Privacy Policy

1. Data Controller

Anmaya Health Technologies Private Limited ("we", "us", "our") operates Anmaya Connect. We are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). All data is stored in AWS ap-south-1 (Mumbai region).

2. Data We Collect

Account data: name, mobile number, email address, password (hashed, never stored in plaintext).

Professional profile: AYUSH system, degree, specialty, registration number, council, college, city, headline, bio, profile photo.

Contact graph: when you import contacts, we store cryptographic hashes of contact identifiers. Hashed contacts are never displayed to other members, never used for marketing, and are purged after use or within 90 days, whichever is sooner.

Usage data: privacy-preserving page view counts (path + date + count only; no IP addresses, no device fingerprints, no tracking cookies).

3. How We Use Your Data

We use your data to: verify your professional credentials; maintain your public profile; enable networking with other verified professionals; process employer talent searches (with your explicit consent); send transactional notifications (OTPs, approval notices, invitation confirmations).

4. Purpose-Coded Consent

Each data processing activity requires separate, purpose-specific consent. Your consents are tracked individually, and you can grant or withdraw consent for each purpose independently:

• Account creation & profile maintenance
• Contact import for colleague discovery
• Search engine indexing of your public profile
• Employer contact unlock for hiring

5. Contact Graph Isolation

Your imported contacts are stored in a separate, restricted database schema with its own access controls. The application's main database role cannot query this schema directly. Contact data is accessed only through a dedicated, audited module with four operations: match on signup, send invite, purge, and honour opt-out.

6. Data Sharing

We do not sell your data. We share your data only: (a) when you explicitly consent (e.g., employer contact unlock); (b) with service providers who process data on our behalf (hosting, email delivery) under data processing agreements; (c) when required by law or court order.

7. Data Retention

Profile data is retained while your account is active. Upon account deletion, personal data is removed within 30 days. Anonymised verification audit records (actor, action, timestamp, no PII) are retained indefinitely to maintain trust ledger integrity. Contact graph data for non-members is purged after send, decline, or 90 days, whichever comes first.

8. Your Rights Under DPDP Act, 2023

You have the right to: access your personal data; correct inaccurate data; request erasure of your data; withdraw consent at any time; nominate a representative; and lodge a grievance with the Data Protection Board of India.

9. Data Export

You can download a copy of your data (profile, connections, consents, invitations) in JSON format from your account settings. The export never includes another member's data or raw contact graph entries.

10. Security

We implement encryption in transit (TLS) and at rest; password hashing with Argon2id; rate limiting on authentication endpoints; immutable audit logging for verification actions; and PII-free application logs (emails and phone numbers are masked in all log output).

11. Children's Data

The Platform is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the version number above and require you to re-accept the updated policy before continuing to use the Platform.

13. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@anmaya.health.