Privacy Policy

Who we are

AIDr is built and operated by Dot eVentures Private Limited (“AIDr”, “we”, “us”), whose registered address is 141 Prashasan Nagar, Jubilee Hills. Our contact for everything in this policy is the Grievance Officer, at info@doteventures.com. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, we are the Data Fiduciary: we decide why and how your personal data is processed. You are the Data Principal, the person the data is about.

This policy covers the AIDr apps for iPhone and Android, the services behind them, and the website at aidr.in. It also covers the personal data of people you add to your account, such as family members. Our Terms of use set out the rules for using AIDr, and the section on children and managed profiles explains what it means when you add someone else.

Vidya is an AI. It helps you understand and organise health information, but it is not a doctor and does not replace one. AIDr is not a hospital and not a medical device. See Vidya, AI and Google.

What we collect

We collect what the product needs and nothing it does not. Some of it you give us, some is produced as you use AIDr, and some comes from the sign-in service you choose.

What we do not collect

• Your contacts, your calendar or your location.
• Your advertising ID. We run no advertising and no ad network.
• Device or usage analytics. We have not added analytics, crash-reporting or advertising tools to our apps.
• Data from third-party data brokers.

The DPDP Act does not have a separate category for health information, but we treat everything on this page with the care that health information deserves. Medical records and medical history are also “sensitive personal data” under India's Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent those rules apply to us. We collect such information only with your consent, for the purposes in this policy, you may refuse or withdraw consent, and we apply the security practices described under How we protect it. We do not claim any security certification.

Information about someone else

If you add a family member, a child or an elder, you give us information about them. Do this only if you are their parent or lawful guardian, or they have agreed. See Children, guardians and managed profiles.

Why we use it, and your consent

We process your personal data on the basis of your consent. Before we ask, we tell you what the data is, why we want it and what it unlocks. Nothing is pre-ticked. Each time you accept, we record which version of the notice you read. Notices are shown in English, Hindi and Telugu.

Consent in AIDr is split by purpose, so you can say yes to one thing and no to another:

Only the first is needed to use AIDr at all. If you say no to an optional purpose, the matching feature stays off and the rest keeps working. Using Vidya itself (the last row) means sending your content to Google's AI service, so the only way to say no to that is not to use those features.

Taking consent back

You can withdraw any consent at any time, in the app under My Privacy. On iPhone, open your profile and tap My Privacy. On Android, open your profile, tap Settings, then My Privacy. It takes one tap, and the screen tells you what withdrawing does and does not undo. Withdrawing is as easy as giving.

• Sharing permissions (family, doctor, caregiver): the other person's next attempt to read stops working, within seconds. It cannot unsee what they already viewed.
• Other purposes (for example memory or reminders): we stop new processing for that purpose. Data already stored stays until you delete it or delete your account. Content already sent to Google cannot be recalled by us.
• Account and sign-in cannot be withdrawn on its own. Withdrawing it is the same as deleting your account.

Withdrawing does not make earlier processing unlawful.

Other lawful uses

Apart from consent, we may use or disclose personal data where the law requires it, for example to comply with a court order or a lawful direction from an authority. We do not use your information for advertising, we do not sell it, and we do not build profiles to target you.

Vidya, AI and Google

What Vidya is and is not

Vidya is an AI. It explains and organises health information: what a report shows, what a medicine is for, what to ask your doctor. Vidya says plainly that it is an AI when it matters.

Its limits are built into AIDr and are checked on our servers, not just requested of the AI model:

• Vidya does not tell you what condition you have, and does not present a condition as settled fact, including from photos or video.
• Vidya does not give a dose in any form, and does not prescribe, start, stop or change a prescription medicine.
• Vidya may suggest ordinary self-care, such as rest, fluids or oral rehydration, and may mention common over-the-counter options in general terms. This is general information, not an instruction for you.
• Vidya can explain what a medicine is for and answer general questions about how medicines interact. AIDr does not send automatic interaction alerts.
• For signs that may be an emergency, such as chest pain, trouble breathing, signs of a stroke, heavy bleeding, a severe allergic reaction, poisoning, a seizure, an unresponsive child or elder, or thoughts of self-harm, Vidya tells you first to call 108 (or 112). A second check on our servers looks for such signs in many languages. That check is built by our engineers, has not been reviewed by clinicians, and errs towards giving the warning, so it can warn when it was not needed and can also miss things.

