YOURGYNAC PRIVACY POLICY

ARTICLE 1: INTRODUCTION, PHILOSOPHY, AND APPLICABILITY

Our Commitment to Your Trust

Welcome to YourGynac ("Platform", "Company", "we", "our", or "us"). Your health data is deeply personal, and at YourGynac, protecting it is not merely a feature - it is our absolute foundation. Guided by our core philosophy, "We Don't Judge, We Heal," we have built a digital healthcare platform that empowers adult women to seek expert gynaecological teleconsultations, solutions, and education for female health-related issues, including PCOS/PCOD, urinary problems, period irregularities, pregnancy care, infertility, high-risk pregnancies, and pelvic pain. We understand that seeking care for these intimate matters requires a safe, confidential, and highly secure environment. This trust is built into how we design our products, how we make operational decisions, and how we hold ourselves legally accountable.

Scope of Applicability

This comprehensive Privacy Policy ("Policy") is the governing document that explains how we collect, use, share, disclose, and relentlessly protect the Personal Information and Sensitive Personal Data or Information of the individuals who utilize our Platform. The Platform includes our internet resource located at www.yourgynac.com (the "Website"), as well as our mobile applications, teleconsultation infrastructures, period tracking software, and related digital services (collectively, the "Services").

User Categories

The provisions of this Policy apply comprehensively to all individuals interacting with the Platform, strictly categorized as follows:

(a) End-Users: Individuals, patients, and women utilizing the Platform to track their menstrual cycles, consume health education, or seek medical guidance and teleconsultations.

(b) Practitioners: Duly registered medical experts, gynaecologists, and healthcare professionals utilizing the Platform to render medical advice, manage patient records, and conduct teleconsultations.

(c) Casual Visitors: Individuals who merely peruse the Website without registering an account or willingly submitting personal data.

(Jointly and severally referred to as "you" or "Users").

Legal Compliance Framework

This Privacy Policy is published and structured in strict compliance with the prevailing laws of the Republic of India, including but not limited to Section 43A of the Information Technology Act, 2000; Regulation 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"); the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and applicable rules; and the Telemedicine Practice Guidelines issued by the Ministry of Health and Family Welfare (MoHFW). For the purposes of the DPDP Act, YourGynac operates as the Data Fiduciary regarding the Personal Data collected.

Acceptance of Terms

By accessing the Website, downloading our applications, utilizing the Services, or otherwise providing us with your information, you are expressly acknowledging that you have read, comprehended, and agreed to the practices and policies outlined in this Privacy Policy. Your continued use of the Services signifies your unconditional consent to our collection, processing, and disclosure of your information as described herein. If you do not agree with any provision of this Policy, you are strictly advised to immediately cease all use of the Platform and the Services.

ARTICLE 2: DEFINITIONS AND CLASSIFICATIONS OF DATA

Personal Information

As defined under the SPDI Rules and the DPDP Act, "Personal Information" refers to any data or information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available to a corporate body, is capable of identifying such person. This includes, but is not limited to, your full name, demographic details, contact number, email address, and residential address.

Sensitive Personal Data or Information (SPDI)

Given the medical nature of YourGynac, the bulk of the data we process falls under SPDI. This includes passwords, financial information (such as credit/debit card details and UPI identifiers), physical, physiological, and mental health conditions, sexual orientation, medical records, diagnostic history, biometric information, and real-time consultation data. Your explicit, informed consent is required and obtained for the processing of SPDI.

ARTICLE 3: COLLECTION OF INFORMATION

Generally, some of our Services require us to accurately know who you are so that we can best meet your medical needs. When you access the Services, we ask you to voluntarily provide us with specific identifying information.

Information Collected from End-Users

To provide you with highly personalized healthcare and tracking insights, we collect identity information (name, age, date of birth, gender), contact information (mobile number, email address, emergency contacts), and extensive health information. This health information, voluntarily submitted by you, includes your menstrual cycle history, ovulation estimates, pregnancy-related records, PCOS/PCOD history, surgical history, laboratory and ultrasound reports, current medications, allergies, and symptoms such as pelvic pain. Furthermore, we collect teleconsultation data, which comprises chat transcripts, images, audio consultation records, video consultation recordings, physician notes, and issued prescriptions.

