Privacy Policy

1. ABOUT CETASIKA LIFE PVT. LTD. AND THIS POLICY

Cetasika Life Pvt. Ltd., provides a digital platform that connects CetaUsers with doctors, Healthcare service providers and wellness centers to facilitate appointment booking, video consultations, health and wellness engagement, and payout settlement services. This Privacy Policy governs the manner in which personal data and sensitive personal information is collected, handled, stored, and protected across various user categories.

For the purposes of this Policy, “Cetasika Website” refers to our public informational website accessible at www.cetasika.com, through which prospective users may learn about our services, download the Cetasika Application, and access this Privacy Policy and other policies; “Cetasika Application” refers to the Cetasika Life mobile application and its associated web-based platform through which CetaUsers, Doctors, Healthcare Service Providers and Wellness Centers register, book appointments, undertake consultations, and avail wellness services; and “Cetasika Clinic Management System” (“CMS”), accessible at cms.cetasika.com, refers to our practice and clinic management software made available to Doctors, clinics and their authorised administrative staff for maintaining patient records, scheduling appointments, generating prescriptions and invoices, and managing clinic operations. Unless the context otherwise requires, the term “Platform” as used in this Policy collectively refers to the Cetasika Website, the Cetasika Application and the Cetasika Clinic Management System.

This Policy is published and maintained in compliance with applicable Indian legal requirements such as the Information Technology Act, 2000, DPDP Act 2023 and associated rules, and is aligned to globally accepted privacy and data protection principles. It is intended to provide transparency regarding the nature, purpose, scope, handling, and protection of personal information within our ecosystem.

We do not permit registration or use of our Platform by individuals under the age of 18 years. If you are below 18, you must not register, use, or access our Platform under any circumstances.

2. TYPES OF INFORMATION WE COLLECT

We collect various categories of information depending upon whether you are a CetaUser, Doctor, Healthcare Service provider or Wellness Center. Information may be voluntarily provided by you, collected during the course of interaction with services, or gathered through permissions enabled for functionality.

You are free to not to share any medical or other information that you consider confidential and withdraw consent for us to use data that you have already provided. In the event that you refuse to share any information or withdraw consent to process information that you have previously given to us, we reserve the right to restrict or deny the provision of our services for which we consider such information to be necessary.

2.1 Information Collected from CetaUser

When a CetaUser registers and uses the Platform, we may collect information essential for identity creation, appointment booking, wellness participation, consultation services, and communication. This includes but is not limited to:

1. Account and Profile Information

• Username
• Email ID
• Mobile Number
• Password
• Profile Photograph

2. Personal and Demographic Details

• First Name, Middle Name, Last Name
• Gender
• Date of Birth
• Blood Group
• Marital Status
• Height and Weight details
• Employment Category and Optional Professional Information
• Residential Address including City, State, PIN Code
• Geographic Location if enabled by user

3. Lifestyle and Wellness Information

• Dietary Preferences
• Exercise Frequency
• Smoking and Alcohol Consumption Indicators
• Current Health Issues
• Ongoing Medications
• Previous Medications
• Additional Notes Submitted by User

This information enables appropriate functionality of the Platform, ensures meaningful engagement with healthcare professionals, and supports wellness-related services made available to you.

2.2 Information Collected from Doctors

For doctors registering on our Platform, we collect professional identity data necessary to verify Educational, Professional and Medical Practitioner credentials, build a trustworthy healthcare ecosystem, enable consultations and facilitate settlements. Information includes:

1. Account Identity Information

• Username
• Email
• Password
• Full Name
• Gender
• Medical Specialization
• Total Professional Experience
• Medical Registration Number
• License Documentation and Verification Image

2. Clinic and Professional Practice Details

• Clinic Name
• Contact Number
• Clinic Address Details
• City, Region and Postal Information

3. Qualification and Credential Verification

• Professional Qualification
• Degree Documentation
• Name of Medical College or Institution or University

4. KYC and Banking Details

• Account Holder Name
• Bank Name
• Account Number
• IFSC Code
• Account Type
• Branch Details
• Bank Passbook Front Page Image
• PAN Details
• Aadhaar Details (Front & Back)
• GST and TAN (optional where applicable)

This data is collected strictly for identity validation, professional display, payment settlements, regulatory verification, and operation of services.

