1. Overview

BartLabs Technologies Private Limited, operating as Zuro Healthcare ("Zuro"), handles personal data as described in our Privacy Policy. The DPDP Act, 2023 and its Rules have phased commencement; statutory duties and remedies apply as their provisions come into force. This page provides a plain-language guide to contacting us and using available data controls.

2. Data rights and product controls

You may contact us about access, correction, deletion, consent, or a grievance. Applicable statutory rights depend on the law and provisions in force when your request is made. The controls below describe product features, not a promise that every feature is available to every account.

2.1 Right to Information

You have the right to know what personal data we collect about you, why we collect it, and how it is used. This information is provided in our Privacy Policy. We provide clear, specific consent notices at each point of data collection.

2.2 Right to Access Your Data

You have the right to obtain a summary of your personal data and information about how it has been processed. On Zuro, you can:

• View all your health records, prescriptions, and medical documents from your patient dashboard at any time
• Download your health records in standard formats (PDF, images)
• View your profile information, appointment history, and medication records
• Request a formal data access report by emailing privacy@zurohealth.com

2.3 Right to Correction

You have the right to correct inaccurate or incomplete personal data. You can:

• Update your profile information (name, contact details, emergency contacts) directly from your account Settings
• Request corrections to health records by contacting the healthcare provider who created them or by emailing support@zurohealth.com
• Flag any data you believe is inaccurate through the in-app support system

2.4 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent. To request erasure:

• Self-Service: Where available, submit an account-deletion request from Settings. The request is queued and processed through the applicable workflow; we communicate material delays or limits.
• Email Request: Send a deletion request to privacy@zurohealth.com with your registered email and account details
• Exceptions: Some clinical, billing, security, or dispute-related records may be retained where required or permitted by applicable law. The period depends on the record and the responsible provider.

2.5 Product data export

Zuro offers data-export controls in some products. The export format and scope depend on the account and records available. This product capability does not expand or replace statutory rights under laws in force.

• You can download your health records and documents directly from your dashboard
• For help with an export request, contact privacy@zurohealth.com

2.6 Right to Withdraw Consent

You can withdraw your consent for data processing at any time. Please note:

• Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal
• Some features of the Service may become unavailable if consent is withdrawn (e.g., you cannot use prescription scanning without consenting to AI processing)
• You can manage consent for data sharing with specific healthcare providers through your dashboard
• For complete consent withdrawal, contact privacy@zurohealth.com

2.7 Right to Grievance Redressal

You have the right to raise concerns about how your data is being processed. See Section 6 below for how to file a complaint.

2.8 Nomination

Where applicable law provides for nomination, you may nominate another individual to exercise eligible rights in the event of death or incapacity. To ask about supported procedures, contact privacy@zurohealth.com with the relevant details.

3. How We Protect Your Health Data

We employ multiple layers of security to protect your personal and health information. For complete technical details, visit our Health Data Protection Practices page. Key protections include:

• Transport security: HTTPS for supported web and service connections. Cloud providers may apply their own encryption controls; this does not mean each data field is separately encrypted by Zuro.
• Access Control: Role-based access control in supported workflows. Permissions depend on account role, clinic membership, and the feature used.
• Consent Management: Health records are shared with healthcare providers through sharing workflows. Review the available consent details and revocation controls for the specific product before sharing.
• Logging: Certain authentication, security, and sensitive workflow events are logged; this is not a guarantee that every view is individually recorded.
• Cloud services: Firebase/Google Cloud and other providers are used for specific services. Provider certifications are not Zuro certifications, and data location depends on configuration.
• Session Security: Automatic session timeouts based on your role, with re-authentication required for sensitive operations.
• No Data Selling: We never sell, rent, or trade your personal or health data to any third party.

4. Consent Management

Consent is requested where required for the relevant purpose. This notice alone is not consent. Available controls vary by feature and product:

4.1 When We Ask for Consent

• At registration, for processing your personal data to provide the Service
• When you upload health records or prescriptions for storage and processing
• When you use an enabled AI feature that sends selected input to a model service for processing
• When you choose to share health records with a healthcare provider or pharmacy
• For non-essential communications such as feature updates and newsletters

4.2 How to Manage Your Consent

• Provider Access: View and manage which healthcare providers have access to your records from your patient dashboard. Revoke access at any time.
• Communication Preferences: Manage email and notification preferences from your account Settings
• Data Processing: To withdraw consent for core data processing, contact privacy@zurohealth.com. Note that this may require account closure as the Service cannot function without processing certain data.

4.3 Consent Records

We maintain records of all consents given, including what was consented to, when consent was given, and any withdrawals. You may request a copy of your consent records by contacting privacy@zurohealth.com.

5. How to Request Data Access or Deletion

You can exercise your data protection rights through the following channels:

5.1 Self-Service (Recommended)

• View and Download Data: Access your health records, prescriptions, and documents directly from your patient dashboard
• Update Information: Edit your profile and personal details from account Settings
• Delete Account: Initiate account deletion from Settings, which will remove your personal data within 30 days
• Manage Sharing: View and revoke provider access from your dashboard

5.2 Email Request

For formal data access, correction, portability, or deletion requests, email privacy@zurohealth.com with:

• Your registered email address
• The specific right you wish to exercise
• Any relevant details to help us identify and process your request

We may verify your identity before processing. We will explain the next steps and any material delay or retention limit.

5.3 In-App Support

You can also raise data protection requests through the Help and Support section within the Platform. Select the "Data Protection" category when creating a support ticket.

6. How to File a Complaint

If you believe your data protection rights have been violated or are dissatisfied with how we handle your personal data, you may:

Step 1: Contact Our Grievance Officer

Step 2: Escalate to the Data Protection Board of India

You may pursue any external complaint or appeal channel made available under the law in force. Check the relevant authority's official website for current filing instructions.

The external contact information is on our Grievance Redressal page.

7. Data Protection Officer

For data-protection enquiries, contact:

This contact can route privacy questions and data requests to the relevant team. Statutory appointment obligations depend on the law and any designation applicable to the Company.

8. Your Duties as a Data Principal

Under the DPDP Act, 2023, Data Principals also have certain duties:

• Provide accurate and truthful information when registering and using the Platform
• Do not impersonate another person or provide false identity information
• Do not suppress material information when providing personal data
• Do not register frivolous or false grievances or complaints with the Data Fiduciary or the Data Protection Board
• Comply with all applicable laws when exercising your rights

9. Related Policies

For more details about how we handle your data, please review our related policies:

• Privacy Policy - Complete details on data collection, processing, and sharing
• Health Data Protection Practices - Technical security measures and compliance details
• Terms of Service - Platform usage rules and agreements