Location Information (Optional)

With your permission, and only while you are using the app, YourGynac may collect approximate or precise location information to help show nearby clinics, regional appointment options, and location-aware care features. Location access is optional. You may decline the system permission prompt or skip the in-app location information sheet and continue using the Platform. Denying location does not prevent you from using core features such as account access, period tracking, booking, or teleconsultation. You may change location permission at any time in your device Settings.

Ask Gynac (AI Health Guidance) Information

If you choose to use Ask Gynac (also called GynoAssist AI), we collect the health details you voluntarily enter in that feature, including free-text symptom descriptions, structured assessment answers, and related check-in replies. This feature is optional. Before first use, the mobile app presents an in-app consent screen that explains what data may be sent, identifies the third-party AI processor (OpenAI), and requires your explicit agreement before any AI processing occurs. If you decline consent, Ask Gynac will not process your data for AI guidance and you may continue using other Platform features.

Information Collected from Practitioners

As part of the onboarding, verification, and profile creation process, Practitioners are required to provide their name, medical registration numbers, qualifications, specializations, contact details, clinic addresses, and digital signatures. We also collect data generated during the course of their practice on the Platform, including consultation volumes, End-User feedback, software usage patterns, and appointment schedules. Practitioners agree to the use of their digital signatures strictly for issuing legally valid electronic prescriptions and clinical notes.

Information Collected from Casual Visitors

No sensitive personal data or information is automatically collected from casual visitors merely browsing the Website. However, the Platform automatically receives technical data, including the Internet Protocol (IP) address, browser type, device type, operating system, and the URL of the site from which the visitor arrived. This technical data is collected via temporary cookies and log files strictly for technical administration, security monitoring, and trend analysis.

Payment and Financial Information

For Services requiring subscription or consultation fees, YourGynac collects billing details. However, YourGynac does not permanently store complete credit card numbers, debit card numbers, or banking PINs. All financial transactions are authenticated and processed on the secure, encrypted servers of approved, RBI-compliant third-party payment gateways.

ARTICLE 4: PRIVACY BY DESIGN AND SECURITY ARCHITECTURE

At YourGynac, security is not just a policy we point to; it is hardcoded into our engineering and infrastructure. We operate on a privacy-first design philosophy to ensure your intimate health data is guarded against unauthorized access.

Encryption at Every Layer

Encryption serves as a digital safe, turning your data into unreadable code. YourGynac utilizes advanced encryption standards, specifically AES-256 for all data at rest (stored data, medical records, chat histories) and TLS 1.3 for all data in transit (active video calls, audio calls, and data uploads). These cryptographic protocols are the same rigorous standards utilized by global financial institutions and government agencies.

Strict Access Controls and Segregation

Your data is shielded by strict, role-based access controls. Only authorized YourGynac technical personnel can access the backend infrastructure, and only when strictly necessary to maintain service operability or comply with legal obligations. Your medical records, tracking data, and consultation histories are accessible exclusively to you and the specific Practitioner you have chosen to consult.

Continuous Monitoring and Independent Verification

Our dedicated security team conducts 24/7 threat monitoring using automated intrusion detection systems designed to identify potential vulnerabilities before they impact your data. We continuously subject our infrastructure to penetration testing, vulnerability assessments, and comprehensive reviews by independent third-party cybersecurity firms. We strive to align our operational protocols with globally recognized frameworks, including ISO 27001 (Information Security) and ISO 27701 (Privacy Management), setting the highest standard for femtech security in India.

ARTICLE 5: PURPOSES AND USAGE OF COLLECTED DATA

YourGynac processes your Personal Information and SPDI strictly for lawful purposes connected directly to the functions and activities of the Platform.

Healthcare Delivery and Teleconsultations

The primary use of your data is to facilitate seamless medical care. Your health records, symptom logs, and tracking data are presented to your Practitioner to ensure accurate diagnoses, personalized treatment plans, and safe prescription generation. We process video, audio, and chat communications to bridge the physical gap between you and expert gynaecologists.

Period Tracking and Predictive Analytics

For End-Users utilizing the period tracking modules, we process your logged menstrual dates, flow intensities, and mood/symptom data through our secure algorithms to predict future cycles, estimate ovulation windows, and flag potential irregularities (such as indicators of PCOS) for your medical awareness.

