Privacy Policy

Zyla Health Private Limited (“Zyla”, “we”, “us” or “our”) respects the privacy of individuals whose Personal Data is processed through the Zyla Platform.

This Privacy Policy explains how Zyla collects, uses, processes, stores, shares and protects Personal Data and Health Information in connection with the Zyla Platform and services.

This Privacy Policy should be read together with Zyla’s Terms and Conditions (“Terms”). Capitalized terms not defined in this Privacy Policy shall have the meanings given to them in the Terms.

This Privacy Policy applies to Personal Data processed through the Zyla Platform, including Zyla’s websites, patient-facing applications, provider-facing applications including Orbit, and healthcare, wellness, preventive care, disease-management, care-management and related services offered or facilitated by Zyla.

This Privacy Policy applies to Patients, Providers, authorized representatives, caregivers and other Users of the Zyla Platform.

Where a particular Program, service, contractual arrangement or jurisdiction requires additional privacy terms or notices, such additional terms may also apply.

For purposes of this Privacy Policy:

“Personal Data” means information relating to an individual who is identified or identifiable, directly or indirectly, from such information or in combination with other information, as applicable under relevant law.

“Health Information” means information relating to an individual’s physical or mental health, medical history, symptoms, diagnoses, medications, prescriptions, investigations, laboratory results, consultations, treatment, care plans, lifestyle, wellness or other health-related information.

“Processing” includes collecting, recording, organizing, storing, using, accessing, sharing, disclosing, transferring, analyzing, modifying, retrieving, deleting or otherwise handling Personal Data.

Other defined terms, including “Patient”, “Provider”, “Zyla Platform”, “Orbit”, “Zyla Care Team” and “Program”, shall have the meanings given to them in the Terms.

Depending upon how you interact with Zyla and the services you use, Zyla may collect or process the following categories of information:

This may include your name, date of birth or age, gender, profile photograph and other information necessary to identify you or maintain your account.

This may include your mobile number, email address, residential or correspondence address and other contact information.

Where relevant to the services being provided, Zyla may process information including:

For Providers using the Zyla Platform or Orbit, Zyla may process information including identity and contact information, qualifications, professional registration and licence information, profile information, availability, appointments, consultation activity, records entered into Orbit, service-related communications, quality or audit information and security or activity logs.

Where services are provided through an insurer, employer, pharmaceutical company or other sponsoring organization, Zyla may receive information necessary to determine eligibility, facilitate enrollment or administer the relevant Program.

Zyla may collect information relating to your interaction with the Zyla Platform, including IP address, browser type, device type, operating system, app version, device identifiers, timestamps, access logs, pages or features accessed, session information and other technical or usage information.

Zyla may process communications between you and Zyla or authorized Providers, including chats, emails, SMS, WhatsApp messages, support interactions and other communications made through or in connection with the Zyla Platform.

Calls made in connection with Zyla services may be recorded for quality assurance, audit, training, documentation, safety and compliance purposes. Zyla will provide any notice or obtain any consent required under applicable law.

Where you choose or authorize an integration with a health-monitoring device, wearable, application or other third-party service, Zyla may receive information from that source in accordance with your authorization and the applicable third party’s terms and privacy practices.

Where payments are made through the Zyla Platform, Zyla may process transaction information necessary to facilitate, verify, reconcile or support the transaction. Payment credentials may be processed by authorized payment gateways or payment service providers in accordance with their applicable terms and privacy practices.

Zyla may collect Personal Data:

a) directly from you when you register, complete a profile or assessment, communicate with Zyla or a Provider, participate in a consultation, upload information, use the Zyla Platform or otherwise interact with Zyla;

b) from an authorized parent, guardian, caregiver or representative;

c) from doctors, nutritionists and other members of the Zyla Care Team or authorized Providers involved in providing or coordinating your care;

d) from hospitals, diagnostic laboratories, pharmacies and other healthcare or service providers where necessary and authorized for providing or coordinating services;

e) from employers, insurers, pharmaceutical companies or other Program Sponsors where relevant to eligibility, enrollment or administration of a Program;

f) from connected devices, applications or services that you authorize to share information with Zyla;

g) automatically through your use of the Zyla Platform, including through operational logs and technologies necessary to provide and secure the Platform; and

h) from other lawful and authorized sources where permitted under applicable law.

