Privacy Policy

Ascle AI Private Limited (“Ascle AI,” “we,” “our,” or “us”) is a healthcare technology company providing WhatsApp-based, telephone-based, and web-based automation solutions for appointment scheduling, reminders, and prescription management to Indian hospitals, clinics, outpatient department (OPD) centers, and diagnostic centers (collectively, “Healthcare Facilities”).

This Privacy Policy (“Policy”) describes how we collect, process, store, protect, and dispose of Personal Data and Personally Identifiable Information (“PII”) in connection with our Services. This Policy applies to all individuals (“Data Principals”) whose data is processed through our platform, including patients, their representatives, and Healthcare Facility staff.

Ascle AI is committed to full compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and any rules or regulations promulgated thereunder. This Policy is designed to meet or exceed all requirements set forth under the DPDP Act regarding the lawful processing of digital personal data in India.

Effective Date: January 10, 2026

In the course of providing our Services, Ascle AI collects and processes the following categories of Personal Data:

• Patient names and contact information (telephone numbers)
• Appointment details including preferred dates, times, doctors, and departments
• Prescription data (only when voluntarily uploaded by patients or Healthcare Facilities)
• Communication logs including WhatsApp messages, call recordings, and SMS records

Data is collected through the following authorized channels: WhatsApp Business API, automated and live telephone systems, and web-based interfaces provided to Healthcare Facilities. The lawful basis for processing includes explicit consent obtained from Data Principals and the fulfillment of healthcare services requested by patients through Healthcare Facilities.

Important: Ascle AI collects Personal Data only with the explicit consent of patients and/or Healthcare Facilities. No data is collected without prior authorization, and all collection practices are disclosed to Data Principals at the point of collection.

Ascle AI implements comprehensive technical and organizational security measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmissions are protected using TLS 1.2 or higher protocols
• Encryption at Rest: All stored data is encrypted using AES-256 encryption standards
• Access Controls: Role-based access control (RBAC) with minimum privilege principles
• Network Security: Enterprise-grade firewalls, intrusion detection systems, and DDoS mitigation
• Database Security: All databases are private and never publicly accessible
• Security Audits: Regular security assessments and vulnerability testing conducted quarterly
• Staff Training: Mandatory data protection training for all Ascle AI personnel

Note: SOC2 Type II certification and HIPAA compliance are currently on our development roadmap and will be implemented in future releases.

In the event of a personal data breach, Ascle AI will take the following actions in accordance with the DPDP Act:

• Investigation: Immediate investigation within twenty-four (24) hours of breach detection
• Notification: Notification to affected Data Principals and Healthcare Facilities within seventy-two (72) hours of confirming the breach, as required by the DPDP Act
• Evidence Preservation: All evidence related to the breach will be preserved for investigation and regulatory purposes
• Corrective Measures: Immediate implementation of remediation measures to prevent recurrence

Breach notifications will be delivered via email and Healthcare Facility communication channels, and will include: the nature and extent of the breach, categories of data affected, remediation steps taken, and contact information for the Ascle AI Data Protection Officer.

Under India's Digital Personal Data Protection Act, 2023, Data Principals (patients and their representatives) have the following rights:

• Right to Access: Request information about what Personal Data we hold and how it is processed
• Right to Correction: Request correction of inaccurate or incomplete Personal Data
• Right to Erasure: Request deletion of Personal Data as detailed in Section 5
• Right to Data Portability: Receive Personal Data in a structured, commonly used, machine-readable format
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Grievance Redressal: Lodge complaints regarding data processing practices
• Right to Nominate: Nominate another individual to exercise data rights in case of death or incapacity

To exercise any of these rights, please contact us at: support@getascleai.com

Data Principals may also lodge complaints with the Data Protection Board of India established under the DPDP Act if they believe their rights have been violated.

Ascle AI's Services are directed exclusively at Healthcare Facilities and healthcare professionals, not at children or minors directly. We do not knowingly or intentionally collect Personal Data from individuals under the age of eighteen (18) years.

Where Personal Data relating to minors is processed through Healthcare Facilities (for example, pediatric appointment scheduling), such data is processed only with the consent of a parent or legal guardian, as obtained by the Healthcare Facility in accordance with applicable law and the DPDP Act.

Ascle AI operates under the exclusive jurisdiction of the Republic of India and is designed to comply with Indian data protection law, specifically the Digital Personal Data Protection Act, 2023.

At present, Ascle AI provides Services only to Healthcare Facilities located within the territory of India. We do not actively solicit or provide services to Healthcare Facilities or patients outside of India.

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts of India.

Ascle AI is committed to maintaining the highest standards of data protection and regulatory compliance.

Ascle AI is fully aligned with the provisions of the Digital Personal Data Protection Act, 2023. Healthcare Facilities utilizing Ascle AI's Services act as co-processors of patient data and share responsibility for DPDP Act compliance.

Future Compliance: Ascle AI is actively working towards SOC2 Type II certification and HIPAA compliance as part of our ongoing commitment to data security excellence.

For all privacy-related inquiries, requests, or complaints, please contact us:

Policy Updates: Ascle AI reserves the right to update or modify this Privacy Policy at any time. Material changes to this Policy will be communicated to Healthcare Facilities and, where possible, to affected Data Principals at least thirty (30) days in advance of the effective date.

Continued use of Ascle AI's Services following any update to this Privacy Policy constitutes acceptance of the revised terms.