Ask Gynac (AI Health Guidance)

When you opt into Ask Gynac and provide in-app consent, YourGynac uses the symptom descriptions and assessment answers you enter to generate educational women’s-health guidance inside the app. Ask Gynac is not a medical diagnosis, emergency service, or substitute for a licensed clinician or teleconsultation. Processing for this feature may involve a third-party AI service as described in Article 6.

Location-Based Personalization (Optional)

If you allow location while using the app, we may use that information to personalize nearby clinic discovery and region-relevant care options. This processing is optional and occurs only when permission is granted.

Communication and Telephony Services

We use your contact information to send appointment confirmations, prescription alerts, and critical service updates. Additionally, when you utilize the 'show number' or in-app calling features to contact a Practitioner or customer support, YourGynac facilitates the call through a secure telephony service. We record these calls for quality assurance, medical record-keeping, and dispute resolution. An IVR message will explicitly notify you of this recording before the call connects.

Research, Analytics, and Business Intelligence

We reserve the right to aggregate and completely anonymize End-User demographic and health information. Once stripped of all personally identifiable markers, this anonymized data may be analyzed for epidemiological research, software utility improvement, predictive healthcare modeling, and commercial business intelligence. We may share this purely statistical, unidentifiable data with strategic partners to advance the broader field of women's health technology.

ARTICLE 6: DISCLOSURE AND SHARING OF INFORMATION

Patient confidentiality is paramount. YourGynac enforces a strict "No-Spam, No-Sale" policy. We do not sell, rent, or trade your personal or medical data to third-party marketers or advertisers under any circumstances. Information is shared only strictly on a need-to-know basis.

Sharing with Healthcare Professionals

Your health data is shared with the independent Practitioners you select for consultation. These Practitioners are bound by the ethical codes of the Indian Medical Council, strict confidentiality agreements with YourGynac, and the MoHFW Telemedicine Practice Guidelines.

Sharing with Third-Party Service Providers

To effectively operate the Platform, we engage trusted third-party contractors (such as secure cloud hosting providers, video-conferencing API providers, payment gateways, and SMS delivery services). These processors are contractually bound by rigorous Data Processing Agreements (DPAs) that prohibit them from using your Personal Information for any purpose other than providing their specialized service to YourGynac.

Sharing with Third-Party AI (OpenAI) for Ask Gynac

When you use Ask Gynac and agree to the in-app AI consent prompt, the following occurs:

• What data is sent: free-text symptom descriptions, assessment answers, and related check-in replies that you voluntarily enter in Ask Gynac.
• Who receives the data: data is transmitted to YourGynac’s servers and then processed by OpenAI (a third-party artificial intelligence service provider) solely to generate educational guidance displayed in the app.
• Permission: we obtain your explicit permission in the app before any such AI processing. Declining consent means Ask Gynac will not send your inputs for AI processing.
• Protections: OpenAI acts as a processor for this limited purpose. We do not sell Ask Gynac health inputs to OpenAI for advertising. We require that third-party processors provide contractual protections consistent with the purposes described in this Policy. You may stop using Ask Gynac at any time.

Ask Gynac guidance is educational only and is not a diagnosis or a replacement for professional medical care.

Legal and Regulatory Disclosures

YourGynac may disclose your Personal Information without prior notice if we believe such action is legally necessary to: (a) comply with a legal obligation, court order, or mandate from a law enforcement agency; (b) protect and defend the rights, property, or intellectual property of YourGynac; (c) prevent or investigate possible fraud, credit risk, or cyber-crime; or (d) protect the personal safety of Users of the Service or the general public in emergency situations.

Corporate Reorganization

In the event that YourGynac undergoes a merger, acquisition, corporate reorganization, or sale of assets, your Personal Information and medical records may be transferred to the acquiring entity. Any such successor entity will be legally bound to uphold the data protection and confidentiality standards set forth in this Privacy Policy.

ARTICLE 7: YOUR RIGHTS UNDER THE DPDP ACT

As a data principal under the Digital Personal Data Protection Act, 2023, you retain ultimate control over your information. We respect and enforce these rights for all our Users.

Right to Access and Export

You have the right to request a comprehensive summary of the personal data we process about you. Furthermore, you may export your health tracking information and consultation records directly from the application for your personal offline records or to share with external medical providers.

