Privacy Policy

Version 3.1 · Effective 2026-09-01

PP.1. Who We Are

Nanak Naam Enterprises Private Limited (CIN: U56100UP2025PTC233798), registered office at D-19/213, S.K. Apartment, Sector 51, Noida, Gautam Buddha Nagar, Uttar Pradesh – 201301, India, operating under the brand OjaFertility ("the Company", "we", "us").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Company is the Data Fiduciary in respect of the personal data described below. You are the Data Principal.

Please read PP.9 (Your Rights) — it tells you how to see, correct, delete, or nominate someone in respect of your data.

PP.2. A Note on Sensitivity

Fertility data is among the most sensitive information a person can share. It can reveal reproductive history, pregnancy loss, sexual activity, medication use, genetic information, and mental health. We treat it accordingly, and we have written this Policy to be read rather than skimmed.

PP.3. What We Collect

3.1 Information you give us

PP.4. Why We Use It, and On What Basis

We process your data for the following distinct purposes. You consent to each separately (see PP.5).

Purpose

What this involves

Basis

Core service

Account, health records, trackers, assessments, bookings, payments

Consent

Sharing with your Provider

Sending health information to the doctor, clinic or lab you book with

Consent, per booking

Support and communications

Queries, appointment reminders, service notices, security alerts

Consent / necessary for service

AI features

Operating AskOja; improving AI quality using de-identified content (opt-out available)

Consent

Analytics and improvement

Understanding Platform use in aggregated or de-identified form

Consent

Marketing

Offers, content and campaign communications by email, SMS or WhatsApp

Separate opt-in — never a condition of use

Legal and safety

Complying with law, preventing fraud, enforcing Terms, defending claims

Legal obligation

★ We do not sell your personal data. We do not use your health data for advertising.

PP.5. Consent

5.1 We ask for your consent through a specific, itemised consent flow at signup — not merely by your use of the Platform. Each purpose (P1–P7) is presented separately, and you may accept some and decline others.

5.2 P6 (marketing) is strictly optional. Declining it does not affect your access to the Platform or any paid service.

5.3 We keep a record of the consent you gave, when, and against which version of this Policy.

5.4 Withdrawing consent.

You may withdraw any consent at any time from your account settings, or by writing to privacy@ojafertility.com. Withdrawal is as easy as giving consent. Withdrawing P1 (core service) means we can no longer operate your account — we will give you 30 days to export your health records first.

5.5 Language.

This Policy is available in English and in Hindi. You may request it in any language listed in the Eighth Schedule to the Constitution by writing to us.

PP.6. Who We Share It With

We share personal data only as described below. We do not sell it and do not share it with data brokers.

Recipient

What they receive

Why

Providers you choose

Health information relevant to your consultation or test

To provide your care (P2)

Diagnostic laboratories

Name, contact, test ordered, clinically relevant details

To perform tests you book

Cloud hosting — (Eg. Amazon Web Services)

Encrypted storage and processing of Platform data

Infrastructure

AI model provider — (Ex. Anthropic Inc.,USA)

AskOja conversation content

To generate responses (P4)

Payment gateway

Billing details and transaction data

To process payments

Communications providers

Mobile number, email

SMS, email, WhatsApp messages

Analytics providers

Usage and device data, pseudonymised

Product analytics (P5)

Professional advisers and authorities

As required by law

Legal and safety (P7)

6.1 Every processor is bound by contract to process data only on our instructions, apply reasonable security safeguards and not use it for their own purposes.

6.2 Providers are independent. Once a Provider receives your data for the purpose of treating you, they handle it under their own obligations and professional duty of confidentiality. Our Provider Terms require them to keep it confidential, not use it for marketing, and not use it to train any AI model.

6.3 Business transfer. If we are involved in a merger, acquisition or asset sale, your data may transfer to the successor, who will be bound by this Policy or one no less protective. We will notify you.

PP.7. Where We Store It and For How Long

Storage location

Data is hosted on Amazon Web Services, primary region ap-south-1 (Mumbai). Some processing takes place outside India — through the AI model provider (Anthropic Inc., USA) and analytics and communications services — subject to contractual data protection safeguards and section 16 of the DPDP Act.

