Privacy Policy

KS Arogya Private Limited (CIN U21001RJ2025PTC106071), a company incorporated in India with its registered office at Plot No. 2, Indira Complex, Dali Bai Mandir, Nandanwan, Jodhpur – 342008, Rajasthan, operates the VitalPoint brand (“VitalPoint”, “we”, “us”, “our”). We run VitalPoint e-clinics, the VitalPoint mobile applications (the “App”), the website www.vitalpoint.health (the “Website”) and the VitalPoint OS platform that supports them (together, the “Services”).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this Policy, and you are the Data Principal. This Policy is also published in compliance with Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

This Policy applies to:

• patients who register, book appointments or tests, or receive care through the Services, whether they use the App themselves or are registered by our clinic staff on their behalf;
• people who attend a VitalPoint health camp, screening camp or mobile medical unit;
• parents, lawful guardians and caregivers who act for a patient;
• visitors to the Website;
• registered medical practitioners on our panel, nurses, pharmacists and other personnel who use VitalPoint OS (“Professionals”) — see Section 16.

It does not apply to third-party websites or services linked from the Services, which have their own policies.

We do not store your Aadhaar number. If you create an ABHA using Aadhaar, authentication happens on ABDM and UIDAI systems. We do not collect your precise location, contacts, photos or files beyond what you actively share, and we do not use advertising identifiers.

Health data, medical records and financial information are “sensitive personal data or information” under the SPDI Rules and are handled with the additional safeguards in this Policy.

• From you, when you register, book, consult, pay or contact us.
• At our clinics, where trained staff may enter your details into VitalPoint OS for you (assisted registration) after explaining this Policy in a language you understand.
• From clinic devices, which transmit test readings directly into your record.
• From treating doctors and our pharmacist, who add notes, prescriptions and dispensing records.
• From ABDM or other providers, only when you approve the request.
• Automatically, through logs and crash reports needed to keep the Services secure and working.

We do not sell personal data. We do not show advertisements, and we never use health data for advertising, marketing profiles or data mining. We use identifiable data for research only with your separate, explicit consent; otherwise research uses anonymised data from which you cannot be identified.

Before we collect your data we give you a notice, in English or Hindi (or another language listed in the Eighth Schedule to the Constitution on request), stating what we collect, why, and how to exercise your rights. You give consent by a clear affirmative act — an in-App confirmation or a signed or recorded consent at the clinic.

You may withdraw consent at any time, as easily as you gave it, through the App, by email to privacy@vitalpoint.health, or at any VitalPoint clinic. Withdrawal stops further processing based on consent but does not affect processing already done, or records we must keep by law (Section 11). If you withdraw consent for your core health record, we may be unable to continue providing clinical services to you. Where registered Consent Managers under the DPDP Act become available, you may also use one to give, manage or withdraw consent.

When you request a consultation, VitalPoint OS offers the request to registered medical practitioners (“RMPs”) on our panel who are available for that slot. We record which doctors the request was offered to, who accepted or declined, and when. The accepting RMP’s name, qualification and registration number are shown to you before or at the start of the consultation. RMPs access your record only to treat you, only for the period of that consultation and any follow-up, and are bound by professional confidentiality under the regulations of the National Medical Commission. Every access to your record is logged.

Video consultations. Video consultations are held on Google Meet. When a consultation is confirmed, we generate a meeting link and share it with you and the RMP through the App. You do not need a Google account to join. Google processes the audio, video and meeting metadata as our service provider under its data processing terms; the content of the consultation is not stored by us. We do not switch on recording, transcription or note-taking features, and neither you nor the RMP may record the session without the consent of everyone present. Because Google operates a global network, meeting data may be processed outside India; see Section 9.

Prescriptions.Where the RMP prescribes, the prescription is created in VitalPoint OS and signed by the RMP using a digital or electronic signature that is valid under Sections 3 and 3A of the Information Technology Act, 2000. It carries the RMP’s name, qualification, registration number and the date and time of signing. We keep a tamper-evident audit trail of each prescription and any revision. You receive the prescription in the App and, at a Clinic, on paper if you ask. You are free to have it filled at any pharmacy of your choice.

What the software does not do. VitalPoint OS records and displays readings, reference ranges and your history. It does not diagnose and it does not prescribe. Every clinical decision, including whether to accept a consultation, what to prescribe and whether to refer you, is made by the treating RMP. We do not use artificial intelligence to counsel patients or to prescribe medicines, as the Telemedicine Practice Guidelines, 2020 require.

We share personal data only as needed for the purpose, and only the minimum required.