Human oversight

Vidya's replies are produced automatically. A clinician does not review each reply before you see it. Decisions about your health stay with you and a registered medical practitioner. AIDr does not use automated means to take decisions about you that have a legal or similarly significant effect. If an answer seems wrong or unsafe, tell us at info@doteventures.com.

Sending your health content to Google (Gemini)

• Your agreement. By sending a message, sharing a photo, or starting a call or voice conversation in AIDr, you ask us to send that content to Google for the purpose in the table. You can choose not to use those features. Withdrawing a consent in My Privacy stops new processing for that purpose, but cannot recall content that has already been sent.
• Google is our processor. Google processes this content to provide its AI service to us. We send only what each request needs. We do not send your content to Google for advertising, and we do not sell it.
• What we store. We do not store the audio or video of calls; we store the written transcript as part of your chat history. Photos you upload are stored in your private storage until you delete them.
• Google's side. Google's own terms govern what it does on its side, including any short-term retention it may apply, for example to prevent abuse or meet legal duties. We do not control Google's systems and we do not state a retention period for Google here.

No training on your data

AIDr does not train AI models on your data, and nothing in our product does so. Our requirement for any AI provider we use is that content we send to it is not used to train the provider's general-purpose models, and we will not knowingly use or authorise any arrangement that allows this. If that ever needs to change, we would first ask you for separate, specific consent.

Wrong or unsafe answers

AI can misread a blurry report, mishear a word or state something that is not true. Check anything important with your doctor or pharmacist, and look at the original report. AIDr does not yet have a button in the app to report a wrong answer, so please write to us.

Who receives your information

We do not sell your personal data. We do not share it with advertisers or data brokers. Your information goes only to the people and services below.

Service providers (processors)

We use a small number of companies to run AIDr. They process data for us, to provide their service to us.

Paid features are not switched on. If we switch them on, payments may go through Razorpay, or through Apple or Google for purchases made in their app stores, and we will update this policy first. We do not store your full card details.

Provider terms and privacy practices apply to them in their own right. Under the DPDP Act, we remain responsible for how our processors handle your data on our behalf. Providers may keep their own records, such as delivery records, request logs or copies of requests, for periods set by their own terms; see How long we keep it.

People you choose

Family members, caregivers and doctors see your information only when you share it. See Family, caregivers and doctors.

Legal reasons

We disclose personal data where a law, a court order or a lawful direction from a government authority requires it, and only as far as it requires.

If the business changes

If AIDr's business is ever merged with or sold to another company, we will tell you before your information moves. The new owner must keep honouring this policy and the consents you have given, and we will ask for fresh consent wherever the law requires it.

Family, caregivers and doctors

Sharing in AIDr is something you grant, not something that happens to you.

• Family sharing. You grant access to a named person, for each kind of information separately. The kinds are: profile basics, conversations, reports, medicines, doses taken, biomarkers, connected-device readings, your emergency card, and Visit Briefs. A grant lets the person read only. It never lets them change your record.
• Revoking. You can stop sharing at any time under My Privacy. The other person's next read stops within seconds. It cannot recall what they already saw.
• Who saw what. AIDr keeps a log of every read of your information, whether allowed or refused, and shows it to you.
• Caregiver digests. If you turn this on, we send an email to the person you name. It tells them whether doses were taken or missed. It does not include report contents.
• Visit Briefs and doctors. A Visit Brief is a summary for a doctor's review. You can share it with any doctor by link or QR code. A link expires after 24 hours unless you choose a longer time, up to 30 days. You can revoke it, and each opening is logged. Anyone who holds the link can open the Brief until it expires or you revoke it, so share it as you would a paper report.
• Family invitations go by email, text or WhatsApp. They carry no health information, and expire after 14 days unless the sender sets another time (between one hour and 30 days).
• Reminders. Medicine reminders run on your own phone. The name of the medicine is not shown on your lock screen.

Emergency card and your lock screen

The emergency card holds basics a stranger may need if you cannot speak: blood group, allergies, conditions, current medicines and an emergency contact. Fields you choose to show on the lock screen can be read by anyone holding your phone, without unlocking it. That may be a paramedic, and it may also be someone who finds or takes your phone.

