Privacy Policy

Effective Date: 14 October 2026 • Version: 1.5

1. Nature of Services

ExaHealth is a digital SaaS platform that enables users to store, organize, and manage their personal health-related information. We do not provide medical advice, diagnosis, or treatment. We do not sell, trade, analyze, or share your personal or health data with external entities for advertising or marketing purposes.

2. Information We Collect

ExaHealth collects only the minimum information necessary to operate and improve our services.

2.1 Personal Information

Information you provide during registration or while using the platform:

  • Full name
  • Email address
  • Mobile number
  • Profile details voluntarily added by you

This information is used strictly for authentication, communication, and account management.

2.2 Health-Related Information (User-Provided Only)

ExaHealth does not generate or modify medical data. We only store the information that you voluntarily upload, which may include:

  • Medical reports
  • Prescriptions
  • Notes
  • Health documents
  • Any files or observations you choose to store

This data is stored securely and remains fully under your control.

2.3 Technical & Log Information

Collected automatically to secure the platform:

  • IP address
  • Device information
  • Browser type
  • Login timestamps
  • Access logs (for security monitoring)
  • App diagnostics: crash reports and app performance information (app version, device model, operating system version), so we can find and fix faults

Before you sign in, the mobile app sends a small amount of essential diagnostic information so we can tell whether sign-in works on every kind of phone: that the app was opened, which sign-in method was tried and whether it worked, the phone's maker, model, operating system version and memory size, and a random number created when the app was installed. It contains no name, phone number, email address, health information or account, and it is used only to keep the app working.

We do not collect information for advertising or behavior tracking.

3. Lawful Basis for Processing

We process your information based on the following legal grounds:

  • Consent: You provide explicit consent when creating an account and uploading data.
  • Contract Performance: Processing is necessary to provide the services you subscribed to.
  • Legal Obligation: We may process data to comply with applicable laws, court orders, or regulatory requirements.
  • Legitimate Interest: We process technical data to maintain platform security and prevent fraud.

4. How We Use Your Information

We use your information strictly for legitimate and essential purposes:

  • To create and secure your account
  • To store your uploaded health information
  • To ensure smooth functioning of platform features
  • To detect, prevent, and investigate security threats or misuse
  • To communicate important updates, alerts, or support responses
  • To comply with regulatory or legal obligations
  • To read the documents you upload and to provide AI-powered features such as health insights and the AI health assistant, using third-party AI services (section 6.3)

We never use your health information for advertising, marketing, profiling, or data monetization.

5. Data Ownership

  • You are the exclusive owner of all information you store on ExaHealth.
  • ExaHealth does not claim any rights over your uploaded documents or health data.
  • You can download, export, edit, or delete your data at any time.
  • Our role is limited to providing secure digital storage and access tools.
  • ExaHealth does not claim ownership or modify your original data. When you upload a document or use AI features, your data is processed by third-party AI services to read it and generate insights — your original records remain unchanged.

6. Data Sharing Policy

ExaHealth follows a strict no-selling, no-trading data policy. We do not share your data for advertising or marketing purposes.

We do NOT share your information with:

  • Advertisers
  • Analytics platforms — your health information is never sent to them (see section 11)
  • External data brokers
  • Other users
  • Third parties for marketing or research

We may share limited information only under these conditions:

6.1 Legal Obligations

We may disclose information if required by:

  • Court order
  • Government authority
  • Applicable law

Even in such cases, only the minimum necessary information is provided.

6.2 Service Providers

Some trusted partners may receive minimal data for essential functions:

  • Payment gateways (billing information only)
  • OTP/verification services
  • Email/SMS providers
  • Cloud hosting and storage (Hostinger and Amazon Web Services, in India) — to run ExaHealth and store your files
  • Document reading (Amazon Web Services Textract, and the AI providers below) — to extract text and results from the health documents you upload
  • AI service providers (Alibaba Cloud's Qwen models, Anthropic, OpenAI) — to read uploaded documents, generate health insights and power the AI assistant

Reading a document is a core function: it runs whenever you upload one, because that is how its results reach your record. Other AI features run when you use them. Providers receive only what the task needs, solely to produce your result, under their commercial terms: they may not use it to train their models, and they keep it only for a limited period (for example to detect abuse) before deleting it. Data is encrypted in transit. Some of these providers process data outside India — see section 7.4.

