1. Scope, document relationship and roles

1.1This Policy applies to visitors, account holders, patients, parents/guardians and pet owners, medical and veterinary professionals, medical astrologers, wellbeing practitioners, interns, sellers, organisation owners/staff and persons communicating with Ayornish, to the extent the relevant Platform functions actually operate.

1.2This Policy is separate from Ayornish End-User Terms & Conditions. Professionals, organisations, educators or sellers may also be subject to separate onboarding, verification and commercial contracts. This Policy is not an independent licence for Ayornish or another provider to access every patient record.

1.3Where Ayornish determines the purpose and means of processing, Ayornish acts as a data controller / Data Fiduciary as applicable. Independent treating professionals, organisations, payment processors and other third parties may also have their own obligations and privacy notices for information under their control. The precise roles depend on the actual transaction and applicable law.

2. The personal data we may handle

2.1Identity and account data: name, date of birth or age where needed, contact number, email address, gender where voluntarily and relevantly supplied, login/session identifiers, OTP verification status, account role, language, communications and consent records.

2.2Practitioner/organisation data: qualifications, registration/licence numbers, professional memberships, addresses and workplaces, expertise, availability, profile photos, identity and verification documents, organisation/branch details, authorised staff roles, supporting evidence and business contacts.

2.3Health and care data: patient or dependent profile, medical history, symptoms, allergies, medicines, prescriptions, reports, diagnosis-related records and uploads, consultation notes, appointment details, selected provider, follow-up status, permitted referrals and patient-directed sharing.

2.4Wellbeing and sensitive contextual data: concerns selected for counselling or coaching, appointment/session messages, mental or emotional wellbeing information disclosed by users, private practitioner session notes where the feature permits them, and related documents. Such information warrants particularly limited, purpose-specific access.

2.5Veterinary information: pet identification, species, age, vaccination, treatment, boarding or care history and related owner contact details; any personal data relating to an identifiable owner or staff member remains protected.

2.6Financial and transaction data: payment amount, orders and booking references, payment gateway confirmation/status, refunds, wallet/credit ledger entries, fee and tax items, invoices, provider payout or KYC details if required and authorised. Full card credentials, UPI PINs and bank OTPs must be entered only into authorised payment interfaces; Ayornish does not ask users to submit them by chat or support.

2.7Optional tools and services: data you choose to enter into BMI, baby-growth, Prakriti/Vikriti and comparable trackers, Ask Ayornish queries, voluntary birth details for astrology/kundli services, learning enrolment data and uploaded educational material where such features are enabled.

2.8Technical and safety data: approximate device/network details, IP address, browser, security logs, login and audit events, request diagnostics, cookies and similar identifiers used for sessions, security, service performance and, where enabled and lawfully configured, analytics.

2.9We aim to request information reasonably relevant to the service being used. Some fields are mandatory for a requested function; optional fields are identified through the relevant interface where feasible. Public browsing need not entail creating a medical profile.

3. Sources of information

3.1Data may come directly from you; from an authorised parent, guardian, representative or provider; from verification documents you upload; from authorised professionals/organisations documenting care; from payment and communication providers reporting transaction or message status; or through the functioning of the site.

3.2You should supply only information you are authorised to provide. Uploading someone else’s patient report, identification document, consultation content or payment data without lawful authority may breach privacy and the Terms. We may seek further verification or restrict access where appropriate.

4. Why Ayornish processes data

4.1Account and identity: registration, OTP and login, role verification, session management, account recovery, preventing duplicate or fraudulent use and responding to access requests.

4.2Discovery and bookings: showing relevant providers, professional qualifications and practice locations; enabling search, slots, appointment requests, confirmation, rescheduling and operational notifications.

4.3Requested care workflows: sharing necessary information with the selected/authorised professional, recording permitted notes and prescriptions, handling follow-ups, patient-directed referrals and permitted access to documents. Independent professional decisions remain with the professional.

4.4Payments and commercial operations: payment initiation/confirmation, gateway reconciliation, separate provider/platform charges, refunds, wallet credits, invoices, accounting records, provider payouts, tax and anti-fraud checks.