• Blood group and your emergency contact are switched on for the lock screen by default, because they help a stranger help you.
• Allergies, conditions and current medicines are off unless you switch them on, and the app asks you to confirm that you understand anyone holding your phone can read them.
• You can change this at any time in the app under Emergency card, in the section Show on the lock screen, including turning off the two defaults.

Registered doctors who use AIDr are set up by us. At launch we do not run a live consultation service, so no consultation data goes to doctors that way. Any doctor who views a Visit Brief you shared sees only that Brief.

Transfers outside India

Some of our providers are companies headquartered outside India, including Google, Twilio and Resend, and our database and storage run on cloud infrastructure that may be located outside India. We cannot tell you in this policy exactly where each provider processes data. As a result, your personal data may be processed or stored outside India. Google's Gemini service processes your chat, images and live audio and video as part of answering you. If you want to know where your data is held, ask the Grievance Officer.

The DPDP Act allows transfer of personal data outside India except to countries the Central Government restricts. We will not knowingly transfer personal data to a country on a restriction list the Government has notified. We rely on our providers' standard data-processing terms, which apply to them in their own right.

How long we keep it

We have not set fixed expiry periods for most of your content. We keep it until you delete it or delete your account, because it is your record and you decide how long it is useful. We do not currently delete inactive accounts automatically: an account you stop using stays until you delete it, so please delete your account if you no longer want us to hold the data. Some things we do limit:

Android automatic backup. The Android app currently allows Android's own backup (Auto Backup). Depending on your phone's backup settings, some of the app's data stored on your phone may be copied to your Google account's backup. We do not control those copies, and deleting your AIDr account does not remove them. You can turn this off in your phone's backup settings.

Apart from the records listed on this page, we do not keep your data for our own purposes after you delete your account. See Delete your account for exactly what is deleted and what is not.

How we protect it

• In transit and at rest. Data travels between your phone and our servers over encrypted (TLS) connections. Stored data is encrypted at rest by our infrastructure provider.
• One set of consent rules. Our services are designed to check the same consent rules before they read or write personal data, and our database is designed to restrict access by those rules. Only you, or someone you manage for, can change a record. A read permission is designed never to become a write permission.
• Private storage. Photos are kept in private storage under your own folder. Our servers decide the path, not the app, and access is through short-lived signed links.
• AI keys stay on the server. Our AI access key is kept in protected server storage. Live calls use a constrained, single-use token with Vidya's instructions fixed in advance.
• Data minimisation in operations. We do not store phone numbers in our sign-in rate-limit records, and we design our logs not to contain names, phone numbers, email addresses or health content. Logs may include technical request details, such as an IP address and error codes.
• Internal messaging is restricted. The service that sends texts and email is designed to be called only by our own back end and to use a fixed set of templates. Caregiver digests and similar messages are sent by email, as described under Family, caregivers and doctors.
• Append-only records. Consent and access logs are designed to be added to, not edited. The only exception is erasure when you delete your account.

We take reasonable steps to protect your information, but we do not hold a security certification or audit report, and we do not claim one. No system is completely secure, and we cannot promise that nothing will ever go wrong. Please keep your phone locked and your sign-in secure, and remember that anything you show on your lock screen can be read without unlocking (see Emergency card and your lock screen).

If something goes wrong

If a personal data breach affects you, we will tell the Data Protection Board of India and the people affected, in the form and within the time the DPDP Act and its Rules prescribe. Our message to you will say what happened, what information was involved, what we are doing, and what you can do to protect yourself. If you think your data or your account has been compromised, write to info@doteventures.com straight away.

Children, guardians and managed profiles

Under the DPDP Act, a child is anyone under 18. The Act sets special rules for a child's personal data, including the involvement of a parent or lawful guardian, and for a person with a disability who has a lawful guardian. It also restricts tracking, behavioural monitoring and targeted advertising aimed at children. AIDr is built for adult account holders. Children appear in AIDr only as profiles that a parent or guardian keeps inside their own account, and AIDr does not run advertising of any kind.