Zyla may process Personal Data for purposes including:

a) creating and managing User accounts;

b) verifying identity, eligibility or enrollment;

c) providing and facilitating healthcare, wellness, preventive care, disease-management and care-management services;

d) facilitating consultations with doctors, nutritionists and other authorized Providers;

e) developing, delivering and managing personalized care plans, recommendations and follow-ups;

f) coordinating diagnostic tests, pharmacy services, healthcare services and other requested services;

g) maintaining healthcare, consultation and service records;

h) scheduling and managing appointments;

i) communicating reminders, care-related information, transactional information, security notifications and other service communications;

j) providing customer support;

k) processing payments and transactions;

l) maintaining and improving the security, reliability and functionality of the Zyla Platform;

m) detecting, investigating and preventing fraud, unauthorized access, misuse and security incidents;

n) monitoring and improving service quality and Provider performance;

o) conducting analytics and improving Zyla’s products, services, Programs and operations;

p) conducting or supporting research, publications, Program evaluation and analysis using aggregated, anonymized or de-identified information where appropriate and permitted by applicable law;

q) complying with healthcare, pharmacovigilance, safety, legal, regulatory, tax, audit and other applicable obligations;

r) establishing, exercising or defending legal rights and claims; and

s) other purposes disclosed to you or permitted under applicable law.

Where required under applicable law, Zyla will obtain appropriate consent before Processing Personal Data for a particular purpose.

In order to provide and coordinate healthcare and related services, relevant Patient information may be made available to members of the Zyla Care Team and authorized Providers involved in the Patient’s care.

Access to Patient information is intended to be limited to persons who require such information for authorized healthcare, care-management, operational, compliance or other permitted purposes.

Providers using Orbit or other parts of the Zyla Platform are required to maintain the confidentiality of Patient information and to access, use and disclose such information only as authorized and permitted under applicable law and the Terms.

Zyla does not sell Personal Data.

Zyla may share relevant Personal Data where reasonably necessary for the purposes described in this Privacy Policy, including with:

Doctors, nutritionists, care managers, health coaches and other authorized Providers involved in providing or supporting services.

Hospitals, diagnostic laboratories, pharmacies, healthcare facilities and other service providers where necessary to provide, coordinate or fulfil requested services.

Authorized service providers supporting hosting, cloud infrastructure, communications, customer support, payment processing, security, technology, operations or other functions necessary to operate Zyla’s services.

Such service providers are expected to process information in accordance with applicable contractual, confidentiality, privacy and security requirements.

Where services are provided as part of an insurer-, employer-, pharmaceutical-company- or other sponsor-funded Program, Zyla may share information with the relevant Program Sponsor as described in Section 8.

Zyla may disclose information where reasonably necessary to comply with applicable law, regulation, court order, governmental request, healthcare or safety obligation, or to establish, exercise or defend legal rights.

Where Zyla becomes aware of information concerning an adverse event, product safety concern or other matter subject to pharmacovigilance or regulatory reporting requirements, relevant information may be reported to the applicable pharmaceutical company, authorized pharmacovigilance partner or regulatory authority as required or permitted by applicable law.

Zyla may provide services to individuals through Programs funded, offered or facilitated by insurers, employers, pharmaceutical companies or other sponsoring organizations (“Program Sponsors”).

A Program Sponsor may provide Zyla with Personal Data necessary to identify eligible individuals, facilitate enrollment, administer the Program or enable Zyla to provide services on the Sponsor’s behalf.

Where Zyla provides care-management or related services on behalf of an insurer that has an existing relationship with the Patient, Zyla may share relevant individual-level information, including Health Information, with the insurer in accordance with the applicable Program, contractual arrangements, authorizations and applicable law.

Such information is used for purposes relating to care management, assessment of Program effectiveness, health outcomes and analysis, and not by Zyla for insurance underwriting or claims adjudication unless separately authorized and permitted under applicable law.

Where an employer sponsors a Program, Zyla generally provides the employer with aggregated or de-identified information relating to Program participation, utilization, engagement and outcomes.

Zyla does not share an individual Patient’s identifiable Health Information with the employer unless the individual has provided appropriate consent or authorization for such disclosure, including where the employer has obtained the required consent from the individual and provided or documented such authorization to Zyla, or where disclosure is otherwise permitted or required under applicable law.

Where a pharmaceutical company or another organization sponsors a Program, Zyla may provide the Sponsor with aggregated or de-identified information relating to Program participation, engagement, outcomes, care-management effectiveness or other Program-level analysis.

Identifiable Patient information will not be shared with such Sponsors except where specifically authorized by the Patient or otherwise permitted or required under applicable law, including applicable safety or pharmacovigilance requirements.

Zyla may create and use aggregated, anonymized or de-identified information derived from information processed through its services.

Such information may be used for:

Zyla may share such aggregated, anonymized or de-identified information with Program Sponsors, research collaborators, academic or scientific organizations, publication partners or other appropriate parties where permitted under applicable law.

Zyla will take reasonable measures designed to ensure that information represented as anonymized or de-identified does not identify an individual and will not intentionally re-identify such information except where permitted or required under applicable law.

Zyla may send marketing or promotional communications in accordance with applicable law and your communication preferences.

You may opt out of marketing communications using the unsubscribe or opt-out mechanism provided or by contacting Zyla.

Opting out of marketing communications will not prevent Zyla from sending essential service-related, transactional, security, appointment, consultation or care-related communications necessary to provide requested services.

Zyla does not disclose identifiable Health Information to advertising platforms or other third parties for targeted or behavioural advertising.