6.3 AI Data Processing

When a document you upload is read, or you use an AI-powered feature (health insights, the AI assistant), the following data may be shared with our AI providers (Alibaba Cloud's Qwen models, Anthropic, OpenAI):

  • Health profile: age, gender, conditions, allergies
  • Lab results: test values, reference ranges, status
  • Vital signs: blood pressure, heart rate, blood glucose, weight, SpO2
  • Medications: name, dosage, frequency
  • Health documents: extracted text for analysis

Important safeguards:

  • AI processing occurs when you upload a document or use an AI feature — never in the background for any other purpose
  • Only the data the task needs is sent
  • Data is encrypted in transit (TLS 1.2+)
  • Providers keep it only for a limited period under their terms, and may not use it to train their models
  • You can stop using AI features at any time, and delete any document you uploaded

This section covers the AI features inside ExaHealth. When you connect an outside AI assistant to your account, section 6.4 applies instead.

6.4 Connecting an AI Assistant (AI Connect)

You can connect an AI assistant that you use, such as Claude or ChatGPT, to your ExaHealth account. The assistant is a separate service that you have your own account with; ExaHealth does not operate it. Connecting is always your choice, and you can disconnect at any time.

  • You choose what it may do. When you connect, you sign in to ExaHealth and pick what the assistant may do — for example find care, book appointments, or read your health records. It can do nothing else.
  • What the assistant receives. Only what you allowed, and only when you ask it something that needs it: for example a list of clinics, an appointment, or the lab values it reads to answer your question. ABHA and Aadhaar numbers are masked. ChatGPT is given care search only — never your health records, appointments or contact details; you book on ExaHealth's own page.
  • Where that copy is kept. What the assistant receives becomes part of your conversation with that assistant and is kept under the assistant provider's terms and your settings with them (Anthropic for Claude, OpenAI for ChatGPT). ExaHealth does not control that copy; to remove it, delete the conversation with the provider.
  • No change without you. An assistant never changes your record on its own. Every reading, dose or document it proposes is shown to you first and saved only when you confirm.
  • Bookings. When you book an appointment or an ambulance through an assistant, the provider you book with receives what a booking needs — the patient's name, a phone number and, for a consultation on India's health network, your ABHA address — exactly as when you book in ExaHealth.
  • See and stop it. Every action an assistant takes (which tool, when, and whether it was allowed) is listed under Settings → Connected AI, where you can disconnect it; a disconnected assistant is refused on its very next request. This activity log is part of your data: it is included when you export your data and deleted with your account (section 9).

7. Data Security & Protection Measures

ExaHealth uses advanced, industry-standard security protocols designed to protect highly sensitive data.

7.1 Encryption

  • Data in transit is protected using HTTPS/TLS 1.2+
  • Data at rest is encrypted using AES-256

7.2 Zero-Trust Access Controls

  • No internal employee can access user health data without explicit authorization.
  • Access is strictly role-based and logged.

7.3 Continuous Monitoring

  • All system access is monitored for suspicious activity
  • Unauthorized attempts trigger automatic alerts

7.4 Secure Infrastructure & Where Your Data Is Stored

  • Your account, health records and uploaded files are stored in India: our servers and database are hosted in Mumbai, and files are kept with Amazon Web Services in its Mumbai region.
  • Redundant backups with encrypted storage.
  • Some processing happens outside India: when a document is read or you use an AI feature, the data the task needs is sent to Alibaba Cloud (Singapore) and Anthropic and OpenAI (United States), as described in sections 6.2 and 6.3. If you connect an outside AI assistant, what it receives is held by that assistant's provider (section 6.4). These transfers are made as permitted by India's Digital Personal Data Protection Act, 2023.

7.5 Regular Security Audits

  • Internal audits
  • Third-party penetration testing
  • Vulnerability management

7.6 Data Isolation

  • Each user's data is stored in a logically isolated manner to prevent cross-access.

