Privacy
Privacy policy.
What we collect, why, who processes it, how long we keep it, and how to use your rights under India's DPDP Act 2023.
Draft for legal review. This text describes how Genoryx works today and is being reviewed by counsel; the reviewed version will replace it under a new effective date.
Effective
01Who we are
Genoryx is a physician-led longevity clinic with clinics in Banjara Hills and Manikonda, Hyderabad. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Genoryx is the Data Fiduciary for the personal data described here. You are the Data Principal.
This notice covers genoryx.com, the Oraia health-literacy tool, and the enquiries and bookings you make with us. Your clinical record at the clinic is also governed by the record-keeping rules that apply to registered medical practitioners.
02What we collect
We collect only what each part of the service needs.
- Booking and callback forms. Your name, phone number, the service you ask about, your preferred clinic, date and time, and any note you add.
- Oraia questionnaire. Your answers to the health and lifestyle questions, your stated age and sex, and your phone number (email is optional).
- Blood-report upload. The report file you upload and the values read from it, such as HbA1c, LDL or fasting glucose.
- Skin analysis. The face photograph you upload and the analysis produced from it.
- Verification. One-time codes sent to your phone or email so that only you can open your saved results.
- Consent records. When you accept the health-data notice we log the version you accepted, the time, your browser’s user agent and a one-way hash of your IP address. We do not keep the IP address itself in this log.
- Clinic visits. The history, examination findings, test results and plans your physician records when you visit.
- Usage data. Pages viewed, referring page, device and browser type, collected by the analytics and advertising tools listed below.
Health data is sensitive. We ask for your explicit consent before any Oraia flow stores it, and the flow will not run without that consent.
03Why we use it
- To respond to your enquiry, call you back and schedule your visit.
- To produce your Oraia result and keep it so you can return to it and compare later results.
- To let a Genoryx physician review your results when you book a consultation, and to plan and record your care.
- To keep the service secure, prevent abuse (for example rate limits on free analyses) and fix faults.
- To understand which pages help people and to measure our advertising, using aggregated analytics.
- To meet our legal obligations, including medical record-keeping and responding to lawful requests.
04Your consent, and the lawful uses that do not need it
We process your personal data on the basis of your consent (DPDP Act, section 6), given when you submit a form or accept the health-data notice in Oraia. You can withdraw consent at any time, as easily as you gave it, by using the delete option on your Oraia results page or by writing to privacy@genoryx.com. Withdrawal does not affect processing that already took place, and it may mean we can no longer provide that part of the service.
Some processing does not need consent under section 7 of the Act, for example responding to a medical emergency or complying with a law or court order.
06Transfers outside India
Our database and file storage are in Mumbai. Some processing happens outside India, as the table above shows: AI inference for Oraia, product analytics, email delivery and our internal booking workspace. Section 16 of the DPDP Act permits these transfers except to countries the Central Government restricts by notification. We will stop or move any transfer that such a notification covers.
07How long we keep it
- Oraia health data (questionnaire answers, uploaded reports and photos, results): up to 7 years from submission, the period stated in the consent you accept, and deleted sooner when you ask. An automated job removes data older than this each week.
- Archived Oraia chat sessions: up to 2 years.
- One-time verification codes: deleted once they expire.
- Booking and callback requests: for as long as you are our patient or prospective patient, and no longer than we need them to serve you.
- Clinical records from clinic visits: for the period that medical record-keeping rules require.
- Analytics data: held by the analytics providers under their own retention settings; it is not linked to your health data.
09How we protect it
Data travels over encrypted connections (HTTPS). Uploaded reports and photos sit in a private storage bucket and are shown only through short-lived signed links. Access to member data is limited to staff who need it for your care. No system is perfectly secure. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the DPDP Act requires.
10Your rights
Under sections 11 to 14 of the DPDP Act you can:
- ask for a summary of the personal data we hold about you and how we use it, and who we have shared it with;
- ask us to correct, complete or update it;
- ask us to erase it, unless the law requires us to keep it (for example clinical records);
- have a grievance addressed by us, and then by the Data Protection Board of India if you are not satisfied;
- nominate another person to exercise these rights if you die or become unable to.
The fastest way to erase your Oraia data is the delete option on your results page, after verifying your phone. For anything else, write to privacy@genoryx.com from the phone number or email linked to your data so we can confirm it is you.
11Children
Oraia and our online forms are for adults aged 18 and over. We do not knowingly collect a child’s personal data online. If a child is seen at our clinic, we process their data only with verifiable consent from a parent or lawful guardian, as section 9 of the DPDP Act requires, and we do not track or target advertising at children.
12Grievance Officer
If you have a concern about how we handle your personal data, write to our Grievance Officer at info@genoryx.com with “Privacy grievance” in the subject line. We aim to acknowledge within 7 working days and to resolve within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used this route.
13Changes to this notice
We will update this notice when our services, providers or the law change, and change the effective date above. If a change affects how we use health data you have already given us, we will ask for your consent again.