4.5Safety, compliance and support: access controls, audit logs, platform integrity, prevention of misuse, investigation of complaints, service incidents, applicable legal duties, enforceable requests and dispute resolution.

4.6Optional service functionality: wellness trackers, saved chart details, chosen communications and enabled learning/marketplace features. Where separate permission is required for record sharing, marketing, consultation recording or another purpose, that separate decision must be obtained; general Terms acceptance is not enough.

4.7Service administration: reliable delivery, troubleshooting, secure infrastructure, measuring platform performance with appropriately configured, proportionate data and improving navigation or support quality within applicable legal limits. Health or private consultation data is not thereby granted for unrestricted advertising or unrelated profiling.

5. Lawful processing, consent and choice

5.1Ayornish processes personal data only on an applicable lawful basis, including valid consent or other grounds permitted by the law in force for the relevant activity. The relevant notice or consent prompt must explain the information and purpose with sufficient clarity. Nothing in this Policy should be read as requiring a user to consent to optional activities merely to use unrelated essential services.

5.2Creating an account requires active acceptance of the End-User Terms and acknowledgement of this Policy. A checkbox confirming contractual terms is not, by itself, a blanket consent for targeted marketing, consultation recording, unrestricted medical-history sharing, publication of testimonials, or unrelated data uses.

5.3When consent is required, users may withdraw it using the controls or contact route provided for that specific activity, subject to applicable law and reasonable verification. Withdrawal generally affects future consent-based processing; it may limit the relevant service and does not automatically erase records lawfully retained for clinical, transactional, legal or security reasons.

5.4Where the Platform proposes materially new personal-data purposes requiring fresh consent, Ayornish will give the applicable notice and seek the legally required choice before beginning that processing. Preferences and withdrawal requests should be recorded and enforced where applicable.

6. Who may receive information

6.1Your selected independent provider: appointment, contact and care information appropriate to the booked service; additional records only where their access is lawful and authorised. A professional’s separate treatment records may be governed by their professional responsibilities and applicable law.

6.2Authorised practice staff and organisations: strictly role-appropriate information to fulfil bookings, care administration, referrals and record handling; access is limited by the actual account permissions and service context.

6.3Selected pharmacies, laboratories, diagnostic centres or referral professionals: only for a feature or request that lawfully authorises the identified recipient and relevant information. Accepting the general Terms does not automatically disclose full records to nearby businesses.

6.4Technical service providers: hosting, storage, messaging/email/OTP, cloud operations, video conferencing and payment gateway services necessary for a transaction or enabled function. Illustrative currently planned or used integrations include Google Meet/Calendar and Razorpay; integrations may change. Third parties can have their own privacy notices and legal obligations.

6.5Payment, audit, legal and regulatory recipients: authorised payment partners, banks, auditors, professional advisers, competent authorities and dispute forums where required or lawfully justified.

6.6With the appropriate lawful basis we may transfer relevant information in a corporate restructuring, provided applicable notice and protection requirements are met. We do not treat this Policy as permission to sell identifiable patient records for unrelated advertising.

7. Sensitive care records and access separation

7.1A public profile, patient record, professional workspace, consultation chat, private wellbeing note, prescription, payment record and public review are different data types and must not be treated as universally visible to every account or Platform partner.

7.2The patient or authorised guardian may be able to direct sharing of a selected record or prescription with a named practitioner, pharmacy or diagnostic recipient where that feature is available. Each recipient, purpose and scope must follow the workflow and lawful permissions. Referrals and clinical transfers may require separate prompts and audit trails.

7.3Clinical and wellbeing records may require retention by the treating professional, and certain practitioner-created private notes may be subject to a different access position than patient-uploaded files. Any access, correction or copy request will be assessed under the applicable law and actual controller/recordkeeper role.

7.4Consultation recording, where offered, requires appropriate disclosure and permissions. The mere creation of an online meeting or booking is not permission to record, broadcast or market a patient’s consultation.

8. Children, dependants and representatives

8.1An individual account holder should be legally eligible to register. For care relating to a child, dependent or another person/pet, the parent, lawful guardian or authorised representative must act within the authority allowed by law and any required care or data-protection consent rules.

