Asha is operated as a working-title product under the Asha team as the Data Fiduciary (per DPDPA s.2(i)). Contact for data-protection matters: grievance@withasha.com.
This Notice describes how we collect, process, store, share, and protect your personal data when you use the Asha mobile application, the Asha website at withasha.com, and any related services. It complies with India's Digital Personal Data Protection Act 2023 (DPDPA), the Information Technology Act 2000, and the Sensitive Personal Data or Information Rules 2011 (SPDI Rules).
| Category | Examples | Source |
|---|---|---|
| Identity | Name, email address, phone number (optional) | You provide at signup |
| Health-context | Symptoms, treatments, test results, recommendations from your treating physician. What you describe to Asha during a consult | You provide during use |
| Family member context | Names, relationships, ages of family members on whose behalf you may consult | You provide |
| Voice content | Audio of you speaking to the AI persona during a consult | Captured during voice mode; not persisted on our servers |
| Device + usage | Device type, OS version, anonymous app analytics | Automatically |
We rely on your consent (DPDPA s.6) for all processing of your personal data. We obtain consent at signup for service operation, and again before each new processing purpose where required.
We share your personal data with the following processors solely as necessary to operate Asha:
Specific vendor names are not disclosed publicly as part of our security posture. Each processor is contractually bound to data-protection obligations consistent with the DPDPA, IT Act, and SPDI Rules. We are happy to disclose specific vendors to data-protection authorities, regulators, or your legal counsel on request to grievance@withasha.com.
Some of the above processors operate outside India. Per DPDPA s.16, we transfer personal data only to jurisdictions permitted by the Central Government from time to time. Where any specific destination is later restricted by Government notification, we will revise this Notice and our vendor list accordingly.
We retain your data for as long as your account is active plus a reasonable period after deletion for legal-compliance purposes. Specific retention windows by category will be published before public launch. Health-context records can be deleted on request via your account settings.
Exercise these rights by emailing grievance@withasha.com. We will respond within timelines specified by the DPDPA Rules.
Asha is not designed for users under 18. The signup flow asks you to confirm you are 18 or older. Pediatric consults are conducted by an adult parent or guardian on behalf of a child. We do not knowingly collect personal data directly from children under 18.
We implement reasonable security practices aligned with the SPDI Rules and ISO 27001 controls (formal certification is in progress at the time of this Notice). Specific measures include: encryption in transit (HTTPS) and at rest, on-device PHI redaction before any external API call, role-based access controls, error-tracking with PHI scrubbing, and a documented breach-response runbook.
If you have any concerns about how your personal data is being handled, please contact our designated grievance officer:
the Asha team
Email: grievance@withasha.com
We will acknowledge your grievance within 24 hours and respond substantively within timelines specified by the DPDPA Rules.
We will notify you of material changes via the email associated with your account. The "Last updated" date above reflects the most recent revision.
- End of Notice -