8. Data Breach Notification

In the unlikely event of a data breach that affects your personal or health information:

  • We will notify affected users via email within 72 hours of becoming aware of the breach.
  • We will provide details about the nature of the breach, the data affected, and steps being taken to mitigate harm.
  • We will report the breach to relevant regulatory authorities as required by applicable law.
  • We will offer guidance on protective measures you can take.

9. Data Retention & Deletion

  • Your data remains stored securely as long as you maintain an active subscription or account.
  • After you cancel your subscription or become inactive, your data will be preserved for 30 days to allow reactivation or export.
  • After the 30-day retention period, all personal and health-related data will be permanently deleted.
  • Deleted data is removed from active systems, backups, and logs (where applicable).
  • Deletion is irreversible.
  • You may request immediate deletion at any time by contacting support.

10. User Rights

As the owner of your data, you have the right to:

  • Access: View or download all information stored in your account.
  • Rectification: Update or correct personal information.
  • Deletion: Permanently delete your account and stored data.
  • Portability: Export your data in standard formats.
  • Withdraw Consent: Stop using the service or request deletion at any time.
  • Restriction: Limit processing of your information.

How to exercise your rights:

  • Access, rectification, deletion, and export can be done directly through your ExaHealth account settings.
  • For consent withdrawal or data restriction requests, email support@exahealth.com with the subject line "Privacy Rights Request."
  • We will respond to all valid requests within 30 days.

11. Cookies & Tracking

ExaHealth uses essential cookies for:

  • Session management
  • Authentication
  • Security
  • Preventing unauthorized access

We also measure how people find and use our website:

  • Google Analytics on our public pages (articles, care directory, pricing and similar), to count visits and see which pages help people. Signed-in areas that hold health information are either not measured or measured with their addresses and titles removed, so no health information reaches Google.
  • A first-party cookie (exa_vid, kept for 90 days) that tells us which page or search brought a visitor to ExaHealth. It holds a random identifier, never your health information.
  • In the mobile app, install attribution (AppsFlyer) runs only if you agree to it, and you can turn it off at any time.

We do not use:

  • Advertising cookies
  • Third-party marketing cookies
  • Any measurement of your health information for advertising

You can block or delete cookies in your browser settings; essential cookies are needed to sign in.

12. Third-Party Services

ExaHealth may integrate with essential third-party services such as:

  • Payment gateways
  • SMS/OTP verification systems
  • Email delivery providers
  • Cloud hosting and storage (Hostinger, Amazon Web Services) — in India
  • Document reading (Amazon Web Services Textract) — for health document text extraction
  • AI service providers (Alibaba Cloud's Qwen models, Anthropic, OpenAI) — to read uploaded documents, for health insights and the AI assistant
  • Website measurement (Google Analytics) and, in the mobile app with your agreement, install attribution (AppsFlyer) — see section 11
  • Crash reporting (Sentry) — error reports and device details from the app, with personal details removed before they are sent

These partners receive only the minimum information required to perform their role. Reading uploaded documents is a core service; other AI features run when you use them. AI providers process data under their commercial terms, may not use it to train their models, and keep it only for a limited period. Where each partner processes data is set out in section 7.4.

We conduct background checks and compliance reviews before onboarding any third-party vendor.

13. Children's Privacy

  • ExaHealth is not intended for users under the age of 18.
  • If we discover that a minor has created an account without guardian supervision, the account may be restricted or removed.
  • Parents or guardians may request deletion of such data by contacting support.

14. Updates to Privacy Policy

We may revise this Privacy Policy periodically to reflect:

  • Changes in law
  • New features
  • Security improvements
  • Company policy updates

When changes occur:

  • The updated version will be posted with a new Effective Date and Version number.
  • Users will be notified of significant changes via email or dashboard notifications at least 15 days before they take effect.
  • Continued use of the platform after changes take effect constitutes acceptance.

15. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Hyderabad, India.

16. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the contact details of the Grievance Officer are:

Name: Jagadishwar Balla

Email: grievance@exahealth.com

Address: Dwaraka Pride – The Headquarters Coworking Space,Huda Techno Enclave, Madhapur,HITEC City, Hyderabad, Telangana – 500081

The Grievance Officer will acknowledge complaints within 48 hours and resolve them within 30 days.

17. Contact Information

For privacy concerns, data deletion, or rights requests, contact:

General Support: support@exahealth.com