8.2Ayornish may require additional verification of age, relationship, guardian status or authorisation for sensitive records or professional services. This Policy does not authorise independent minor registration where the current product rules require guardian-led access.

8.3Where statutory requirements for children’s data, verifiable consent or other special safeguards become applicable, the affected processing must satisfy them before continuing. This policy does not assume an exemption.

9. Payment information and Ayornish Wallet

9.1Payments may be processed by independent gateway providers. Ayornish may hold the transaction reference, status, method description, masked details where supplied, charge breakdown, refund history and wallet/credit ledger necessary to provide the service and reconcile accounts.

9.2Ayornish does not request your card CVV, UPI PIN, bank OTP or full gateway credentials through the Platform’s ordinary care messaging, support email or clinician workspace. Never send them to providers or purported Ayornish representatives.

9.3Wallet/account credit is governed by the applicable payment and refund terms. Record-keeping for credits, platform fees, disputes and fraud prevention can continue where the law requires it after an account closure request.

10. External video, websites and communications

10.1A video consultation may use Google Meet or a different clearly disclosed provider. A third-party tool may independently process device and connection information under its own policies. The Platform cannot promise that a third-party network is continuously available.

10.2Links to providers, pharmacies, educational or third-party websites do not make those services part of Ayornish’s data practices. Review the recipient’s policy before providing information directly to it.

10.3OTPs and essential security, booking, payment and consultation notices may be sent by configured email, SMS or other service channels. Unrelated marketing uses require the appropriate lawful choice; unsubscribe/opt-out options should be respected where available and required.

11. Cookies, session storage and analytics

11.1Ayornish may use cookies, local session mechanisms and similar technologies to authenticate users, secure sessions, store necessary preferences, defend against abuse and operate features. Certain cookies may be essential to requested services.

11.2If analytics, performance monitoring or optional tracking technologies are deployed, the actual live tools, providers, purposes, cookie lifetimes and choices must be accurately disclosed in an appropriate cookie notice or settings interface where required.

11.3Browser settings can restrict cookies but may affect sign-in or protected workflows. A marketing/third-party tracking consent banner should not be claimed to exist unless actually implemented.

12. Storage, security and incident response

12.1Ayornish may store information using controlled databases, cloud hosting, protected file storage and authorised service providers. We aim to maintain access restrictions, authentication, encryption where appropriate, audits, role segregation, backups and reasonable security practices proportional to the data and risks.

12.2No internet service can guarantee absolute security. Users should protect their devices, passwords and OTPs, use official Platform links and report suspected unauthorised account access.

12.3Where an incident triggers a legal notification, reporting or mitigation duty under the law then in force, Ayornish will address that duty through the applicable processes. This Policy does not create an unconditional guarantee against outages, breaches or loss.

13. Data location and international service providers

13.1Information may be processed using infrastructure and contracted processors in India or other permitted locations depending on the actually enabled services. Some communications, analytics, video and cloud providers may operate globally.

13.2Cross-border transfers, localisation or restricted-country requirements will be handled under the law applicable to the particular data and service. Ayornish must not promise an India-only hosting location or a specific processor country without checking its current deployment.

14. Retention, deactivation and deletion

14.1Ayornish intends to retain information only as long as needed for the purposes for which it was collected and for lawful clinical, financial, tax, security, anti-fraud, audit, regulatory and dispute-resolution requirements. The period may differ by record type, controller, feature and legal obligation.

14.2Account closure does not necessarily delete active bookings, payment ledgers, independently maintained professional clinical records, legally required logs or records under dispute. Where deletion is permitted and applicable, data will be removed or de-identified under a documented process and appropriate verification.

14.3A detailed retention schedule (including records, backups, access logs, OTPs, abandoned registrations, support tickets and optional wellbeing notes) must be aligned with implemented systems and legal review before publication. No blanket universal retention period is promised in this draft.

15. Access, correction, grievances and other rights

15.1Subject to the rights available under applicable law and appropriate identity/authority verification, you may request information about processing, access or copies of eligible data, correction or completion of inaccurate data, erasure where required, and help with consent withdrawal, account closure or a grievance.

