Privacy policy

Swastya AI builds two things. Swastya care is AI that explains lab reports and coaches people on WhatsApp: Aira explains, Harvey plans meals and Teresa coaches, either directly or on behalf of a clinic or hospital. Swastya Ads is software we use to plan, build and run Google Search campaigns on behalf of diagnostic pathology laboratories.

This policy covers both. Where a section applies to only one of them, it says so.

If you ask for a demo on this website, we keep the name, centre and contact details you give us, and use them only to arrange and follow up on that demo.

You can reach us about anything in this policy at:

If you chat with Aira, Harvey or Teresa, we collect what we need to explain your report and coach you:

• Contact details — your WhatsApp number, and your name if you give it.
• What you tell us in the questionnaire — age, sex, height, weight, activity level, goals, food likes and dislikes, allergies, and routine.
• Blood reports you or your clinic share, and the marker values read from them.
• Food you log, and the messages you exchange with Aira, Harvey and Teresa.

We use this to explain your report, plan your meals and coach you, and to keep that consistent across conversations. Unless you opt out, we also use it to improve Swastya (see clause 3). We do not sell it, and we do not use it for advertising.

Health information is sensitive personal data. It is stored on managed cloud infrastructure, encrypted in transit and at rest, and access is limited to the Swastya AI staff who need it to run the service. Swastya gives health education and coaching, not a medical diagnosis.

Your conversations with Aira, Harvey and Teresa, and the reports and details you share in them (“conversation data”), are owned by Swastya AI. We use conversation data to run your care and, unless you opt out, to check the quality of our replies and to train and test our AI models. Before we use it to improve Swastya, we remove your name, number and other details that identify you wherever we can.

Owning these records doesn’t take away your rights over your personal data. Clause 10 explains how to see, correct or delete it.

We handle health and personal data in line with the laws that apply to you.

• India: the Digital Personal Data Protection Act, 2023; the Information Technology Act, 2000 and its rules on sensitive personal data; and the Telemedicine Practice Guidelines, 2020.
• United States: HIPAA and the HITECH Act, where we work for a clinic or hospital under a business associate agreement; the FTC Act and the FTC Health Breach Notification Rule; and the state health-privacy laws that apply to you.

When a laboratory chooses to link its Google Ads account to Swastya Ads, it does so through Google's own OAuth consent screen. We ask only for the scope needed to manage that laboratory's campaigns.

Alongside the token we keep the operational record of the work: campaign structures, keywords, ad copy, budgets, and the performance figures Google reports back to us.

The two sides of our business are kept apart. Nothing collected through Aira, Harvey or Teresa, and no patient record from a laboratory, is ever used for advertising or sent to Google Ads.

A laboratory can revoke our access at any time, without asking us and without notice, from its own Google Account under Security → Your connections to third-party apps. Revoking takes effect immediately and our refresh token stops working.

You can also email us and ask to be disassociated. We action that within 3 business days. Either way:

• We delete the stored refresh token and any cached Google Ads credentials for that laboratory within 7 days.
• The campaigns stay in the laboratory’s account, under its exclusive control. We do not delete, pause, or remove the work already built unless asked.
• On written request we also delete the reporting data we hold for that laboratory, keeping only what tax and accounting law requires us to retain.

• OAuth refresh tokens — for as long as the laboratory is a client, then deleted within 7 days of revocation or disassociation.
• Google Ads reporting data — 24 months, so labs can compare year on year, then deleted. Sooner on written request.
• Patient health data and chat history — for as long as you use the service, and for 12 months after your last message. Then it is deleted, or de-identified so it no longer identifies you. If you opted out of data usage, it is deleted.
• Invoices and financial records — kept as long as Indian tax law requires.

We use a small number of service providers to run the product: managed cloud hosting and databases, AI model providers that process conversations to write replies, Google (for the Google Ads API, and Google Sheets for demo requests), and WhatsApp for messaging. This website uses Vercel Analytics, which records page views without cookies and without profiling individual visitors.

These providers process data on our instructions. We do not sell data to anyone, and we do not share it with advertisers or data brokers.

You can ask us what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Email apoorv@swastya.ai with the number or the laboratory name you use with us. We reply within 30 days.

To stop us using your conversations to improve Swastya, message “Opt out of data usage” to Aira on WhatsApp. To stop all messages, reply STOP.

If you are unhappy with how we handled a request, tell us and we will look at it again.

If we change how we handle data we will update this page and move the date at the top. If a change is significant, we will tell affected patients and laboratories directly.

Our terms for patients and for laboratories are in our terms of service.