protected Health Information (PHI)”

Health-related Personal Data including diagnoses, clinical notes, treatment plans, prescriptions, lab results, and session recordings that relate to the physical or mental health of an identifiable individual.

“Processing”

Any operation performed on Personal Data, including collection, storage, use, disclosure, sharing, transfer, or erasure.

“Consent”

A free, specific, informed, unconditional, and unambiguous indication of agreement to the processing of Personal Data, given through a clear affirmative action.

“Platform”

The web application, mobile application, and API services operated by the Company, including all features described in these terms.

3. Personal Data We Collect

We collect the following categories of personal data, depending on your role and how you use the Platform:

We never collect Aadhaar biometric data, and we do not store raw payment card data (card numbers, CVVs, expiry dates). All payments are processed directly by Razorpay under their PCI-DSS compliant infrastructure. We receive only a payment reference ID and status.

4. How and Why We Use Your Data — Legal Basis & Retention

Every processing activity we perform has a documented legal basis under the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (DPDP Act), and applicable sector regulations:

After the applicable retention period expires, Personal Data is securely deleted or anonymised in accordance with our Data Retention and Disposal Procedure. Anonymised, aggregated data may be retained indefinitely for research and analytics.

5. Third-Party Service Providers (Data Processors)

We share your Personal Data with the following third-party processors strictly to deliver the services you have requested. All processors are bound by data processing agreements that require them to protect your data to at least the same standard as this Policy:

We do not sell your Personal Data to any third party. We do not share your data with advertisers. We do not use your data for any purpose incompatible with the purposes for which it was collected without obtaining fresh consent.

6. Consent — Collection, Scope & Withdrawal

6.1 How We Obtain Consent

• Registration: by completing registration you consent to collection and use of identity and contact data for account management purposes.
• Clinical data: a separate, explicit consent is presented before any clinical note, diagnosis, or treatment plan is created under your profile. This consent is captured in our system and timestamped.
• Appointment recording: an additional, specific consent is displayed and recorded before any consultation recording begins. Recording does not start until consent is confirmed (/api/appointments/recording/consent/).
• Marketing: promotional communications require a separate opt-in. You will never receive marketing emails or SMS without having explicitly opted in.
• Cookies: a cookie consent banner is displayed on first use of the web application. You may accept, reject, or customise cookie preferences at any time.

6.2 Withdrawal of Consent

• You may withdraw consent for any processing activity at any time through your Account Settings > Privacy, or by emailing privacy@untaboo.com.
• Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Where processing is necessary for the performance of a contract (e.g., delivering your appointment) or required by law (e.g., retaining medical records for 7 years), we may be unable to delete the relevant data even upon withdrawal of consent. We will inform you clearly if this applies.
• Withdrawal of consent to clinical data processing may mean we are unable to provide healthcare services to you. We will notify you of this consequence before processing your withdrawal.

7. Children's Privacy

The Platform is intended for users aged 18 and above. We do not knowingly collect Personal Data from children under the age of 18 without verifiable parental or guardian consent.

Where a minor (under 18) requires healthcare services through the Platform, their account must be created and managed by a parent or legal guardian. The parent/guardian is the Data Principal for all data relating to the minor and is responsible for all consents.

If you believe we have inadvertently collected data from a child without appropriate consent, please contact us immediately at privacy@untaboo.com. We will investigate and delete such data promptly.

8. Data Security

8.1 Technical Safeguards

• Encryption at rest: all data stored on AWS RDS, S3, and EBS is encrypted using AES-256 with AWS KMS-managed keys.
• Encryption in transit: all data in transit is protected by TLS 1.2 or higher. HTTP connections are rejected.
• Access control: role-based access control (RBAC) ensures staff can only access the minimum data required for their function.
• PHI access logging: every access to clinical notes, diagnoses, and treatment plans generates an immutable audit log entry recording the user, timestamp, and patient record accessed.
• Appointment recordings: stored as encrypted chunks in AWS S3 with presigned URLs (15-minute expiry). Temporary files are deleted immediately after processing.
• JWT authentication: all API access requires a time-limited JSON Web Token (maximum 15-minute expiry) signed with an RS256 asymmetric key.
• Penetration testing: the Platform undergoes external penetration testing annually and after major releases.