2.3 Information Collected from Wellness Centers

Wellness Centers registering on the Platform are required to share organization details, verification records, and Banking details to support onboarding, listing, operational activities and payouts. This may include:

1. Account Information

• Username
• Email
• Password

2. Center Profile and Establishment Data

• Center Type
• Center Name and Description
• Name and Details of Contact Person
• Full Address Details
• Establishment Date
• Center Photographs

3. Banking and Regulatory Information

• Account Holder Name
• Bank Name
• Bank Account Number
• IFSC Code
• Bank Passbook Copy
• PAN
• Aadhaar (Front and Back)
• GST (optional)
• TAN (optional)

These details enable secure onboarding, legal compliance verification, display of genuine service providers, complaint management, and financial transactions processing.

2.4 Technical and Permission-Based Data Collection

In order to ensure optimal functionality and improved user experience, we may collect technical information and data arising from permissions granted by users. This may include the following:

• Location Data when user enables access to location services
• Camera access for document submissions, identity verification and profile updates
• Microphone access only during active video consultation sessions
• Notification access for transactional alerts, reminders and updates

We do not collect unnecessary background data, nor do we utilize advanced analytics or behavioral profiling tools for advertising targeting or promotional exploitation. Data is used solely for service delivery, operational functioning, and support-related requirements.

2.5 Information Collected through the Clinic Management System (CMS)

Doctors, clinics and their authorised administrative staff using the Cetasika Clinic Management System may input, upload and store the following categories of information in the course of managing their practice:

1. Patient Records and Clinical Information

• Patient Name, Contact Number and Address
• Medical History, Allergies, Vitals and Diagnostic Notes
• Prescriptions and Treatment Records
• Uploaded Documents and Reports

2. Appointment, Billing and Communication Data

• Appointment Scheduling and Queue Information
• Billing, Invoicing and Payment Records
• WhatsApp Number used for sending prescriptions, bills and appointment reminders

3. Staff and Access Information

• Names and Roles of Doctors, Receptionists and other Clinic Staff
• Login Credentials and Role-Based Access Records
• Activity and Audit Logs

Patient and clinical information entered into the CMS by a Doctor or clinic is provided by, and remains under the control of, that Doctor or clinic in their capacity as the treating healthcare provider. Cetasika Life processes such information solely as a service provider, on behalf of and under the instructions of the concerned Doctor or clinic, for the purpose of providing the CMS as a practice-management and hosting service.

3. PURPOSE AND USE OF INFORMATION

The information collected through our Platform is utilized exclusively to enable, support, manage, and enhance the healthcare consultation and wellness services provided.

3.1 Use of CetaUser Information

CetaUser’s information is primarily used to facilitate appointment booking, enable scheduled and real-time video consultations, process notifications related to booking and activities, and ensure accurate service delivery through associated doctors and wellness centers. We also use CetaUser details for essential communication such as alerts, confirmations, reminders, and legally required transactions.

We do not generate medical records on behalf of CetaUser, do not use CetaUser’s data for targeted promotions or marketing campaigns, and do not use CetaUser’s data for analytical profiling or behavioral tracking. Only authorized doctors, Healthcare Service Providers and Centers providing service to the specific CetaUser receive access to relevant information.

3.2 Use of Doctor Information

Doctor information is utilized for credential verification, identity validation, profile showcasing, consultation management, CetaUser interaction support, operational communication, and financial settlements. All information processed is proportionate to service delivery, regulatory validation needs and professional usage.

3.3 Use of Wellness Center Information

Wellness center information is used for onboarding authentication, legitimacy verification, service packaging, listing visibility, transactional engagement, and financial settlement processing. All usage aligns strictly with operational and compliance requirements.

