Snapshot 90524
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy How Samyama collects, uses, and protects your information Privacy Policy for Samyama Operated by: VaidhyaMegha Private Limited Effective Date: 1-June-2025 Next Update: 1-Dec-2025 1.Introduction Welcome to samyama.ai, a product and property of VaidhyaMegha Private Limited (“VaidhyaMegha”, “we”, “our”, or “us”). This Privacy Policy outlines our strict commitment to the collection, use, disclosure, storage, protection, and retention of your data—with zero tolerance for misuse or leakage. We treat data privacy and user consent as fundamental rights. Our practices strictly comply with the Information Technology Act, ISO/IEC 27001, and future DPDP Act readiness. 2. What This Policy Covers This policy applies to all data interactions via samyama.ai, including redirections from vaidhyamegha.com, user interactions, offline initiations, and communications through linked channels. 3. Data We Collect We operate on data minimization and purpose limitation. We collect: Personal Data: Name, contact, ID (if consented), company, etc. Technical Data: IP, browser, OS, timestamps, etc. Sensitive Data: Only if required, fully encrypted and secure. No ad trackers, behavioral profiling, or dark patterns. 4. Purpose of Data Collection We collect and use your data only for legitimate, explicitly stated, and narrowly defined purposes. These include: Account creation and service provisioning To enable authentication, manage user sessions, and provide access to platform-specific services, tools, and APIs. Security and fraud prevention To protect user accounts, detect unauthorized access, monitor anomalies, and enforce security protocols. Compliance and regulatory support To meet obligations under applicable Indian and international data protection laws, health-tech guidelines, financial compliance (e.g., KYC/AML), and any court-ordered mandates. No data is used for advertising, marketing, or profiling unless you have explicitly opted in. We do not engage in behavioral advertising, third-party profiling, automated decision-making, or retargeting based on your personal data by default. 5. Data Sharing and Disclosure We do not sell, rent, trade, or disclose your personal data to any third party for commercial purposes. Data sharing occurs only under tightly controlled circumstances, and only when strictly necessary for legitimate operations, legal compliance, or service provisioning. Data may be shared only with the following entities: Authorized Employees of VaidhyaMegha Private Limited Access is granted strictly on a “need-to-know” basis. All employees are bound by formal Non-Disclosure Agreements (NDAs), confidentiality clauses in employment contracts, and internal access control policies. Regular audits are conducted to monitor and log access. Trusted Third-Party Service Providers and Subprocessors These include cloud infrastructure providers, payment processors, secure email delivery systems, and compliance support tools. Every third-party processor is contractually obligated to maintain confidentiality, implement industry-standard security, and process data only under our instructions. We only engage vendors that are certified under standards like ISO/IEC 27001, SOC 2 Type II, or GDPR-compliant frameworks. Governmental, Regulatory, or Legal Authorities Only in response to valid legal obligations such as court orders, subpoenas, regulatory mandates, or applicable law enforcement requests. Where possible, users will be notified in advance unless prohibited by law. We strictly prohibit: Sale of personal data under any circumstance Sharing for advertising, marketing, or profiling Unsupervised third-party analytics Each sharing instance is logged, reviewed, and periodically audited for compliance with data protection laws and internal governance. 6. Data Storage and Security We are committed to protecting your personal data through rigorous technical, organizational, and administrative controls. All information collected on Samyama is stored and secured in accordance with globally recognized best practices, including ISO/IEC 27001, and Indian IT Act 2000 (with 2008 amendments). Our security framework includes the following controls: Encryption Standards AES-256 encryption is applied to all data at rest, ensuring strong protection of stored information within our cloud infrastructure. All data in transit is protected using TLS 1.3 or higher, ensuring end-to-end security during communication between your browser/device and our servers. Access Management and Role Control Access to personal or sensitive data is governed by Identity and Access Management (IAM) protocols. Users, employees, and systems are assigned role-based permissions, following the principle of least privilege. All elevated access is time-bound, auditable, and requires multi-factor authentication (MFA). Perimeter and Internal Security Our servers and applications are protected using firewalls, intrusion prevention systems (IPS), and anti-DDoS protections. The infrastructure is built on a Zero Trust security architecture, meaning no implicit trust is granted to any user or system, regardless of location or network origin. Audit Trails and Monitoring Every access, configuration change, and data transaction is fully logged and monitored. Logs are securely stored for a minimum of 24 months and reviewed periodically for anomalies and unauthorized access attempts. Independent security audits and vulnerability assessments are conducted regularly by external cybersecurity firms. Hosting & Data Residency All data is stored on secure cloud infrastructure located within India, unless otherwise consented or mandated for cross-border regulatory interoperability. 