8.2 Organisational Safeguards

• All staff handling PHI or SPDI complete mandatory data protection training annually.
• Access to production systems requires multi-factor authentication (MFA).
• Third-party processors undergo security due diligence before onboarding and are audited annually.
• A documented Incident Response Plan ensures breaches are contained, investigated, and notified within required timeframes.

8.3 In the Event of a Data Breach

If we suffer a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant regulatory authority (CERT-In for cyber incidents; Data Protection Board under DPDP Act) within 72 hours of becoming aware of the breach.
• Notify affected Data Principals without undue delay when the breach is likely to result in high risk to them.
• Provide clear information on: the nature of the breach, the data affected, the likely consequences, and the steps we are taking to address the breach.

To report a suspected security vulnerability, please email security@untaboo.com.

9. Cookies and Tracking

We do not use cross-site tracking cookies. We do not serve third-party advertising cookies. Analytics data is anonymised before storage.

10. International Data Transfers

We are an Indian company and our primary data centre is located in AWS ap-south-1 (Mumbai, India). Our DR data centre is in AWS ap-south-2 (Hyderabad, India). All personally identifiable data and all PHI remains within India at all times.

Limited technical data (device tokens for push notifications) is processed by Google Firebase, which may involve transfer to servers outside India. We rely on Standard Contractual Clauses and Google's Data Processing Addendum for this transfer. Notification payloads do not include Personal Data or PHI.

We will never transfer your health data, financial data, or identity data outside India without your explicit consent and appropriate legal safeguards.

11. Your Rights

Under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, you have the following rights with respect to your Personal Data:

To exercise any of the above rights, please email dpo@untaboo.com with the subject line “Data Rights Request — [Your Name]”. We will verify your identity before processing the request and respond within 30 days. Complex requests may take up to 45 days; we will notify you if additional time is required.

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India, once constituted, or approach the appropriate court of law.

12. Data Retention

We retain Personal Data only for as long as necessary for the purpose for which it was collected, or as required by law. The key retention periods are:

• Medical records (PHI): minimum 7 years from last clinical interaction, per Medical Council of India guidelines and DISHA.
• Financial records (payments, invoices, payroll): 7 years from the relevant financial year end, per Companies Act 2013 s.128 and Income Tax Act.
• Appointment and call records: 2 years.
• Marketing consent and communication records: 3 years from last interaction or consent withdrawal.
• Security and access logs: 12 months online, 7 years archived.
• Inactive accounts: if your account has had no activity for 3 consecutive years, we will notify you by email and delete the account 90 days thereafter, subject to any legal retention obligations.

Upon the expiry of the applicable retention period, your Personal Data is securely deleted or irreversibly anonymised. Deletion requests do not override legal retention obligations; we will inform you clearly if this applies to your request.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, our services, or our data practices. When we make material changes we will:

• Update the “Effective Date” at the top of this document.
• Notify registered users by email at least 30 days before the new policy takes effect.
• Display a prominent notice on the Platform.
• Where required by law, obtain fresh consent for any new processing activities.

Your continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using the Platform and may request account deletion.

14. Governing Law & Grievance Redressal

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the Digital Personal Data Protection Act, 2023; and applicable sector regulations including DISHA.

Any disputes arising out of this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of New Delhi, India.

Grievance Officer

• Name: [Grievance Officer Name]
• Email: grievance@untaboo.com
• Phone: +91 [Phone Number]

Grievances will be acknowledged within 24 hours and resolved within 30 days of receipt, as required by Rule 5(9) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

15. Document History