3.4 Use of Information Collected through the Clinic Management System

Information collected through the CMS is used solely to enable Doctors and clinics to manage patient records, appointments, prescriptions, billing and staff operations, and to deliver related notifications including WhatsApp-based prescription, billing and appointment communications. Cetasika Life does not use patient information entered into the CMS by a Doctor or clinic for its own independent purposes, and processes such information strictly as a service provider acting on behalf of, and under the instructions of, the concerned Doctor or clinic.

4. PLATFORM PERMISSIONS AND CONTROLLED ACCESS

To provide uninterrupted service operations and ensure enhanced usability, Cetasika Life Pvt Ltd requires certain controlled permissions which operate transparently and strictly under consent-based enablement.

5. DATA SHARING AND DISCLOSURE

We ensure that data sharing is extremely restricted, purpose-driven and conducted under strict confidentiality obligations. Data is never disclosed for commercial exploitation or unauthorized third-party benefit.

Information may be shared under the following conditions only:

• With consulting doctors for delivery of healthcare consultation limited to that specific CetaUser
• With wellness centers solely for enabling booked services
• With cloud infrastructure providers such as Amazon Web Services (AWS) purely for data hosting
• With affiliates, associates, holding, subsidiary company or such entity involved in provisions of Cetasika product and services, to the extent permitted by applicable law.
• With WhatsApp Business messaging services solely for delivering prescriptions, bills, appointment confirmations and reminders on behalf of Doctors and clinics using the Clinic Management System
• With legal and regulatory authorities including investigation agencies and courts strictly when required by applicable law or under enforceable governmental directive

We do not sell or commercially trade user information, do not engage in advertising-based data monetization and do not provide data access to marketing or third-party advertising networks.

6. PAYMENTS AND FINANCIAL INFORMATION

Payment transactions on Cetasika Life are facilitated through third-party compliant payment gateways. CetaUser payment collections (pay-ins) are conducted through Razorpay wherein we do not store any payment card information. For settlement payouts to doctors and wellness centers, bank information is securely retained and processed through Cashfree. All banking information stored is encrypted and processed securely following industry compliance and data security standards.

7. DATA STORAGE, SECURITY AND PROTECTION

All user information is stored on secure cloud infrastructure managed through Amazon Web Services located in Asia Pacific (Mumbai) regional servers utilizing highly resilient storage environments such as AWS S3, AWS RDS. We maintain comprehensive security mechanisms including encryption at rest, encryption in transit with TLS/HTTPS protocols, structured role-based access controls, OTP verification processes and limited employee access governed strictly on need-to-access principles.

Access to user personal and sensitive information is restricted only to authorized personnel with legitimate operational requirements under confidentiality and security monitoring protocol.

8. TERMS & CONDITIONS

Refer to Terms & Conditions

9. USER RIGHTS AND CONTROL

Users can update their profile details for certain fields on request only. The users can manage information visibility, delete health and wellness records, and delete their account permanently from the Platform. Currently, Cetasika Life does not support downloadable data extraction requests.

10. CHILDREN AND MINOR USAGE POLICY

Use of Cetasika Life is strictly restricted to individuals aged 18 years and above. Any user identified as minor or reported to be under 18 will be removed and prohibited from platform access.

11. DATA SECURITY AND DATA RETENTION

Data Backup, Storage and Recovery Overview

This Data Security and Data Retention Policy applies across the Cetasika Website, the Cetasika Application and the Cetasika Clinic Management System (“CMS”) (each as defined in the Cetasika Life Privacy Policy, and collectively the “Platform”). References to “application data” and “the platform” in this Policy accordingly include data generated, uploaded or stored through the CMS by Doctors, clinics and their authorized staff, including patient records, appointment, billing and staff-access data.

