Privacy Policy

1. Who we are

Vedatricks Technologies Private Limited (“Vedatricks”, “we”, “us”) is a private limited company incorporated in India in 2025, with CIN U62012KA2025PTC209058 and GSTIN 29AALCV4654M1ZH. Our registered office is at SMC, Thalaghattapura, Bengaluru, Karnataka 560109, India.

We build and operate software products (Clinitricks, Biztricks, HamaraPG, Dentricks, SocietyHub, VMail, Vedatricks Analytics and Integration Hub), deliver custom engineering services, resell domain names and help businesses set up and integrate Razorpay.

This notice covers www.vedatricks.com and the enquiry, careers, domain and payment journeys on it, the Veda website assistant, and the personal data we hold about you as a customer, prospect, applicant or visitor.

When your organisation uses one of our products, the data your organisation records inside that product belongs to your organisation. Your organisation is the Data Fiduciary and decides why and how it is processed; we act as its Data Processor on the terms at /legal/dpa/. If you are a patient, a resident, a tenant or a customer of one of our customers, please raise your request with that organisation first — we will forward it to them if you send it to us.

2. Summary

• We ask for personal data only where we have a reason to, and we tell you the reason on the form.
• Consent boxes are never pre-ticked, and you can withdraw consent at any time.
• We do not sell personal data, and we do not share it with advertising networks.
• Our website measurement is first party and cookieless by default; no analytics identifier is written to your device before you allow it.
• Conversations with the Veda assistant are stored for 90 days and are sent to Sarvam AI to generate a reply, after our server removes identifiers it can recognise.
• You can ask for a summary of your data, a correction, an erasure, or to nominate someone, at /privacy/requests/. We acknowledge every request within 48 hours. We aim to resolve requests within 30 days.

3. What we collect, why, on what basis, and for how long

The table below is the itemised list of personal data and specified purposes that Rule 3 of the Digital Personal Data Protection Rules 2025 requires. We do not collect any of it unless you give it to us or it is generated by your use of the service.

What we ask you not to send us

Please do not put Aadhaar numbers, PAN, card numbers, bank credentials, passwords, health information or any other sensitive detail into a website form, a WhatsApp message to us or the Veda assistant. We do not need them there. If you send them anyway, we delete them as soon as we notice.

4. Where the data comes from

• From you — forms, email, phone, WhatsApp, the assistant, and what you type into our products.
• From your device — IP address, request headers and page views, as any web server receives them.
• From your employer or client — when a colleague adds you to a Vedatricks product as a user, or when a customer gives us your details as a project contact.
• From our processors — Razorpay tells us whether a payment succeeded; ResellerClub tells us whether a domain was registered; Cloudflare Turnstile tells us whether a submission looked automated.
• From advertising platforms — where you arrive from an ad, the click identifier in the URL, so we can tell which campaigns produce genuine enquiries. We do not receive your profile from those platforms.

5. The website assistant and voice input

Veda is the assistant in the corner of this website. Before your first message it shows a notice and asks you to continue; nothing is sent anywhere until you do. The full description of what it is, what it refuses to do and how it is constrained is at /legal/ai-disclosure/.

What happens to a message

1. Your message is sent to our server over TLS. The model provider’s key stays on our server.
2. Our server removes patterns it recognises as identifiers — Aadhaar-shaped numbers, PAN, card numbers, phone numbers and email addresses — before the message leaves our systems.
3. The redacted message, the conversation so far and our instructions are sent to Sarvam AI, which returns the reply.
4. We store the conversation with a session identifier, a hashed IP address, the model name, token counts and cost, so we can enforce limits and investigate abuse.
5. The conversation and any voice clip are deleted 90 days after the conversation ends.

Voice

If you dictate a message, your browser records a short audio clip only while you hold or toggle the microphone control. The clip is sent to our server, transcribed, and the transcript is used as your message. Clips follow the same 90-day deletion rule as transcripts. We do not use your voice to build a voiceprint and we do not clone voices.

Handing over to a person

If you ask for a human, or the assistant refuses twice, we offer to create an enquiry. That only happens if you fill in the short form and tick the consent box — the assistant does not turn a conversation into a lead by itself.

6. Who we share personal data with

We do not sell personal data. We share it with the processors below, who act on our instructions, and with the recipients listed after the table where the law or your instruction requires it.

