VRAH Telehealth Services Private Limited ("VRA Health", "we" or "us", including its affiliates) operates the vrahealth.com website and the VRA Health mobile applications (together, the "Services").

This Privacy Policy explains how we collect, use, share, disclose and protect personal information about users of the Services — patients, website visitors and practitioners alike. Your use of the Services is subject to this Privacy Policy and our Terms and Conditions.

By using the Services or otherwise giving us your information, you confirm that you have read, understood and agreed to the practices described in this Privacy Policy and consent to our collection, use and disclosure of your information as described here. If you use the Services on behalf of someone else (such as your child) you confirm that you are authorised to accept this Privacy Policy and consent on their behalf. If you do not agree with this Privacy Policy, please do not use the Services or provide us your information.

Last updated: 29 July 2026

1. Why this Privacy Policy

This Privacy Policy is published by VRAH Telehealth Services Private Limited ("VRA Health", "we", "us" or "our") in compliance with applicable Indian law, including:

• Section 43A of the Information Technology Act, 2000;
• the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPI Rules");
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and
• the Digital Personal Data Protection Act, 2023, to the extent its provisions are brought into force.

It explains what information we collect from users of the VRA Health website and mobile applications (together, the "Services"), why we collect it, how we use, share and protect it, and the choices you have. "Users" includes patients, visitors and the doctors and clinics who provide consultations through the platform ("Practitioners").

2. Information we collect

Depending on how you use the Services, we may collect:

• Account and contact data — your name, email address, phone number and login credentials;
• Demographic data — such as gender, date of birth, location and time zone;
• Health data you choose to share — symptoms, medical history, reports, images and documents you provide to a doctor during a consultation, and the prescriptions issued to you;
• Usage and appointment data — your booking history and how you use the Services;
• Payment-related data — processed by third-party payment gateways; we do not store your card or banking credentials;
• Device and technical data — such as device type, browser, IP address and notification tokens, used to deliver calls, messages and notifications;
• Practitioner data — qualifications, registration numbers, practice details and other information Practitioners provide for their public profiles.

Some of this information constitutes "Personal Information" or "Sensitive Personal Data or Information" under the SPI Rules (for example passwords, financial information, health condition, and medical records and history). Providing it is voluntary; however, some Services cannot be delivered without it.

3. How we use your information

• To create and manage your account and verify your identity;
• To connect you with Practitioners, schedule appointments, and enable video/audio consultations, chat and file sharing;
• To deliver prescriptions, booking confirmations, reminders and service notifications;
• To process payments through third-party payment gateways;
• To provide customer support and resolve technical issues;
• To improve the Services, including analysis in aggregated, anonymised form;
• To send you information about new features or offers, where permitted — you may opt out of promotional communications at any time;
• To comply with legal obligations and enforce our Terms and Conditions.

4. How we share information

• With the Practitioner you consult — the information you share in a consultation is visible to that Practitioner, who is independently responsible for maintaining its confidentiality as part of their professional obligations;
• With service providers — such as payment gateways, cloud hosting, video-calling and notification providers, strictly to the extent needed to run the Services;
• With authorities — where required by law, court order or government direction;
• In aggregated or anonymised form — for research, statistics and service improvement, in a form that does not identify you.

We do not sell your personally identifiable information.

5. Confidentiality and security

Consultations take place over encrypted connections, and your consultation records are accessible only to you and the consulting Practitioner in the ordinary course of the Services. We implement reasonable security practices — including managerial, technical, operational and physical controls — appropriate to the nature of the information we hold. No administrator has knowledge of your password; please protect your login credentials and log out after using shared devices. While we take all reasonable precautions, no online service can guarantee absolute security against events beyond its reasonable control.

6. Retention

We retain your information for as long as your account is active and as needed to provide the Services, to comply with legal and medical record-keeping requirements, and to resolve disputes. Thereafter, data may be anonymised and retained in aggregated form for analytics.

7. Your rights and choices

• You may access and update your account information from your profile;
• You may request correction of inaccurate information, or deletion of your account and associated personal information, by contacting us using the details below (subject to records we are legally required to keep);
• You may withdraw consent at any time, though this may mean we can no longer provide you some or all of the Services;
• You may opt out of promotional communications at any time.

8. Children

The Services are intended to be used by minors only under the supervision and with the consent of a parent or legal guardian. Consultations for children must be booked and attended by a parent or guardian.

9. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be notified on the website or by email. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

10. Grievance Officer and contact

If you have any questions, concerns or grievances regarding this Privacy Policy or your personal information, please contact:

VRAH Telehealth Services Private Limited
SanathNagar Main Road, Hyderabad - 500018, Telangana, India
Email: info@vrahealth.com
Phone/WhatsApp: +91 99149 32405

We aim to acknowledge grievances within 48 hours and resolve them within the timelines prescribed under applicable law.