Cetasika Life Pvt Ltd maintains a structured and secure data backup mechanism to ensure availability, integrity, and protection of application data. All production data, including application databases hosted on AWS RDS PostgreSQL, file storage and media stored in AWS S3, and required system logs and configurations, are backed up automatically using AWS-managed services. The platform follows a daily backup strategy where one snapshot is taken every 24 hours. The first snapshot is a full backup, and subsequent backups are incremental in nature, ensuring efficient storage utilization while preserving data consistency. All backups are stored securely in AWS S3 within the ap-south-1 (Mumbai) region, with no secondary or offsite replication configured at this stage. Backup data is retained for 7 days, after which older snapshots are automatically deleted as part of the rotation policy, and no long-term archival is currently maintained.

All backup data is protected using encryption at rest through AWS-managed encryption mechanisms, including server-side encryption (SSE) for S3 and managed encryption for RDS databases. Access to backups is strictly controlled through AWS Identity and Access Management (IAM), and backup processes are continuously monitored by AWS. In the event of any backup failure, automated alerts are triggered via AWS SNS notification services and routed to AWS administrators for immediate attention. Restoration of data, if required, is performed using point-in-time recovery from available snapshots. The defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are both 30 minutes, ensuring minimal disruption and data loss in the event of an incident. Backup management and monitoring follow AWS’s shared responsibility model, where AWS manages infrastructure-level reliability while recovery approvals and operational decisions remain under the responsibility of Cetasika Life Pvt Ltd’s management.

Account Deletion

When a user requests account deletion, the user account is deactivated and access to the platform is disabled. The associated data is retained securely for purposes such as regulatory compliance, audit requirements, dispute resolution, fraud prevention, and fulfillment of legal obligations. Once an account is deleted, it is no longer visible or accessible to other users on the platform. All retained data continues to be protected using the same security, access control, and encryption standards as active accounts. Any future changes to data removal timelines or permanent deletion processes will be implemented in accordance with applicable laws and reflected through updates to this policy. Where a Doctor or clinic requests deactivation of its Cetasika Clinic Management System account, patient records maintained within the CMS shall continue to be retained in accordance with this Policy and shall be released or transferred to the concerned Doctor or clinic upon request, subject to applicable law.

Data Retention

Deletion & Erasure

• Data is securely deleted or anonymized upon expiry of retention periods
• User erasure requests are honoured unless retention is legally required
• Deletion actions are logged for audit purposes

Exceptions

Data may be retained beyond scheduled periods if required for:

• Ongoing litigation or investigations
• Regulatory or governmental directives
• Enforcement of legal rights or claims

12. Third Party Websites and Services

Cetasika Website and /or applications may contain links to third party services, and give you the ability to access such third-party websites, products, and services. Please note that you may proceed to the use of such third party website or service at your own risk and the Cetasika will not be held liable for any outcome or harm arising as a result of your use of such third party websites or services. Please read the privacy policies of any third party before proceeding to use their websites, products, or services.

13. LEGAL COMPLIANCE AND DISCLOSURE OBLIGATION

We may disclose personal data if required under legal obligation, judicial mandate, regulatory requirement, court order, or to respond to verified requests by government authorities to fulfil statutory compliance responsibilities, protect platform integrity or prevent unlawful activity.

14. GRIEVANCE REDRESSAL AND CONTACT INFORMATION

As mandated under applicable Indian law, Cetasika Life Pvt Ltd shall appoint a Grievance Officer responsible for complaint resolution relating to privacy and data concerns.

Grievance Officer:

Email:

grievance@cetasika.com

We will attempt to respond to your grievances or complaints as soon as possible within reasonable time.

15. MODIFICATIONS TO PRIVACY POLICY

Cetasika Life Pvt Ltd reserves the right to modify, amend or update this Privacy Policy as part of continuous compliance, platform enhancement, legal requirement or operational necessity from time to time. Any revised version will be published on our Platform with an updated effective date. Your continued use of our products and services after the effective date of the Privacy Policy means that you accept the revised Privacy Policy. If you do not agree with any such revised terms, please refrain from using our Services and contact us to close any account you may have created.

16. USER CONSENT ACKNOWLEDGEMENT

By registering, accessing or continuing to use Cetasika Life, you acknowledge that you have read, understood and agreed to this Privacy Policy and consent to the collection, use, storage and processing of your personal information in accordance with the same.