• Who may hold an account. You must be 18 or over to create an AIDr account. We do not check a person's age when they sign up, so this depends on you.
• Managed profiles. You can add a profile for a child or for an elder inside your account. Add one for a child only as their parent or lawful guardian, and add an adult only if they agree or you are their lawful guardian.
• Guardian declaration. To create a profile for someone under 18, the app asks you to declare that you are their parent or legal guardian. We record that declaration. We have no way to independently verify your identity or your relationship to the child. If a profile's age is not known, we treat it with the stricter child protections.
• Extra protections for under-18 profiles. Vidya does not build a memory of facts for that profile.
• Deleting a manager's account. Each managed profile has one manager. If the manager deletes their own account, the profiles they manage are erased too. There is no handover to another person. Copy what you need before you delete.

If you believe a child's information is in AIDr without a parent's or guardian's authority, write to info@doteventures.com and we will act on it.

Your rights and how to use them

The DPDP Act gives you these rights over your personal data. You can use most of them in the app. For anything else, write to the Grievance Officer at info@doteventures.com from the email address or number on your account, so we can match the request to you.

We may need to confirm you are who you say you are before we act, because we do not want to hand your health information to someone else. If we cannot act on a request fully, for example because the law requires us to keep something, we will say what we did not do and why.

Under the DPDP Act, you also have duties: give accurate information, do not impersonate anyone, and do not make false or frivolous complaints.

Grievance Officer and escalation

If you have a question about this policy, want to use a right, or want to complain about how your personal data has been handled, contact our Grievance Officer.

What happens after you write

1. We acknowledge within 24 hours and give you a reference numberSo you can follow up on the same request.
2. We look into itWe may ask you to confirm who you are, or ask a question.
3. We resolve it within 15 days where the IT Rules apply, and in any case within 30 daysYou get a written reply that says what we found and what we did, or why we could not.

These are commitments we make to you. They run from the day we receive your email. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 set the 24-hour and 15-day periods for complaints where they apply to us.

If you are not satisfied

If you are not satisfied with our answer, or we do not respond in time, you can complain to the Data Protection Board of India, as the DPDP Act and Rules provide. The Act expects you to have first raised the matter with us through this process, so please start here.

DPDP notice, item by item

This is the notice the DPDP Act asks us to give you. It stands on its own: for each purpose it lists the personal data, what we use it for, and how to withdraw consent. The sections above give the detail.

Who is asking

Dot eVentures Private Limited (Data Fiduciary), 141 Prashasan Nagar, Jubilee Hills. Contact: Grievance Officer, MN Reddy, info@doteventures.com.

Your rights

Access, correction and completion, erasure, withdrawing consent, grievance redressal and nomination. How to use each, and when we respond, is in Your rights.

How to withdraw consent

In the app under My Privacy, or by writing to the Grievance Officer. As easy as giving it.

How to complain

First to the Grievance Officer at info@doteventures.com; see Grievance Officer and escalation. If you are not satisfied, or we do not respond in time, you can complain to the Data Protection Board of India in the way the DPDP Act and Rules provide; the Board publishes how to do that on its official website.

Where your data goes

To the service providers in Who receives your information, including Google for AI processing, and possibly outside India. See Transfers outside India.

This website: cookies and links

• Cookies and tracking. We do not set cookies of our own on these pages, and they have no analytics, advertising or tracking pixels from us.
• Fonts. To display text, pages load fonts from Google Fonts. When your browser requests them, Google receives your IP address and browser details, as it does when any site uses Google Fonts. Google Fonts is the only third-party resource these pages load.
• Server records. Like any website, the server that delivers aidr.in may record technical request details, such as IP address, time and browser type, for security and to keep the site running.
• Links to other sites. We may link to websites we do not control, such as government health information or app stores. We are not responsible for their content or privacy practices, and their policies apply once you leave AIDr.
• The apps. We have not added analytics, advertising or crash-reporting tools to the apps.

Changes and version history

We will update this policy when AIDr, the law or our practices change. If a change affects how we use your personal data in a way that needs your consent, we will ask for it again, in the app, before the change applies to you. For smaller changes we will update this page and its effective date. We will not take away rights you have under the DPDP Act through a change here.

Languages

The AIDr apps and their consent notices are available in English, Hindi and Telugu. This policy is published in English. Where a translation of any part of it differs from the English text, the English text controls. If you would like this notice explained in another language, write to info@doteventures.com and we will help.

Governing law

This policy is governed by the laws of India. Subject to any right you have under the DPDP Act to complain to the Data Protection Board, and to any right that cannot lawfully be limited, the courts having jurisdiction over our registered office in India have jurisdiction over disputes about it.