Privacy Policy
Last updated 17 October 2026
This policy explains what personal and health-related data Ayunila collects, how it is used, and the choices available to clinics and their patients. We treat patient health information with particular care.
Scope
This policy covers ayunila.com, ayunila.app and the Ayunila application used by clinics ("clinics", "you") and, through them, by the clinics' patients. Each clinic that signs up for Ayunila controls the patient data it enters — see "How this fits together with your clinic" below.
Information we collect
We collect three broad categories of information:
- Clinic and staff account data — clinic profile and GSTIN, staff names, roles, email addresses, phone numbers, login credentials and session/device information.
- Patient records entered by the clinic — demographics, appointment and visit history, prescriptions, lab orders and results, vitals, and billing and payment records. This data belongs to the clinic; we process it to run the product.
- Technical and usage logs — IP address, browser and device information, timestamps, and system logs kept to operate, secure and troubleshoot the service.
How this fits together with your clinic
For patient data, your clinic decides what is collected and why — it is the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Ayunila acts as the data processor, handling that data only to provide the service to the clinic. Our Data Processing Addendum (/legal/dpa) sets out this relationship in full.
Lawful basis for processing
We and the clinics using Ayunila rely on the following bases to process personal data:
- Consent — captured from patients for things like appointment reminders, promotional messages, and sharing records across branches of the same clinic group. Patients can review and change these choices at any time.
- Contract — to provide the Ayunila service to the clinic that signed up.
- Legal obligation — to meet record-keeping and other requirements that apply to healthcare providers in India.
- Legitimate use — for security, fraud prevention, and keeping the service running.
How we use information
- To operate the appointment, queue, consultation, pharmacy, lab and billing workflows the clinic uses day to day.
- To send the messages the clinic configures — appointment reminders, prescription and bill notices, and (only with consent) promotional messages.
- To provide customer support and respond to requests from the clinic or its patients.
- To secure the service, detect abuse, and meet legal and audit obligations.
Data isolation between clinics
Ayunila is multi-tenant: every clinic's data is logically separated from every other clinic on the platform, and staff access is scoped to the clinic and branch they belong to. A clinic never sees another clinic's data.
Security measures
- Sensitive clinical fields are encrypted in our database.
- Access to the product is controlled by role-based permissions, so a given staff member only sees what their role needs.
- Access to patient records is recorded in an audit trail.
- Two-factor authentication (TOTP) is available for staff accounts, and login and OTP endpoints are rate-limited.
- Traffic to and from Ayunila is encrypted in transit (HTTPS/TLS).
More detail is on our security page: /legal/security.
Retention
We retain personal data for as long as the clinic's account is active and as needed to provide the service. Medical records are subject to retention requirements under Indian law and professional regulations that apply to the clinic, so they are kept for the period the clinic is required to keep them — even after a patient asks for their data to be erased. In that case, we remove the identifying details (name, contact information, and similar identifiers) from the record rather than deleting the clinical record itself.
Sub-processors
Depending on the clinic's plan and configuration, we share limited data with:
- Cloud hosting and file-storage providers, to run the application and store files.
- Payment gateway providers (for example Razorpay, Cashfree or PayU, depending on the clinic's setup), to process online payments.
- WhatsApp Business messaging providers (for example Meta's Cloud API or Interakt), to deliver reminders and notifications the clinic sends.
Each is bound to only use the data to provide their service to us.
Your rights under the DPDP Act
If you are a patient of a clinic on Ayunila, you have the right to access, correct and (subject to the retention rules above) request erasure of your personal data, and to withdraw consent you previously gave.
Patients can exercise most of these rights directly: the patient portal's Privacy page lets you review and change consent for reminders and marketing, download a copy of your data, and submit an erasure request to the clinic.
If you are not a registered patient, or need help beyond what the portal offers, contact the clinic that treats you directly, or write to us using the details below.
Changes to this policy
We may update this policy as the product or applicable law changes. Material changes will be reflected by an updated "Last updated" date on this page.
We use Cloudflare Turnstile on public forms to detect automated abuse. This processes browser and device signals under Cloudflare’s Turnstile Privacy Addendum. Google sign-in for authorized platform administrators uses the Google account’s verified email and account identifier.
[TODO: owner to appoint and publish the name and direct contact details of a Grievance Officer / Data Protection Officer as required under the DPDP Act, and add them here.]