1. Introduction

BartLabs Technologies Private Limited, operating as Zuro Healthcare ("Zuro", "we", "us", or "our"), is committed to protecting your privacy and the security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our healthcare management platform ("Platform" or "Service").

We publish this notice to explain our data practices. Applicable privacy laws, including the Digital Personal Data Protection Act, 2023 and its phased commencement, govern processing where and when their provisions apply. This notice is not a claim of certification or regulatory approval.

This policy is a privacy notice, not a substitute for a feature-specific consent. Where consent is required, we request it separately and explain the relevant purpose. You may decline optional processing; some requested features may then be unavailable.

2. Data Fiduciary Information

Under the DPDP Act, 2023, Zuro acts as a "Data Fiduciary" for the personal data processed through the Platform. The Data Fiduciary details are:

3. Information We Collect

3.1 Personal Information

• Full name, email address, and phone number
• Date of birth, age, and gender
• Profile photographs (optional)
• Residential address
• Emergency contact information
• Government or health identifiers (including ABHA details) only where a feature asks you to provide them. Do not send Aadhaar numbers or OTPs through support messages.

3.2 Account and Role Information

• Account type (patient, doctor, hospital/clinic, pharmacist, admin)
• Professional credentials and verification documents (for healthcare providers), including medical registration number, council name, and qualification certificates
• Clinic or hospital details (name, address, specialties, operating hours, registration number)
• Subscription tier and billing information

3.3 Health Information (Sensitive Personal Data)

• Medical prescriptions and documents uploaded by you or issued by providers through the Platform
• Lab reports, diagnostic results, and imaging reports
• Vaccination records and immunisation history
• Medication history, current medications, and reminders
• Doctor appointments, consultation notes, and visit history
• Emergency health information (blood type, known allergies, chronic conditions)
• AI-extracted prescription data (medicines, dosages, frequency) generated through OCR scanning

3.4 Financial Information

• Payment transaction records (processed via Razorpay; we do not store complete card details)
• Subscription history and invoices
• Billing address

3.5 Support and Feedback Data

• Support tickets and correspondence
• Feature requests and feedback submissions
• Bug reports and issue descriptions

3.6 Technical and Usage Information

• Device information (type, operating system, browser)
• IP address and approximate geolocation
• Security events, access logs, and limited service diagnostics needed to operate and protect the Platform. Optional analytics may be used only where enabled and disclosed in the relevant product.
• Cookies and similar tracking technologies

4. Purpose of Data Processing

We process your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve the healthcare management platform, including storing medical records, processing prescriptions, managing appointments, and sending medication reminders
• AI-Powered Features: To enable prescription OCR scanning (via Google Gemini AI), Smart Rx suggestions, drug interaction checks, and medicine information lookups
• Account Management: To create and manage your account, verify provider credentials, and process subscriptions and payments
• Communication: To send transactional emails (via Resend), appointment reminders, medication alerts, security notifications, and service updates
• Healthcare Coordination: To facilitate the sharing of health records between patients and their authorised healthcare providers, with explicit consent
• Security and Compliance: To detect and prevent fraud, unauthorised access, and other security threats; to comply with legal obligations
• Service operations: To monitor reliability, diagnose errors, protect accounts, and improve operations. Optional product analytics are not enabled by the current cookie notice.
• Customer Support: To respond to support tickets, feedback, and enquiries

5. Legal Grounds for Processing

We assess the applicable legal ground for each purpose. Where consent is required, it is requested for the relevant feature and purpose; viewing this notice alone is not consent.

• Consent: Where required, consent is requested separately for the relevant purpose. Contact us about withdrawal or use the control provided for that feature.
• Service delivery: Processing needed to provide a feature you request, on a legal ground applicable to that processing.
• Legal Obligation: Processing required to comply with applicable Indian laws, including medical record retention requirements, tax laws, and regulatory requirements.
• Other grounds may apply where permitted by a law in force.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data or health records. We share your information only in the following circumstances:

• With Healthcare Providers (With Consent): When you explicitly choose to share health records with a doctor, hospital, or pharmacy through the Platform's consent management system
• With Pharmacies (With Consent): When you or your prescribing doctor shares a prescription with a pharmacy for dispensing
• With Service Providers (Data Processors): With trusted third-party service providers who process data on our behalf under strict contractual obligations (see Section 11)
• Legal Requirements: When required by law, court order, or government authority, or when disclosure is necessary to protect our rights, safety, or property, or the rights, safety, or property of others
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections

7. Data Security

We use technical and organisational safeguards intended to protect personal information. The safeguards available depend on the product, feature, and service configuration. For more information, please refer to our Health Data Protection Practices page. Key measures include:

• Transport security: HTTPS for supported web and service connections. Cloud providers may apply their own encryption and security controls; this does not mean every field is separately encrypted by Zuro.
• Access Control: Role-based access control (RBAC) with five distinct roles ensuring users can only access data relevant to their role
• Access controls: Authentication and role-based authorization are used in supported workflows. No security measure makes risk zero, and access controls vary by feature and deployment.
• Cloud services: Firebase/Google Cloud and other providers are used for the services described below. Provider certifications are not certifications of Zuro.
• Session Management: Automatic session expiry with role-based timeout durations
• Logging: Certain authentication, security, and sensitive workflow events are logged; logging coverage is not a guarantee that every view is individually recorded.
• No Third-Party Selling: We never sell your health data to third parties

8. Data Rights and Product Controls

You may contact us about your personal data and use controls available in your account. Statutory rights and remedies depend on applicable law and the provisions in force when your request is made.

