Privacy Policy

Last updated: 11 October 2026 · The Adhyog service is in beta, so we keep this policy up to date as it changes (section 13).

Adhyog Software Private Limited (“Adhyog”, “we”, “us”) makes software that businesses in India use to run their daily work: Adhyog for shops, restaurants and service businesses (billing, inventory, orders and customers), Adhyog Care for clinics and hospitals, and Adhyog School for schools. It runs on the web, in our mobile apps and as a desktop app.

For shops, restaurants and service businesses we offer the main Adhyog app and focused apps for particular kinds of business, such as Adhyog Restaurant and Adhyog Services. Clinic staff and patients use the Adhyog Care app, and school staff and parents use the Adhyog School app. This policy covers all of them.

This policy explains what personal data we handle, why, who else processes it, how long we keep it, and the rights you have under applicable law.

1. Who is responsible for your data

If you have an Adhyog account — as a business owner, a member of staff, or a parent using a school’s app — we decide how your account data is used, so we are responsible for it.

Businesses use Adhyog to keep records about other people — a shop’s customers, a clinic’s patients, a school’s students and parents, and each business’s staff and suppliers. The business is responsible for those records: it decides what to record and why, and we handle the data only on its behalf and on its instructions — apart from producing the anonymised statistics described in section 3. The same applies to the details you enter on a business’s ordering, menu or booking page that runs on Adhyog.

If you are one of those people, please contact the business first to see, correct or delete your record. If you write to us instead, we may pass your request to the business.

2. What we collect

2.1 Your account

Your name, email address, mobile number if you add one, your password (stored only as a bcrypt hash, never as the password itself), your role, and the businesses you can open. When you sign up we email you a one-time code to confirm your address. We also keep security records such as sign-in attempts.

2.2 Records a business keeps in Adhyog

Shops, restaurants and service businesses: products and inventory, bills and payments, expenses, suppliers, GSTIN and PAN where the business records them, and customers’ names, phone numbers, addresses, orders, balances due and reminders.
Clinics and hospitals (Adhyog Care): patients’ names, age or date of birth, sex, contact details and ID numbers; appointments, consultation notes, vitals, prescriptions, lab tests and reports, admissions, medicines dispensed, bills, and documents the clinic uploads. This is health data and we treat it as sensitive.
Schools (Adhyog School): students’ names, class, date of birth, attendance, fees and marks, and their parents’ or guardians’ contact details; where the school records them, health details such as allergies, medical conditions, regular medication, and doctor and emergency contacts, the consent a guardian gives for medicine to be given at school, and visits to the school’s medical room; behaviour records, including incidents, commendations and any action taken; meal-plan enrolment; and, after a student leaves, alumni contact details kept with their consent. Staff records including, where the school enters them, PAN, UAN, ESIC and bank details for payroll. Adhyog asks only for the last four digits of an Aadhaar number, and schools should not upload full Aadhaar numbers. Student health details are health data and we treat them as sensitive.
Staff attendance: the check-in and check-out times a business records.

Passwords, bank account details and health records are “sensitive personal data or information” under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and we protect them accordingly.

2.3 What you send through a business’s public page

When you order from a shop’s online catalogue or a restaurant’s table QR menu, or book through a business’s booking link, you give that business your name, phone number, delivery address (for deliveries) and the order or booking details — and, on a pharmacy’s catalogue, a photo of your prescription if you choose to upload one. The business receives them through Adhyog.

2.4 Files

Logos, product photos, and the documents and images attached to bills, prescriptions or patient records. A service business’s rider may also take a photo when collecting or delivering an order, as proof of pickup or delivery. Such a photo may show the customer’s premises or the customer. It is stored privately and shown only to that business’s own staff.

2.5 Technical data

IP address, browser or device type, the address requested and timestamps, kept in server logs for as long as security and the law require (section 8), to keep the service secure and to find and fix faults.

If you turn on alerts in one of our mobile apps, we also keep that phone’s notification token, its model name, whether it runs Android or iOS, which of our apps it is and the language you use, so that alerts reach the right phone in your language (section 4).

2.6 What we don’t collect

We currently don’t use advertising or product-analytics tools, our apps don’t send crash reports, and we don’t track your location. If that changes, we will update this policy first.

3. How we use it

To provide the service: keep the records, print and share bills, send the messages and reminders a business sets up, and keep your devices in sync.
To keep accounts secure: verification codes, sign-in checks and preventing misuse.
To send service emails: sign-up codes, password resets, and notices about security, billing or changes to this policy. Product news only if you ask for it.
To give support and fix the problems you report to us.
To meet legal obligations, such as tax and GST record-keeping and lawful requests from authorities.

We may also turn data into anonymised, aggregated statistics — for example totals across many businesses — that cannot identify you, any business or anyone in its records, and use them to improve Adhyog and to publish insights and benchmarks.

We do not sell personal data or share it with advertisers. We don’t currently send it to outside AI services; if we start to, we will update this policy first.