Zyla generally retains Personal Data and Health Information for a period of up to ten (10) years from the date of collection or the last relevant interaction, unless a longer or shorter retention period is required or permitted under applicable law or is reasonably necessary for the purpose for which the information is processed.

Retention may be necessary for purposes including maintaining healthcare and consultation records, continuity of care, regulatory and pharmacovigilance obligations, audit requirements, resolving disputes, enforcing agreements, fraud prevention and maintaining appropriate financial, operational and security records.

Different categories of information may therefore be retained for different periods where required by applicable law or Zyla’s applicable retention requirements.

At the end of the applicable retention period, Zyla may securely delete, anonymize or otherwise dispose of Personal Data in accordance with applicable law.

Zyla implements reasonable and appropriate technical and organizational safeguards designed to protect Personal Data against unauthorized access, acquisition, disclosure, alteration, loss, destruction or misuse.

These safeguards may include encryption, access controls, authentication mechanisms, logging, monitoring, backups and other security measures appropriate to the nature and sensitivity of the information being processed.

Access to Personal Data is intended to be limited to authorized personnel and service providers who require such access for legitimate and authorized purposes.

However, no electronic transmission, storage system or technology can be guaranteed to be completely secure.

Where Zyla becomes aware of a Personal Data breach or security incident, Zyla will investigate and take appropriate steps, including notifications to affected individuals or authorities where required under applicable law.

Zyla may provide services to Users located outside India and may engage service providers operating in different jurisdictions.

Accordingly, Personal Data and Health Information may be transferred to, accessed from, processed in or stored in India or other jurisdictions in which Zyla or its authorized service providers operate.

Zyla will undertake such transfers and Processing in accordance with applicable data protection laws, contractual requirements and regulatory requirements.

Additional privacy notices or terms may apply to services provided in jurisdictions outside India.

Zyla may use cookies and similar technologies that are necessary to operate, secure and maintain the Zyla Platform, remember User preferences, maintain sessions and understand the performance and use of Zyla’s services.

Zyla does not use third-party marketing or advertising tracking technologies to disclose identifiable Health Information to advertising platforms.

Where Zyla introduces analytics, marketing or other non-essential tracking technologies in the future, Zyla will implement appropriate notice, choice or consent mechanisms where required under applicable law and update this Privacy Policy as appropriate.

A User may add a dependent to their account in order to access consultations or other Zyla services on behalf of that dependent.

Zyla may collect information including the dependent’s name, date of birth, relationship information and relevant Health Information. Date of birth may be used to identify whether the dependent is a minor.

By adding or managing a dependent, the account holder represents that they are the parent, legal guardian, caregiver or other person appropriately authorized to provide information and access or manage services on behalf of the dependent.

In sponsor-led Programs, Zyla may also receive dependent and eligibility information from the relevant Program Sponsor or its authorized representatives.

Zyla may implement additional verification or consent mechanisms where required by applicable law.

Depending upon applicable law and your relationship with Zyla, you may have rights relating to your Personal Data, including the right to:

a) obtain information regarding the Processing of your Personal Data;

b) request access to information about Personal Data processed by Zyla;

c) request correction, completion or updating of inaccurate or incomplete Personal Data;

d) request deletion or erasure of Personal Data where applicable;

e) withdraw consent where Processing is based upon consent, subject to the consequences of such withdrawal and any lawful basis for continued Processing;

f) nominate guardian to exercise applicable rights on your behalf in circumstances recognized by applicable law;

g) raise a grievance regarding Zyla’s Processing of Personal Data; and

h) exercise any other privacy rights available under applicable law.

Requests may be subject to reasonable identity or authority verification.

Certain rights are not absolute. Zyla may retain or continue to process information where necessary or permitted for healthcare, regulatory, legal, security, fraud-prevention, dispute-resolution or other lawful purposes.

Withdrawal of consent or deletion of certain information may affect Zyla’s ability to provide some services.

The Zyla Platform may contain links to or integrate with third-party websites, applications, devices or services.

The privacy practices of such third parties are governed by their own privacy policies and terms. Zyla encourages Users to review the privacy practices of third-party services before providing information to or using those services.

Zyla may update this Privacy Policy from time to time to reflect changes to its services, technology, business practices or applicable legal and regulatory requirements.

Where changes are material, Zyla may provide appropriate notice through the Zyla Platform, email or other appropriate means.

The “Last revised” date at the beginning of this Privacy Policy indicates when it was most recently updated.

This Privacy Policy explains how Zyla processes Personal Data and Health Information.

Zyla’s Terms and Conditions govern access to and use of the Zyla Platform and services, including User and Provider responsibilities, limitations of liability, indemnification, governing law and dispute resolution.

Any dispute arising out of or relating to this Privacy Policy shall be governed by the Governing Law and Dispute Resolution provisions contained in Zyla’s Terms and Conditions.

Nothing in this Privacy Policy limits any rights available to an individual under applicable law.