• Access: You may request a summary of all personal data we hold about you and the processing activities associated with it
• Correction: You may request correction of inaccurate or incomplete personal data. You can also update most information directly through your account settings.
• Deletion: You may request deletion of your personal data. Requests are reviewed and processed through the applicable workflow. Some data may remain while a request is processed or where retention is required or permitted by law; we will communicate material delays or limits.
• Product export: Where available, use the account export controls or contact us to request a copy. This product capability is separate from statutory rights that apply under laws in force.
• Consent controls: Where processing is based on consent, you may withdraw it as described for the relevant feature. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal. Note that withdrawing consent may limit your ability to use certain features of the Service.
• Grievance: You may raise a grievance with our Grievance Officer (see Section 14) or file a complaint through an external channel available under law.
• Nomination: Where provided by applicable law, you may nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise an applicable right or raise a privacy concern, contact privacy@zurohealth.com. We may verify your identity, assess legal retention obligations, and explain any limits or expected processing time.

9. Data Retention

We retain personal information only for as long as reasonably needed for the purposes described here, to operate the requested service, resolve disputes, protect security, and meet applicable legal obligations. Actual periods depend on the record type, product, and role of the person or provider responsible for it.

• Active Account Data: Retained for as long as your account remains active and is needed to provide the Service
• Deletion requests: Requests are reviewed and processed through the applicable workflow. Some data may remain while a request is processed or where retention is required or permitted by law; we will communicate material delays or limits.
• Clinical records: Records created or held by a healthcare provider may remain in that provider's own systems under its clinical, professional, and legal obligations, even after a Zuro account is closed.
• Billing and security records: Retained for the period applicable to the record and the legal, accounting, security, or dispute-resolution purpose.
• Other records: Backup copies and logs may persist for a limited period under operational retention and deletion cycles.

10. Children's Data Protection

Zuro does not knowingly collect personal data from children under the age of 18 without verifiable parental or guardian consent, in compliance with the DPDP Act, 2023.

• Parents or legal guardians may create accounts and manage health records on behalf of their minor children
• We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children
• If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete such data promptly
• Healthcare providers using the Platform to manage paediatric patients must ensure appropriate parental consent is obtained as required by law

11. Third-Party Services (Data Processors)

Depending on the feature used and deployment configuration, information may be processed by the following service providers. Their own terms and privacy notices also apply; the provider list and configuration may change as the service evolves.

• Google Cloud Platform / Firebase: Cloud authentication, database, file storage, messaging, and application services.
• Razorpay: Payment processing for eligible web transactions. Payment providers receive information needed to process and reconcile the transaction; do not include clinical details in payment fields.
• Google Gemini AI: Prescription OCR scanning and Smart Rx features. Prescription images are processed for data extraction when you use an enabled AI feature. The selected image or text is sent from the authenticated service to Google's model service for processing. Review Google's applicable terms for retention and model-use details; we do not promise zero retention or a particular training setting in this notice.
• Resend: Transactional email delivery (account verification, password resets, appointment reminders). Only the minimum necessary information (email address and message content) is shared.
• Vercel: Application hosting, delivery, and operational request processing for the web application. Request data may be processed as needed to serve and secure requests.

12. Cross-Border Data Transfers

Some of our third-party service providers may process data outside India. In such cases:

• We assess cross-border processing against applicable law and any government restrictions in force. Service providers may process information in locations outside India depending on product and configuration.
• We use provider terms and contractual safeguards where applicable; contact us for current processor information.
• Data location can vary by provider and service configuration; do not assume that all information is stored in India.
• Regional configuration and data residency must be confirmed for the specific service and deployment.

13. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India as required under the DPDP Act, 2023, without unreasonable delay
• Notify affected Data Principals (users) of the breach, the nature of data compromised, and the remedial measures taken, in the manner and within the timeframe prescribed by the Data Protection Board
• Take immediate steps to contain the breach, investigate the cause, and implement measures to prevent recurrence
• Maintain a record of all data breaches and the actions taken in response

14. Cookies and Tracking Technologies

The website uses cookies and browser storage needed for security, session management, and remembering a cookie-notice preference. The current cookie notice does not activate an optional analytics cookie category.

• Essential Cookies: Maintain your authenticated session and ensure the Platform functions correctly. These cannot be disabled.
• Preference Cookies: Remember your settings, language preferences, and display choices.

We do not use the cookie notice as consent to health-data processing. Optional analytics or advertising technologies will be described and controlled separately if introduced.

15. Grievance Officer

Contact our Grievance Officer about concerns regarding data processing or this Platform:

If you are not satisfied, you may pursue any external complaint or appeal available under the law in force. Current contact information is on our Grievance Redressal page.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide at least 15 days' prior notice via email or in-app notification. Continued use of Zuro after the effective date of the revised policy constitutes your acceptance of the changes. The "Last updated" date at the top of this page indicates when the policy was last revised.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: