Privacy Policy — Varah Group

Plain Language Summary

What This Policy Means in Simple Terms

We respect your privacy. Our products exist to help you — not to exploit your data. We collect only what is necessary, we never sell your personal data, and you can delete your data at any time.

Is my data sold? No. Never. Not to anyone.

Is it secure? Yes — encrypted in transit (TLS) and at rest.

Can I delete my data? Yes, anytime. Full deletion within 30 days.

Are there ads? No ads. No trackers sold to advertisers.

AI Training? Anonymised data only. Opt-out available.

Support varahgrp@gmail.com

01

Who We Are

This Privacy Policy applies to all products operated by Varah Group (Varah Health and Technology Private Limited):

ARYA — aryaai.in

Personal AI companion for thinking, growth, and wellness. Available as a PWA with Free, Core, Pro, and Elite plans.

ErMate — ermate.in

AI-powered voice-first clinical documentation platform for Indian emergency departments.

NÉVARH

Luxury Kashmiri saffron skincare brand. Products sold via Amazon India and our website.

Data Controller: Varah Group (Varah Health and Technology Pvt. Ltd.)
Address: Perumbillissery, Cherpu Post 680561, Kerala, India
Email: varahgrp@gmail.com

02

What Data We Collect — By Product

ARYA

Category	What We Collect	Why
Account	Name, email, password hash, language preference, plan	To create and manage your account
Conversations	Chat messages, AI responses, conversation history	To provide personalised responses and memory
Voice	Audio recordings (processed in real time, not stored permanently)	To power voice conversations and voice notes
Goals & Mood	Goal entries, mood logs, energy check-ins	To provide proactive check-ins and growth tracking
Documents	Uploaded files and images (stored securely)	To enable document analysis and summaries
Usage	Feature usage, session duration, device type, IP address	To improve the product and fix issues
Payment	Billing metadata only (processed by Razorpay)	To manage subscriptions. We never store card numbers.

ErMate

Category	What We Collect	Why
Clinician Account	Name, email, institution, registration number, specialisation	Account creation and professional verification
Voice / STT	Audio processed in real time via Sarvam AI (not stored long-term)	To generate clinical documentation from speech
Case Documentation	Transcripts, ABCDE fields, vitals, SAMPLE history, clinical notes	To create and store case sheets and discharge summaries
Patient Data	Clinical data entered by the treating clinician	We are a data processor; the clinician’s institution is the data controller for patient data
Usage	Session duration, features used, device type, IP	To improve the platform and resolve issues

NÉVARH

Category	What We Collect	Why
Order Data	Name, delivery address, email, phone, order details	To fulfil your purchase and communicate about delivery
Payment	Handled entirely by Amazon Pay or payment gateway. We do not store card details.	Transaction processing
Support	Messages related to returns, queries, or feedback	To provide after-sales support

03

What We Do NOT Collect

Full credit card numbers or banking credentials — all payments are handled by Razorpay or Amazon Pay.
Audio or video recorded without your explicit activation (you must tap the microphone to begin).
Data purchased from third-party data brokers or advertising networks.
Sensitive biometric data such as fingerprints or face scans.
Identifiable patient data beyond what the treating clinician explicitly enters into ErMate.

04

How We Use Your Data

Your data is used specifically and only for:

Providing the service — delivering the features you use in each product.
Personalisation — for ARYA, this includes cross-conversation memory, goal check-ins, and mood tracking. For ErMate, it includes case history and documentation preferences.
AI improvement — anonymised, aggregated data is used to improve our models. Individual data is never used for training without de-identification. You may opt out in account settings.
Customer support — to respond to your queries, resolve issues, and manage your account.
Security and fraud prevention — to detect and prevent misuse of our services.
Order fulfilment (NÉVARH) — to process, ship, and support your purchase.
Legal compliance — to meet obligations under applicable Indian law.

We do not use your data to show you targeted advertising or to build advertising profiles.

05

Sensitive Personal Data

If you share sensitive information with ARYA — such as health concerns, personal struggles, or mental health experiences — you do so voluntarily. We treat this data with the highest security standards. Please remember that ARYA is an AI assistant, not a licensed medical or mental health professional.

For ErMate, all clinical and patient data is treated as sensitive by default. Data is encrypted, access-controlled, and never used for AI training in identifiable form. Varah Group acts as a data processor; the treating institution is the data controller for patient records.

NÉVARH does not collect health or medical data as part of the purchasing process.

06

Who We Share Data With

We share your data only in the following limited circumstances:

Service Providers

OpenAI (GPT-4o) — powers ARYA’s AI responses. Data shared per OpenAI’s enterprise API terms.
Sarvam AI — Indian language voice and STT/TTS for ARYA and ErMate.
Supabase / AWS — cloud database and hosting infrastructure.
Razorpay — payment processing for ARYA subscriptions.
Amazon India — marketplace for NÉVARH products.

All service providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

Legal Requirements

We may disclose data if required by a valid court order, government authority, or law enforcement request under applicable Indian law. We will notify you of any such request where legally permitted to do so.

Business Transfers

In the event of a merger, acquisition, or sale of Varah Group, user data may be transferred to the acquiring entity under the same privacy obligations as set out in this policy. You will be notified in advance.

We never sell, rent, or trade your personal data to third parties for marketing or advertising purposes.

07

Data Storage and Security

All data is encrypted in transit using TLS 1.2 or higher.
All data is encrypted at rest using AES-256 or equivalent.
Access to production systems is restricted to authorised personnel only, with multi-factor authentication required.
For ErMate, additional security measures include device-level authentication and role-based access control.
We conduct regular security reviews and promptly address identified vulnerabilities.

No digital system is completely immune to breaches. In the event of a data breach that materially affects your personal data, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable law.

08

Your Rights

Under the Digital Personal Data Protection Act, 2023 (India) and other applicable laws, you have the right to:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate or incomplete personal data.
Erasure — request deletion of your personal data (Right to be Forgotten).
Portability — receive your data in a commonly used, machine-readable format.
Opt-out of AI training — opt out of your data being used (even anonymised) for AI model improvement.
Withdraw consent — withdraw consent for any data processing based on consent, at any time.
Raise a grievance — contact our Grievance Officer (see below) for any privacy concern.

To exercise any of these rights, email us at varahgrp@gmail.com with the subject line “Privacy Request — [Your Right]”. We will respond within 7 business days and act within 30 days.

09

Data Retention and Deletion

ARYA

You may delete your ARYA account at any time via account settings. Upon deletion, all personal identifiers and conversation history are permanently removed from our active databases within 30 days. Some anonymised data may remain in aggregate AI training datasets where it cannot be reasonably isolated.

ErMate

Clinician account data is retained for the duration of your active subscription and for a reasonable period thereafter for legal and audit purposes. Patient case data is retained in accordance with applicable healthcare record-keeping obligations. Contact support@ermate.app to request deletion of your clinician account or specific case records beyond the mandatory retention period.

NÉVARH

Order records are retained for the period required by applicable tax and consumer protection law (typically 7 years). Personal data beyond this mandatory period will be deleted on request. Contact varahgrp@gmail.com to request deletion.

10

Children’s Privacy

ARYA and ErMate are not designed for or directed at children under the age of 13 (or a higher age as required by local laws). We do not knowingly collect personal data from children under 13 without verifiable parental consent.

If we discover that we have inadvertently collected data from a minor without appropriate consent, we will delete it immediately. If you believe your child has provided us with personal data, please contact us at varahgrp@gmail.com.

NÉVARH products are cosmetic items that may be used by or for minors under parental supervision; however, purchasing requires an adult.

11

Cookies and Tracking

Essential cookies — used to keep you logged in and secure your session on ARYA and ErMate. These cannot be disabled without breaking core functionality.
Analytics cookies — used to understand how our products are used (e.g., which features are most used, session duration). These are used to improve the product, not to profile you.
No advertising cookies — we do not use cookies to serve you advertisements or sell your browsing data to advertisers.

You can manage cookie preferences through your browser settings at any time. Disabling analytics cookies will not affect the core functionality of any Varah Group product.

12

Third-Party Links and Services

Our products may contain links to or integrations with third-party websites and services (including Amazon, Razorpay, OpenAI, and Sarvam AI). Once you leave our product or connect a third-party service, their own privacy policy applies. We are not responsible for the privacy practices of third-party services.

For NÉVARH products purchased via Amazon, Amazon’s privacy policy governs the data collected during the purchase process on the Amazon platform.

13

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this page. For significant changes that materially affect your rights or how your data is used, we will notify registered ARYA and ErMate users via email or a prominent in-app notice at least 14 days before the changes take effect.

Your continued use of any Varah Group product after the effective date of an updated policy constitutes your acceptance of the changes.

14

Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the details of our designated Grievance Officer are:

Organisation: Varah Group (Varah Health and Technology Pvt. Ltd.)
Role: Data Privacy & Grievance Handling
Email: varahgrp@gmail.com
Address: Varah Group, Perumbillissery, Cherpu Post 680561, Kerala, India

We acknowledge all grievances within 48 hours and aim to resolve them within 30 days of receipt.

15

Contact Us

For any privacy questions, data requests, or concerns, contact us at:

General / Data Requests: varahgrp@gmail.com
ARYA Support: support@aryaai.in
ErMate Support: support@ermate.app
NÉVARH Support: varahgrp@gmail.com

Subject line format: “Privacy Request — [Access / Deletion / Correction / Opt-out]”