7. Data Retention We retain personal and system-generated data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law, regulation, or contractual obligations. Data retention periods are reviewed annually, and deletion is carried out in accordance with our internal data lifecycle management policy and security protocols. Retention Periods by Data Category: User Account Data Includes names, contact information, login credentials, authentication records, and user preferences. Retention Period: Up to 5 years following the last recorded activity or account closure, unless an earlier deletion is requested and legally permissible. Health and Medical Information Any personal health data submitted voluntarily through AI medical assistance modules or virtual consultations. Retention Period: 3 years, in line with healthcare data guidelines. Users may request earlier deletion of this data, subject to verification and absence of regulatory holds. System and Operational Logs Includes access logs, error logs, and security-related metadata. Retention Period: 6 months, unless linked to ongoing investigations or system diagnostics. Financial and Transactional Records Covers billing information, payment history, transaction IDs, invoices, and associated metadata. Retention Period: Up to 8 years, to comply with Indian accounting standards, tax laws, and audit requirements. Deletion and Archival Protocols: All deletion operations are irreversible and follow secure data destruction methods such as crypto-shredding or zero-fill overwriting. Archived data (where applicable) is encrypted and access-restricted. On expiry of a retention period, data is either permanently deleted or anonymized for statistical use, with no linkage to the original identity. 8. User Rights and Controls We recognize and uphold your fundamental rights as a data subject. In accordance with applicable privacy regulations—such as the General Data Protection Regulation (GDPR), the Indian IT Act, and emerging frameworks like the Digital Personal Data Protection (DPDP) Act—you are entitled to full transparency, control, and autonomy over your personal data. You have the right to: Access Your Data Request a summary of all personal data we hold about you, including the purposes of processing, categories of data, and any third parties with whom it has been shared. Rectify Inaccurate Data Request correction or completion of incomplete, outdated, or inaccurate personal information maintained in our systems. Erase Your Data (Right to Be Forgotten) Request the permanent deletion of your personal data, subject to regulatory exceptions (e.g., compliance, financial records, legal claims). Restrict Processing Limit the processing of your data where accuracy is contested, or processing is unlawful but you object to deletion. Object to Processing Object to data processing based on legitimate interest, direct marketing, or profiling, even if initially consented to. Data Portability Obtain a copy of your personal data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and transfer it to another service provider upon request. How to Exercise Your Rights To exercise any of the above rights, please contact our Data Privacy Office: Email: contact@samyama.ai All requests will be acknowledged within 72 hours and fulfilled within 15 working days, subject to identity verification and applicable exemptions. Please note: For sensitive requests (e.g., medical data deletion), we may require multi-factor verification to prevent unauthorized access or tampering. 9. Children’s Privacy The services provided by Samyama are not intended for use by individuals under the age of 16. We do not knowingly solicit, collect, or process personal data from children or minors without verifiable parental or guardian consent, in accordance with applicable laws such as: Section 43A of the Indian IT Act COPPA (U.S. – Children's Online Privacy Protection Act) GDPR Article 8 (EU/EEA) Policy Enforcement: If it is discovered that a child under the age of 16 has submitted personal data—with or without intent—we will: Promptly delete the data from our systems; Attempt to notify the child’s parent or legal guardian, if identifiable; Prevent future submissions by that user through flagging and IP/account restrictions. User Responsibility: We encourage parents and guardians to monitor their