Right to Correction and Erasure

You are responsible for maintaining the accuracy of your profile. If your information changes or is inaccurate, you may correct it via your account settings. You also possess the right to request the permanent deletion of your account and all associated data. Upon receiving a verified deletion request, YourGynac will in due course of time securely erase your data, saving only the specific medical and transaction records we are statutorily required to maintain under Indian law.

Right to Withdraw Consent

You may withdraw your consent for the processing of your data at any time. You may withdraw location permission in your device Settings without losing access to core Platform features. You may decline or stop using Ask Gynac at any time; declining Ask Gynac AI consent does not by itself terminate your account or other Services. However, because certain Services rely fundamentally on your health data, withdrawing broader consent for health-data processing may result in the termination of your ability to use the period tracker and teleconsultation services. Withdrawal of consent does not affect the legality of data processing that occurred prior to the withdrawal.

Right to Nominate

In accordance with the DPDP Act, you have the right to nominate another individual to exercise your privacy rights on your behalf in the event of your death or medically declared incapacity. The process for nomination may be exercised by contacting the Grievance Officer at _____

ARTICLE 8: DATA RETENTION, LOCALIZATION, AND DESTRUCTION

Data Retention

YourGynac retains your Personal Information for as long as your account is active and as strictly necessary to fulfil the purposes outlined in this Policy. Specifically, clinical records, doctor notes, and prescriptions generated through the Platform are classified as electronic medical records. By law, healthcare providers and facilitating platforms must retain these medical records for a minimum statutory period of 3 years, (records may be retained longer subject to applicable laws including but not limited to MoHFW guidelines and MCI Ethics Regulations, 2002) even after an account deletion request.

Data Localization and Cross-Border Transfers

Your primary health data is securely hosted on servers located within the territory of India to ensure strict compliance with domestic data sovereignty principles. In limited circumstances, anonymized analytics data or encrypted backups may be transferred to secure servers located outside India, subject to such safeguards and in accordance with such conditions as may be prescribed under the DPDP Act. When you use Ask Gynac, symptom text and related answers you submit may be processed by OpenAI, which may process such inputs on infrastructure located outside India solely to generate the educational guidance returned to the app, subject to applicable law and contractual safeguards.

Data Destruction

Upon the expiration of the legal retention periods, or upon a valid user deletion request (where no legal retention mandate applies), your Personal Information is subjected to cryptographic erasure or irreversible anonymization, ensuring that it can never be reconstructed or traced back to you.

ARTICLE 9: COOKIES AND TRACKING TECHNOLOGIES

The YourGynac Website and mobile applications utilize temporary cookies, session trackers, and web beacons. These technologies are strictly used to authenticate your session, maintain platform security, expedite the login process, and analyze aggregated user navigation patterns to optimize our user interface. Our cookies do not silently extract external personal data from your hard drive. You maintain the right to adjust your web browser settings to refuse cookies; however, disabling critical session cookies may severely impair the functionality of the teleconsultation portal and your account dashboard.

ARTICLE 10: CHILDREN'S AND MINOR'S PRIVACY

YourGynac strongly believes in the rigorous protection of minors. The Platform, its health tracking tools, and teleconsultation services are designed, marketed, and intended exclusively for adult women who have attained eighteen (18) years of age. We do not knowingly permit minors to create accounts, nor do we knowingly collect SPDI from children. Should we discover that a minor has circumvented our age-verification protocols to submit personal data, we will execute immediate administrative action to permanently terminate the account and purge the data.

ARTICLE 11: DATA BREACH PROTOCOL

Breach Response

While we implement the industry's most rigorous security architectures, no internet-connected system is entirely infallible. In the highly unlikely event of a verified data breach compromising your unencrypted Personal Information, YourGynac has established a rapid-response protocol. We will immediately assess the severity, contain the vulnerability, and promptly notify you and the Data Protection Board of India, as mandated by the DPDP Act, providing transparent details regarding the breach and the remedial measures undertaken. For limitations on YourGynac's liability, refer to the Limitation of Liability clause in the Terms of Use.