Every Data Processor is bound by a written contract requiring confidentiality, reasonable security safeguards, processing only on our instructions, and deletion or return of data when the engagement ends. We remain responsible for their processing. We do not charge or pay any commission for prescriptions or referrals.

Your health records, reports, prescriptions and account data are stored on servers located in India, hosted with Amazon Web Services (AWS) in the Mumbai region. Clinic and camp devices may hold data temporarily when connectivity is unavailable; this data is encrypted on the device and synchronised to our servers when the connection returns.

One exception applies. Video consultations run on Google Meet, and Google may route and process the live session and its metadata on servers outside India. This is permitted under Section 16 of the DPDP Act, which allows transfer to any country other than those the Central Government restricts by notification, and Google is bound by its data processing terms. No recording of the session is created or stored. If the Government restricts transfers to a country Google uses, we will move the service or stop using it.

We maintain reasonable security practices consistent with the SPDI Rules, the MoHFW Electronic Health Record Standards and the DPDP Rules, including:

• encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
• role-based access, so each staff member and doctor sees only what their role requires;
• individual logins with multi-factor authentication for staff and doctors;
• access and activity logs, retained for at least one year and maintained within India as required by the CERT-In Directions, 2022;
• encrypted, access-controlled backups;
• written confidentiality undertakings from all staff and Professionals;
• written security obligations on all Data Processors;
• periodic review of our security controls.

No system is completely secure. You help protect your account by keeping your mobile number and one-time passwords (OTPs) private and your device locked.

When a retention period ends, we delete the data or irreversibly anonymise it. Where the DPDP Rules require, we will notify you at least 48 hours before erasing data on the ground that you have not used the Services.

Subject to applicable law, you have the right to:

• Access a summary of your personal data, the processing done on it, and the identities of those we have shared it with;
• Receive a copy of your medical records, which we provide within 72 hours of a request;
• Correct, complete or update inaccurate or incomplete data;
• Erase data that is no longer needed for its purpose, unless the law requires us to keep it;
• Withdraw consent at any time (Section 6);
• Nominate another person to exercise your rights if you die or become unable to act;
• Seek grievance redressal from our Grievance Officer (Section 19), and thereafter complain to the Data Protection Board of India.

To exercise a right, use the App (Profile → Privacy), email privacy@vitalpoint.health, or visit any VitalPoint clinic. We verify your identity before acting, usually by OTP to your registered mobile number, and respond within 30 days.

Under Section 15 of the DPDP Act you also have duties: provide accurate information, do not impersonate another person, and do not file false or frivolous complaints.

You can delete your account in the App (Profile → Privacy → Delete account), through the web form at www.vitalpoint.health/delete-account, or at any clinic. Requests are reviewed and approved within 24–48 hours. Once approved, deletion removes your login, contact preferences and App profile within 30 days. Medical, pharmacy and financial records that the law requires us to keep are retained for the periods in Section 11, access-restricted, and then deleted. We will tell you what is retained and why when you request deletion.

A child is anyone under 18. A child’s account must be created and managed by a parent or lawful guardian, and we obtain verifiable consent from that person. Where the DPDP Rules permit a clinical establishment or healthcare professional to process a child’s data without such consent, we do so only to the extent necessary to provide health services to the child. For a person with a disability who has a lawful guardian, the guardian gives consent on their behalf. We never track, behaviourally monitor or direct advertising at children.

The Website uses only cookies essential for it to function and stay secure. If we introduce analytics cookies, we will ask for your consent through a cookie banner before setting them. We do not use advertising or cross-site tracking cookies. The App does not track you across other companies’ apps or websites.

For panel doctors, nurses, pharmacists and other personnel, we process name, contact details, qualifications, registration numbers with the National Medical Commission, State Medical Council, State Pharmacy Council or Nursing Council, identity and address proof, the signing credential issued to you in our admin panel to sign prescriptions electronically, bank account and tax details for payments, the Clinic or camp you are assigned to, and login, access, consultation-response and prescription audit logs.

We use this data to verify credentials against the relevant register, grant and control access, display your registration details to patients as the Telemedicine Practice Guidelines require, maintain the audit trails the law requires, allocate consultation requests, pay you, review service quality and investigate grievances. Response-time and acceptance logs are used for scheduling and quality review, and are not published. Data linked to a patient record, such as your identity on a consultation note or prescription, is retained with that record for the periods in Section 11 even after you leave the panel. Your signing credentials remain under your sole control; we never sign on your behalf.

We will post any change here with a new effective date. For material changes we will notify you in the App or by SMS at least 30 days in advance, and ask for fresh consent where the law requires.

If you have a question, request or complaint about your personal data, contact:

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

This Policy is available in English and Hindi in the App, on the Website and at every clinic. If the versions differ, the English version prevails.