children’s online activity and guide them in using internet platforms responsibly. If you believe your child has submitted personal information to Samyama in error, please contact us immediately at: Email: contact@samyama.ai 10. International Data Transfers At present, all personal and sensitive data collected via Samyama is stored and processed exclusively within data centers located in India. Our infrastructure providers are bound by strict data residency requirements and comply with Indian IT security regulations and international data protection frameworks. Cross-Border Transfers (If Applicable in Future) If at any time in the future it becomes operationally necessary to transfer personal data outside of India—for example, to trusted subprocessors, regulatory authorities, or for interoperability with global services—we will ensure such transfers are handled with the highest level of legal and technical safeguards, including: GDPR-Compliant Transfer Mechanisms All international data transfers will be governed by: Standard Contractual Clauses (SCCs) approved by the European Commission; Adequacy decisions (where applicable); Binding Corporate Rules (BCRs) for our group entities (if structured). Contractual and Technical Protections Third-country recipients will be subject to: Enforceable contractual obligations on data protection; Independent audits; Encryption and access control requirements; Non-disclosure agreements and limited data usage rights. Transparency and User Notification We will notify affected users before initiating any cross-border transfer involving their personal data and offer options to opt out where feasible. No Transfers Without Legal Basis We will never transfer your personal data outside India without a lawful basis, nor without ensuring it receives an equivalent or higher level of protection as required by Indian and international privacy laws. 11. Policy Updates We reserve the right to modify or update this Privacy Policy periodically to reflect changes in: Legal or regulatory requirements (e.g., new data protection laws); Our internal data handling practices; The scope of services offered on Samyama; Technological advancements or security enhancements. How We Notify You To ensure transparency, we will provide advance notice of any material changes: Notification Timeline: At least 15 calendar days prior to the effective date of the updated policy. Notification Channels: A prominent announcement banner or modal on the samyama.ai website; Direct email communication to registered users (if applicable). User Acknowledgment Continued use of the Samyama platform after the effective date of the revised policy shall constitute your acceptance of the updated terms. If you do not agree with the changes, you have the right to request account deletion or contact our privacy team with any concerns before the changes take effect. 12. Data Breach Notification At Samyama, we implement stringent security measures to prevent unauthorized access, misuse, or compromise of personal data. However, in the rare event of a personal data breach (as defined under applicable law), we follow a clear, time-bound incident response protocol to protect your rights and comply with regulatory mandates. Our Notification Policy Includes: User Notification Timeline We will notify affected users within 72 hours of becoming aware of a confirmed data breach involving personal or sensitive data, unless prohibited by law or ongoing forensic investigation. Notification Method Email alerts (to the registered contact information); Website banners or in-app notices (if applicable); Any additional method required by law. Content of Notification The notice will include: Nature and scope of the breach; Categories of affected data; Likely consequences or risks; Remedial actions taken; Contact details for further queries or support. Regulatory Reporting: In accordance with Indian IT security regulations, we will notify the Indian Computer Emergency Response Team (CERT-In) within the legally mandated timeframe. Where the breach affects users from other jurisdictions (e.g., EU/UK), we will notify the relevant Data Protection Authorities (DPAs) in line with GDPR Article 33/34. Remediation and Accountability: Affected systems will be immediately quarantined, patched, or rebuilt. Incident root cause analysis and forensic review will be documented. A post-incident impact report will be maintained and auditable for up to 2 years. 13. Contact & Complaints We are committed to resolving your concerns regarding the collection, use, or protection of your personal data with fairness and transparency. If you have questions, complaints, or wish to exercise your data rights, please contact us through the channels below: Primary Contact VaidhyaMegha Private Limited Email: enquiry@samyama.ai Phone: +91 9618986039 Data Protection Officer (DPO) You may also escalate privacy matters directly to our appointed Data Protection Officer. Please mention "Privacy Concern – Samyama" in the subject line of your email. Partners