Medical and Technical Disclaimer

YourGynac is a facilitator of digital health services. Our teleconsultation infrastructure is designed for routine gynaecological care, guidance, and tracking. IT IS NOT DESIGNED FOR, NOR SHOULD IT BE USED IN, MEDICAL EMERGENCIES. If you are experiencing a life-threatening condition, severe haemorrhaging, or an obstetric emergency, you must immediately contact local emergency services by calling 108 or 112 or visit the nearest physical hospital. Ask Gynac AI guidance is educational only and is not a diagnosis. Furthermore, YourGynac shall not be held liable for any data loss, delay, or unauthorized access resulting from circumstances entirely beyond our control, including user-side device compromises, public Wi-Fi interception, or telecommunication infrastructure failures.

ARTICLE 12: MODIFICATIONS TO THE PRIVACY POLICY

The landscape of healthcare technology, femtech privacy, and Indian jurisprudence is constantly evolving. Consequently, YourGynac reserves the unequivocal right to amend, modify, add, or delete portions of this Privacy Policy at our sole discretion, at any time. When material changes are implemented, we will revise the "Last Updated" date at the top of this document and display a prominent notification on your account dashboard or via email. Your continued utilization of the YourGynac Services subsequent to the publication of an updated Policy constitutes your binding acceptance of the revised terms.

ARTICLE 13: GRIEVANCE REDRESSAL AND CONTACT INFORMATION

Your trust requires our accountability. If you harbor any questions regarding this Privacy Policy, wish to exercise your rights under the DPDP Act, or need to report a grievance concerning the processing of your Personal Information, we have appointed a dedicated Data Protection and Grievance Officer to assist you. We commit to acknowledging your grievance swiftly and utilizing our best efforts to resolve the matter within the legally prescribed timelines.

Data Protection and Grievance Officer Details:

SCHEDULE A: INDICATIVE LIST OF INFORMATION COLLECTED BY NATURE OF SERVICE

To ensure absolute transparency, below is an exhaustive outline of the specific data points collected based on your interaction with our Platform:

Section 1: End-Users Registering for an Account

Upon creation of a patient account, the following information is collected: full legal name, active mobile number, verified email address, date of birth, age, gender, and geographic pin code. This information is processed for the purposes of account authentication, appointment booking, period tracking synchronisation, and secure storage of diagnostic records.

Section 2: End-Users Utilizing Period Tracking & Health Tools

End-Users who engage with the period tracking and health monitoring features voluntarily submit the following data: the first day of the last menstrual period, cycle length, flow volume, physical symptoms (including cramps, nausea, and pelvic pain), basal body temperature (where fertility tracking is enabled), and mood variations. This data is processed solely for the purpose of generating cycle predictions and health insights for display on the User's account dashboard.

Section 2A: End-Users Using Ask Gynac (AI Guidance)

When an End-User opts into Ask Gynac and provides in-app consent, the following information may be collected and processed: free-text symptom descriptions, structured assessment answers, and related check-in replies entered in that chat. This information is transmitted to YourGynac’s servers and processed by OpenAI to generate educational guidance displayed in the app. Use of Ask Gynac is optional and requires prior explicit permission in the mobile application. Declining consent or not using Ask Gynac does not prevent use of other Platform features.

Section 2B: Location (Optional)

If the End-User grants location permission while using the app, approximate or precise location may be collected to support nearby clinic discovery and regional care options. Location is optional; the End-User may deny or later revoke permission in device Settings and continue using the Platform.

Section 3: End-Users Engaging in Teleconsultations

Prior to and during a teleconsultation, the following information is collected: the User's chief medical complaint, historical medical records uploaded by the User, and details of current medications. During the active consultation, the Platform processes and securely stores audio and video stream parameters, chat transcripts exchanged with the Practitioner, and the resulting digital prescription and clinical notes authored by the Practitioner.

Section 4: Practitioners Registering for Empanelment

For the purposes of verification and profile listing, the following information is collected from Practitioners: legal name, personal mobile number, professional email address, Medical Council Registration Number, scanned copies of medical degrees and specialty credentials, clinic or hospital affiliations, professional photograph, and a cryptographic digital signature used exclusively for the authorisation of electronic prescriptions.

Section 5: Users Utilizing Telephony Communications

Where an End-User initiates a call via the 'Call' or 'Show Number' function to contact a Practitioner or YourGynac support, the call is routed through a masked telephony gateway. The following data is collected in connection with such calls: timestamp, call duration, and a secure audio recording of the conversation. An automated IVR message notifies the User of the recording prior to connection. These recordings are retained for the purposes of dispute resolution and quality assurance, in accordance with the security measures described in Article 4.