4. App permissions

Our mobile apps ask for each permission only when you use the feature that needs it. That includes notifications: our apps never ask for them when you sign in. They ask only when you tap “Turn on” for alerts or, for clinic staff in Adhyog Care, when you open the Alerts screen. Every permission is optional: if you say no, only that feature stops working, and you can change your choice at any time in your phone’s settings. What a permission gives the app is used only for the purpose described here.

Permission	What it is used for
Camera	Scanning barcodes, and taking photos to attach to a record — for example of a product, or the photo a service business’s rider may take as proof of pickup or delivery, which may show the customer’s premises or the customer. A photo is uploaded only when you choose it for a record. Proof photos are stored privately and shown only to that business’s own staff.
Photos and files	Choosing a photo from your gallery, such as a product photo, a proof photo or a logo, or a file to import. Only what you pick is read.
Contacts	Picking a customer from your phone’s contacts instead of typing their name and number. Only the contact you choose is read — its name and number — and we never upload or change your address book.
Bluetooth	Connecting to the Bluetooth printers you have paired with your phone, to print bills and receipts.
Notifications	Showing alerts on your phone, if you turn them on. In our apps for shops, restaurants and service businesses: new online orders and bookings, and a restaurant’s table orders; a bill made offline that could not be saved when it was synced, or was saved at a different total; a daily low-stock reminder; a cash register left open from an earlier day; and word that a new business has been approved. In Adhyog School: new notices, for staff and parents, and the school’s messages to parents. In Adhyog Care: pages to clinic staff, such as critical lab results, lab and imaging reports that are ready, admissions and discharges; and, for patients, a note that the clinic has sent them a message. Adhyog Care alerts never name a patient or show their health details: they only say there is something to read in the app.
Fingerprint or face unlock	Adhyog Care can lock itself when you step away and unlock with your phone’s fingerprint or face check. The check happens on your phone; nothing about it leaves the device.
Location (approximate)	Adhyog Care only, and only when you tap “Show clinics near me”: with your permission, the app uses your approximate location to show clinics near you and how far they are. It is used on your phone to measure distance and is not sent to us or stored. The app never asks for your precise location and never reads your location in the background.
Microphone	Voice entry, if the app offers it: your speech is turned into text on our own servers for that entry. The microphone is used only while you are recording.

We don’t read your SMS messages or call logs, and no Adhyog app tracks your location.

5. WhatsApp messages

5.1 Sharing from your own WhatsApp

When you tap “Share on WhatsApp”, Adhyog opens your WhatsApp app with the message ready. You send it yourself, and it travels between your phone and WhatsApp like any other message you send.

5.2 A business’s connected WhatsApp Business account

Where Adhyog offers it, a business can connect its own WhatsApp Business account to Adhyog. It then chooses which messages go out automatically — for example a bill, an order update, an appointment reminder or a payment reminder — and Adhyog sends them from the business’s own number through Meta’s WhatsApp Business Platform, acting as the business’s technology provider.

For each message, Meta receives the recipient’s WhatsApp number and the message content (such as their name, the bill or order number and the amount) and tells us whether it was delivered and read. Meta handles this data under its own terms and privacy policy.
We store the connection details — the access token encrypted — and a record of each message with its delivery status.
We send only a business’s own messages to its own customers. Adhyog never messages a business’s customers for its own purposes, and never sends its own marketing through a business’s account.
If you don’t want WhatsApp messages from a business, tell the business — it can stop them. You can also write to us.

6. Who else processes data

We use a small number of service providers, and aim to give each only what it needs for its task.

Provider	What for	Data it receives	Where
Oracle Cloud Infrastructure	Hosting the service, the database, uploaded files and backups	Everything held in Adhyog	India
Cloudflare	Our domain’s DNS, and the secure network every connection to Adhyog passes through	Each request between your device and Adhyog, including your IP address	Cloudflare’s worldwide network
Brevo	Sending our emails: sign-up codes and password resets	Your email address and the email’s content	European Union
Meta Platforms (WhatsApp)	Sending a business’s WhatsApp messages — only if it connects its WhatsApp Business account (§5.2)	The recipient’s WhatsApp number, the message content and its delivery status	Meta’s servers, which may be outside India
Expo, Google (Firebase Cloud Messaging) and Apple push services	Registering phones for alerts and delivering them, in all Adhyog mobile apps (§4)	Your phone’s notification token, which app and type of phone (Android or iOS) it belongs to, and the text of each alert	Outside India
Zoho	Our company email — if you write to us, your message is kept there	Your email address and what you write	India
Services a business connects itself	For example a clinic’s own SMS provider, or a web address a shop sets up to receive its order updates	What that business sends to them — usually a phone number and the message or order details	Chosen by the business

A business that connects its own services chooses them and is responsible for them. We disclose personal data to government authorities only when the law requires it, and only what the request lawfully covers. We may also share it with our professional advisers and auditors under a duty of confidentiality, where needed to establish or defend legal claims, and with a company that takes over the service, which must protect it as this policy describes.