15.2To submit a request, contact ayornish@gmail.com and describe the account or service involved without emailing unnecessary full medical reports or passwords. Ayornish may need to verify identity and refer requests for independent clinical records to the responsible practitioner or organisation.

15.3Where and when provided by law, further rights and complaint/escalation routes will be honoured, including nomination or authority representation. Statutory deadlines and regulatory processes apply according to their actual commencement and applicability—not simply the draft publication date of this Policy.

15.4Users may also contact the Platform grievance officer identified below for a service or content grievance. Mandatory regulatory, consumer and medical-professional grievance rights remain unaffected.

16. Medical, wellbeing and automated-content safeguards

16.1Ask Ayornish, wellness and growth tools, search recommendations, educational materials, astrology or other automated features may produce incorrect or incomplete information. These tools should not be relied upon as clinical diagnosis or emergency instructions.

16.2Information voluntarily entered in mental/emotional wellbeing features or session communications should be accessible only to the intended authorised participants and support/admin personnel with a lawful need as supported by the system. General acceptance of this Policy does not authorise public display or broad secondary use of identifiable wellbeing disclosures.

16.3Public reviews, if available, are a separate publishing action. Private health information should not become public merely because a user books, messages or uploads a file. Any proposed use of identifiable testimonials or treatment records for marketing requires appropriate separate authorisation.

17. Public profiles and professional verification

17.1Professionals or organisations choosing public listing may supply display names, qualifications, practice addresses, specialties, availability, profile images and published portfolio details for discovery. Personal contact details or private supporting documents are not automatically public unless the interface and lawful permissions provide for disclosure.

17.2Verification, profile visibility, paid listing and approval decisions may require document review and audit records. Verification indicators describe the Platform’s stated checks; they do not promise clinical outcomes or that every professional is suitable for every patient.

17.3An organisation’s authorised owner/admin and staff may have different access entitlements. The Platform should enforce relevant tenant, organisation, branch and role boundaries; this notice does not create new permissions.

18. Changes to this Privacy Policy — Ayornish reserved rights

18.1Ayornish expressly reserves the right, in its own discretion and from time to time, to review, revise, amend, supplement, update or replace this Privacy Policy, including because of product changes, service additions or discontinuations, technology and security developments, processing arrangements, commercial operations, law, guidance or regulatory requirements.

18.2Each published update will identify the updated Policy version and effective date. The revised Policy may become effective on the date stated in the published version, subject to legal requirements for notice, reasonable communication, and, where legally required, fresh or specific consent for materially changed processing.

18.3We may notify users through a website notice, account interface, email or another appropriate channel where needed. Existing personal data will not be used for a materially new purpose without the required lawful basis, notice or consent. A statement that Ayornish may amend this Policy does not waive statutory data rights or retrospectively authorise past unlawful processing.

18.4Prior versions and relevant acceptance/consent evidence may be retained where lawfully necessary to document what terms or notices applied to a particular account, transaction or date. Users should refer to the current effective version displayed on the official Platform.

19. Platform Terms, severability and limits

19.1The End-User Terms govern contractual use of the Platform; this Policy describes personal-data practices. Service-level booking, payment, professional and clinical disclosures apply when presented for the actual transaction or function.

19.2Nothing in this Policy limits an independent professional’s mandatory confidentiality duties or the User’s non-waivable rights. If any part of this notice becomes legally ineffective, its remaining provisions apply to the extent lawful.

19.3This Policy does not warrant that a future feature is already launched, guarantee any specific security certification or promise indefinite access to all data. The published Policy must be verified against the active Product and infrastructure.

20. Contact, complaints and publication details

Where applicable, further complaint or regulatory channels will be provided in accordance with the legal requirements then in force.

Operator / Data Fiduciary

Ayornish

Correspondence address

C2-203, GT Life Space, Sector 30, Naya Raipur, Chhattisgarh, India

Customer service and privacy requests

Ayornish Support & Grievance Desk · ayornish@gmail.com

Grievance contact

Ayornish Support & Grievance Desk · ayornish@gmail.com

Website

https://ayornish.com