Cloudflare Turnstile

Our forms and the assistant are protected by Cloudflare Turnstile, which decides whether a request is likely to be automated. Where the widget runs without any visible interaction, we are required to point you to Cloudflare’s Turnstile Privacy Addendum — please read it, as it explains what Cloudflare collects to make that decision. Turnstile does not read the content of your form.

Other recipients

• Professional advisers — our auditors, lawyers and accountants, under duties of confidentiality.
• Domain registries and registrars — registrant details as ICANN, registry and NIXI rules require. We cannot keep this data private beyond what the relevant registry’s policy allows.
• Authorities — where we are compelled by a lawful order, and only to the extent of that order. We record every such disclosure.
• A buyer — if the business or a product line is sold or reorganised, under confidentiality, and we will tell you before your data moves.

We keep a current list of the processors used inside each product as Annex C of the Data Processing Agreement, and we give customers 30 days’ notice before adding one.

7. Processing outside India

Section 16 of the DPDP Act and Rule 15 of the DPDP Rules allow personal data to be transferred outside India unless the Central Government restricts a particular country by order. We rely on that permission for these transfers:

• Sarvam AI — assistant messages may be processed in United States or European Union cloud regions, as Sarvam’s own privacy policy states.
• Cloudflare — requests are served from the nearest edge location, which is often outside India.
• Domain registries — registrant details go to the registry operator for the top-level domain you chose, wherever it is established.

Every such transfer is covered by a written contract with the recipient that requires confidentiality, security and deletion on our instruction. Our application databases and backups are hosted at [ ● ]term not yet agreed; this document is in legal review.

8. How long we keep personal data

The retention column in section 3 is the operative schedule. Three rules sit above it:

• Purpose served, data erased. When the purpose we told you about is complete and no law requires us to keep the data, we erase it or strip it of identifiers.
• Legal holds. We keep data longer where a statute requires it — for example accounting records under the Companies Act 2013 and GST records under the CGST Act 2017 — or where it is needed for a live dispute, investigation or grievance.
• Logs. Access and security logs are retained for at least 12 months as Rule 6 of the DPDP Rules 2025 requires.

Backups are overwritten on a rolling cycle. A record you ask us to erase may sit in a backup until that cycle completes; it is not restored into live systems, and it is erased when the backup is.

9. How we protect personal data

Rule 6 of the DPDP Rules 2025 requires reasonable security safeguards. Ours include:

• TLS on every connection to our websites, products and APIs.
• Encryption at rest for the most sensitive fields in our clinical product, with a blind index so those fields can still be searched without being decrypted in bulk.
• Role-based access control, least-privilege staff accounts, and multi-factor authentication on the systems that support it.
• Append-only, hash-chained audit logging in the products that carry health records, and administrative audit logs elsewhere.
• Rate limiting, a web application firewall, honeypot fields and Turnstile on public forms.
• Database backups taken before every schema migration, and a documented restore procedure.
• Access logs retained for at least 12 months, and monitoring for unusual access patterns.
• A documented incident-response runbook with a 72-hour reporting path (section 10).

We do not hold ISO/IEC 27001 or SOC 2 certification. What we do instead, and what we are still building, is set out at /legal/security/.

10. If there is a personal data breach

Rule 7 of the DPDP Rules 2025 sets no harm threshold. If a breach affects your personal data:

• We will inform you without delay, in plain language, describing the nature and extent of the breach, its likely consequences, what we have done and are doing to mitigate it, the safety measures you can take, and who to contact for more.
• We will inform the Data Protection Board of India without delay, and give the Board the detailed report it requires within 72 hours of becoming aware.
• If we act as a processor for your organisation, we will notify your organisation without undue delay and, in any case, within 24 hours of becoming aware, and assist with its own reporting.

11. Your rights and how to exercise them

Sections 11 to 14 of the DPDP Act 2023 give you the following rights over your personal data.

Right to access information

A summary of the personal data we process about you, the processing activities, and the identities of the other Data Fiduciaries and processors with whom we have shared it.

Right to correction, completion and updating

To have inaccurate or misleading data corrected, incomplete data completed and stale data updated.

Right to erasure

To have data erased where you withdraw consent or the purpose is served, unless retention is required by law. We will tell you what we must keep and why.

Right of grievance redressal

To complain to us and get a decision, before approaching the Data Protection Board.

Right to nominate

To nominate another individual who may exercise these rights on your behalf if you die or become incapable of exercising them.