7. Where your data is stored

Adhyog’s servers, database, uploaded files and backups are in India, in Oracle Cloud’s Indian regions. We may also keep recent backups in a second location in India controlled by Adhyog, so the service can be restored if the main copies are lost. Cloudflare, Brevo, Meta and the push services process some data outside India where needed to provide the service, and we follow any restriction the Government of India places on such transfers.

On your phone, our apps keep your sign-in in the phone’s secure storage, and keep some recent data — such as bills or readings waiting to upload while you are offline — on the phone itself. Adhyog Desktop keeps your records on your own computer; its connected editions also sync them to your Adhyog account.

8. How long we keep it

While your account is open we keep your account and your business’s records. A business decides how long to keep the records it holds about its customers, patients or students, within what the law allows, and can delete them or remove the personal details from them.
After an account is closed or a deletion request is confirmed, we normally delete the live data within 30 days.
Backups roll over by themselves: each automatic database backup is kept for 14 days and the point-in-time recovery archive for 30 days, so deleted data normally leaves our automatic backups within about five weeks of its removal from the live service. The copies taken before each software update (the last ten) and any second-location copies are replaced as newer ones are made, so deleted data can stay in them longer; they are used only to restore the service.
Server logs and security records are kept for up to one year, as security and the law require, and then deleted automatically. Server logs can’t be removed before then, including when an account is deleted.
Records the law requires us to keep — for example our own tax and GST records for the fees we charge, and account sign-up details where the law requires them — and records the law or an authority requires us to preserve, or that we need to establish or defend a legal claim, are kept for as long as the law or the matter requires, used only for those purposes, and then deleted.

How to ask for deletion, and exactly what is removed: Data Deletion.

9. How we protect it

HTTPS on every connection to Adhyog.
Passwords stored only as bcrypt hashes.
The phone numbers, email addresses and street addresses in customer, supplier and patient records, and account email addresses, encrypted in the database with AES-256; the access tokens of services a business connects, such as WhatsApp, are encrypted too.
Each business’s data kept separate from every other business’s, and roles controlling what each member of staff can see.
In the Adhyog Care app, screenshots blocked on screens that show patient information.
Backups in private storage with restricted access, and our own staff’s access to data limited to what running and supporting the service needs.

No system is perfectly secure. If you find a security problem, please email info@adhyog.com and we will look into it promptly. If a breach affects your personal data, we will inform you and the authorities as the law requires.

10. Children

Adhyog accounts are for adults (18 or older). Schools that use Adhyog School keep records about their students, many of whom are children. The school is responsible for those records, including obtaining verifiable consent from a parent or guardian where the law requires it. We process children’s data only to provide the school’s service: we don’t track, monitor or build profiles of children for our own purposes, or use their data for advertising.

11. Your rights

Subject to applicable law — including the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 as its provisions come into force — you can:

ask for a summary of the personal data we process about you, how we process it, and who we have shared it with;
have inaccurate or incomplete data corrected, completed or updated;
have your data erased — see Data Deletion;
withdraw consent you gave us (this does not affect processing already done, and if the service needs that data we may no longer be able to provide it);
have a grievance addressed; and
nominate someone to use these rights for you if you die or become unable to.

Email info@adhyog.com from the address on your account, or tell us how we can confirm it is you. We aim to respond within 30 days, and always within the time the law requires. For a record a business holds about you, contact the business first (section 1). If you are not satisfied with our response, you may be able to complain to the Data Protection Board of India, as the law provides.

12. Cookies and browser storage

We don’t set cookies ourselves: the web app keeps your signed-in session, your preferences and work in progress in your browser’s local storage. Cloudflare, which protects the connection to our servers, may set a strictly necessary security cookie. When a business owner connects WhatsApp, Meta’s sign-in window comes from Meta and uses Meta’s own cookies. We don’t use advertising or cross-site tracking cookies.

13. Changes to this policy

The Adhyog service is in beta, and while it is we will keep updating this policy as we add new features and change how the service works. Each version is posted on this page with its “Last updated” date and takes effect from that date — or from when it is posted, if that is later — so please check this page from time to time. Where we think a change is significant, we may also let you know by email or in the app. If a change means using your personal data for a new purpose that needs your consent, we will ask for your consent first.

14. Contact and grievances

Adhyog Software Private Limited
CIN U62011UW2026PTC257152
Registered office: E 1601, TowerE Spring, Meadows GH-07A, TechZone 4, I.A. Surajpur, Noida, Gautam Buddha Nagar - 201306, Uttar Pradesh, India

Grievance Officer: Shivam Gupta — privacy requests, and complaints about the service or any content on it, including under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Anyone may complain, with or without an account: email info@adhyog.com with “Grievance” in the subject, saying what the complaint is about and where the content is. We acknowledge and resolve grievances within the times the law requires.
Help with the product: support@adhyog.com