Legal

Data processing agreement

The data-protection contract between Aayul Health Pvt Ltd and home-care agencies that list on the marketplace and process family data via the platform.

Effective 2026-05-08 · Replaces all prior versions.

Both controllers

We and the agency are joint data controllers for booking and care data — each with defined responsibilities. Anything the agency collects outside the platform is theirs alone.

Limited use

Family data shared with the agency may only be used to deliver the booked service. Marketing or onward sharing is prohibited without explicit consent.

Security baseline

Agencies must encrypt PII at rest, run KYC on every staff member, log access, and report breaches within 24 hours.

Termination

On delisting, the agency must delete or return all family data within 30 days, except what they're legally required to retain.

01Scope

This DPA applies to all personal data processed by an agency in connection with bookings made through AayulHealth. It supplements (but does not replace) the platform terms of service signed at agency onboarding.

02Roles

Aayul Health Pvt Ltd is the data controller for marketplace browsing, search, and booking creation.

The Agency is the data controller for care delivery, clinical records, and any data collected during visits.

For booking-and-handoff data, both parties are joint controllers, each acting within the boundaries of their role.

03Permitted purposes

The agency may process family data only to:

  • Confirm and deliver the booked service
  • Communicate with the family about the booking
  • Issue invoices and receipts
  • Comply with regulatory and clinical record-keeping

Use for marketing, sales, or sharing with third parties requires fresh, explicit consent from the family.

04Security baseline

  • Encrypt PII at rest (database column-level or KMS)
  • Restrict access to staff with operational need
  • Log every access to family records
  • Run KYC and police-check on every carer
  • Annual security and compliance review
  • Follow the controls in AayulHealth SECURITY.md as a baseline

05Sub-processors

Agencies must maintain a list of sub-processors (e.g. hospital partners, lab partners, billing services) that touch family data, and disclose it on request. Material changes require notice to AayulHealth and to affected families.

06Incident notification

On discovering a personal-data incident, the agency must notify AayulHealth within 24 hours and assist with breach notification under DPDP requirements (72-hour clock to the Data Protection Board).

07Family rights requests

When a family exercises a right (access, correction, deletion), AayulHealth forwards the request to the agency. Agency must respond within 14 days and confirm completion in writing.

08Termination

On delisting from the marketplace, the agency must delete or return all family data received via the platform within 30 days, except records they are legally required to retain. Confirmation of deletion is required in writing.

09Audit

AayulHealth may audit the agency's processing on reasonable notice. Audits are limited to what's necessary to verify compliance with this DPA and DPDP requirements.

10Contact

For DPA queries: dpa@aayulcareu.com. Aayul Health Pvt Ltd · India.

Questions about this document? Email legal@aayulcareu.com or read our other policies.

Terms · Privacy · Data processing · Refunds & cancellation