How to make a request

Use the form at /privacy/requests/. It creates a ticket ID and routes the request to the person who can act on it. You may also email our Grievance Officer, whose details are at the end of this notice.

Verification

We must be sure the request is yours. We normally verify by sending a code to the email address or phone number already on the account. Where that is not possible, we may ask one or two questions only you could answer. Do not send us identity documents unless we specifically ask.

Our timelines

• We acknowledge every request within 48 hours.
• We aim to resolve requests within 30 days.
• Grievances are resolved within 90 days at the outside, as the DPDP Rules 2025 require.

There is no fee. If a request is manifestly excessive or repetitive we may explain why we are declining it, and you may take that decision to the Board.

Your duties

The DPDP Act also places duties on you as a Data Principal: give authentic information when you exercise a right, do not impersonate another person, do not suppress material information, and do not file a false or frivolous grievance.

12. Withdrawing consent

Where we rely on your consent, you can withdraw it at any time, and it must be as easy to withdraw as it was to give. You can:

• choose “Withdraw my consent” on /privacy/requests/;
• reply “STOP” to any marketing email or WhatsApp message we send;
• reject the measurement and preference categories in the cookie banner, or change them later;
• close the assistant and choose “Delete this conversation”.

Withdrawal takes effect for the future. It does not make lawful processing that already happened unlawful, and we may still hold data we are required by law to keep. Where a service depends on the data — a subscription you are paying for, a domain registered in your name — withdrawing consent may mean we can no longer provide it, and we will say so before acting.

13. Children and persons with a lawful guardian

Our website, products and services are for businesses and are not directed at children. We do not knowingly collect the personal data of anyone under 18 through this website.

• Where a service does involve a child — for example a clinic recording a paediatric patient in Clinitricks — the customer organisation is responsible for obtaining verifiable consent from the child’s parent or lawful guardian, and our software records that consent against the record.
• We do not carry out tracking, behavioural monitoring or targeted advertising directed at children, and we do not process a child’s data in a way likely to cause a detrimental effect on their well-being.
• The same protections apply to a person with a disability who has a lawful guardian.
• If you believe a child’s data has reached us through this website, tell our Grievance Officer and we will delete it.

14. Cookies and similar technologies — summary

We set a small number of cookies. Strictly necessary cookies — the record of your consent choice, the Cloudflare bot-management and challenge cookies, and your product session cookie after you sign in — are always on. Preference and measurement cookies are set only if you opt in, and the banner’s “Reject all” is as prominent and as easy as “Accept all”.

Vedatricks Analytics, our own measurement tool, is cookieless by default: it counts a page view without writing an identifier to your device. We do not use advertising or cross-site tracking cookies anywhere on this site.

The full register — cookie names, providers, purposes and durations, and how to change your choice — is at /legal/cookies/.

15. Automated decisions and profiling

We do not make decisions that produce legal effects for you, or similarly significant effects, by automated means alone. Two systems are automated and worth naming:

• Turnstile may decide that a form submission looks automated and reject it. If that happens to you, email us and a person will take your enquiry.
• The Veda assistant generates text. It cannot approve, price, refuse or commit anything, and any quotation or decision is made by a person.

We do not build advertising profiles, and we do not combine your data with data bought from third parties.

16. Complaints and the Data Protection Board of India

Please raise a complaint with our Grievance Officer first — the details are below and the timelines are in section 11. If you are not satisfied with our decision, or we do not respond in time, you may complain to the Data Protection Board of India under section 13(3) of the DPDP Act 2023. Details of how to file are published by the Board at [ ● ]term not yet agreed; this document is in legal review.

Nothing here takes away any other remedy available to you, including under the Consumer Protection Act 2019 or the Information Technology Act 2000.

17. Changes to this notice

When we change this notice we increment the version at the top of the page and update the “Last updated” date. If a change materially affects how we use personal data we already hold, we will tell registered users by email at least [ ● ]term not yet agreed; this document is in legal review before it takes effect, and — where we relied on your consent — ask for consent again rather than assume it carries over. Previous versions are available on request.

18. How to contact us

For anything about this notice, email hello@vedatricks.com, or write to Vedatricks Technologies Private Limited, SMC, Thalaghattapura, Bengaluru, Karnataka 560109, India. For a formal request under section 11 to 14 of the DPDP Act, use /privacy/requests/.