Retention periods

Data

Retained for

Health records and clinical documents

3 years from last activity or last record entry, whichever is later

Account and profile data

Duration of account, then 90 days

AI conversation logs

12 months

Transaction and invoice records

8 years (Companies Act and tax law)

Support and complaint correspondence

3 years from closure

Marketing data

Until you opt out, then deleted within 30 days

Device and usage analytics data

24 months, pseudonymised

Consent records

Duration of account plus 3 years

Data subject to pending dispute or proceeding

Until final disposal

7.1 When a retention period ends, we delete the data or irreversibly de-identify it.

PP.8. Cookies and Tracking

8.1 We use cookies and similar technologies for essential functionality, session management, remembering preferences, and analytics.

8.2 We do not use advertising, retargeting or third-party marketing pixels on this Platform. Fertility browsing behaviour is sensitive and we do not share it with advertisers.

8.3 You can manage cookies through your browser settings. Disabling essential cookies may prevent the Platform from functioning correctly.

PP.9. Your Rights

Under the DPDP Act you have the following rights. Write to privacy@ojafertility.com or use your account settings. We will respond within 30 days.

Right

What it means

DPDP section

Access

Obtain a summary of personal data we process about you, the purposes, and who it has been shared with

s.11

Correction and completion

Have inaccurate data corrected, incomplete data completed, outdated data updated

s.12(1)

Erasure

Have your personal data deleted, unless retention is required by law

s.12(3)

Data portability

Receive a copy of your health records in a usable format to take to another provider

—

Withdraw consent

Withdraw any consent at any time as described in PP.5.4

s.6(6)

Nomination

Nominate someone to exercise your rights on your behalf in the event of your death or incapacity

s.14

Grievance redressal

Raise a complaint with us; escalate to the Data Protection Board if not resolved

s.13

★ On nomination: for a fertility platform, a nominee determines who can access, transfer or delete your stored records if you die or become unable to act. We encourage you to set one in your account settings.

PP.10. Security

10.1 We implement reasonable security safeguards including: encryption of data in transit (TLS) and at rest; role-based access control; access logging and periodic review; multi-factor authentication for administrative access; periodic vulnerability assessment and penetration testing; contractual security obligations on all processors; and staff confidentiality training.

10.2 No system is completely secure. We cannot guarantee absolute security. You can help by using a strong, unique password and not sharing your credentials.

PP.11. If There Is a Data Breach

11.1 If a personal data breach occurs affecting your data, we will notify the Data Protection Board of India and you without undue delay, as required by section 8(6) of the DPDP Act.

11.2 Our notice to you will describe: the nature and extent of the breach, when it occurred, likely consequences for you, measures we have taken, what you should do to protect yourself, and a contact for further information.

PP.12. AskOja and AI Features

12.1 Conversations with AskOja are personal data and are covered by this Policy.

12.2 AskOja conversation content is processed by Anthropic Inc. (USA), a third-party AI model provider. That provider is contractually barred from using your conversation content to train its own models.

12.3 Conversation logs are retained for 12 months and used to operate the service and investigate safety issues.

12.4 We may use de-identified conversation content — from which no individual can be identified — to improve AskOja's quality and safety. You may opt out of this at any time from your account settings.

12.5 You can delete your conversation history at any time from your account settings.

12.6 AskOja does not make decisions that produce legal effects for you. Its outputs are informational only.

PP.13. Children

13.1 The Platform is for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.

13.2 We do not conduct behavioural monitoring of, or targeted advertising directed at, children.

13.3 If we become aware that a user is under 18, we will suspend the account and delete the data, except where law requires retention. Contact privacy@ojafertility.com if you believe a minor has provided us data.

PP.14. Marketing Communications

14.1 We send marketing communications only with your separate opt-in consent (P6). This is never a condition of using the Platform.

14.2 You can opt out at any time using the unsubscribe link in any email, by replying STOP to an SMS or WhatsApp message, or through your account settings. We will action it within 7 days.

14.3 Service communications — appointment reminders, payment receipts, security alerts, and changes to this Policy — are not marketing and will continue while your account is active.

14.4 Our SMS and WhatsApp communications are sent through DLT-registered templates in compliance with TRAI regulations.

PP.15. Changes to This Policy

15.1 We may update this Policy. The revised version will be posted with a new "Last Updated" date.

15.2 For material changes — new purposes, new categories of recipient, new cross-border transfers, or longer retention — we will notify you by email at least 30 days in advance and, where required, ask for fresh consent.

15.3 Previous versions are available on request.

Data Protection Contact: privacy@ojafertility.com

Grievance Officer (IT Act): Hardeep Singh · care@ojafertility.com · +91 9289499200

Escalation: Data Protection Board of India — s.13(3) DPDP Act 2023

This Policy was last updated on 1 September 2026 and replaces the version dated 22 April 2026.