ODRISC TECHNOLOGIES LLPMATERNAL-FETAL INTELLIGENCEODRISCPrivacy PolicyMaternal-fetal intelligence platformEffective date5 September 2026Applies toODRISC patient-facing mobile and web applications, clinician-facingportal, website, and related maternal-fetal intelligence servicesData fiduciary / controllerODRISC TECHNOLOGIES LLPRegistered office1st Floor, Building No. 23/25, Flat No. 04, Vasil Khan Marg, Surti Mohalla,Mumbai, Maharashtra 400008, IndiaPrivacy and grievance contact support@odrisc.com | +91 98206 79567 | https://www.odrisc.comA healthcare-specific privacy framework for ODRISC patient, clinician, pregnancy, ultrasound, fetal-growth,and connected-health services.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 2PRIVACY AT A GLANCEODRISC processes personal, pregnancy, health, ultrasound, fetal-growth, lifestyle, device, and clinical-workflowinformation to provide a maternal-fetal intelligence platform. We do not sell personal data, share it with databrokers, or use health data for advertising. ODRISC outputs support users and clinicians but do not make anautonomous or final clinical decision. You can manage permissions, withdraw optional consent, exercise privacyrights, and request account deletion as described below.This Privacy Policy explains what ODRISC TECHNOLOGIES LLP ("ODRISC", "we", "us", or "our") collects, how weuse and share it, how long we keep it, and the choices and rights available to you. It replaces the previousODRISC Privacy Policy for the Services from the effective date above.Please read this Policy before using the Services. This Policy is a privacy notice, not a clinical consent form,research consent form, or authorisation to publish a case. Where separate consent is legally required, we willrequest it clearly and separately.CONTENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41. SCOPE OF THIS POLICY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42. WHO IS RESPONSIBLE FOR YOUR DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43. OUR HEALTH-DATA COMMITMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54. HOW WE OBTAIN INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55. PERSONAL DATA WE MAY COLLECT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66. APP-STORE DATA CATEGORY SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77. WHY AND HOW WE USE PERSONAL DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78. LEGAL BASES AND CONSENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89. MATERNAL, FETAL, AND CLINICAL INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810. CLINICIAN AND ORGANISATION ACCOUNTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811. ALGORITHMS, ANALYTICS, AND HUMAN OVERSIGHT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 912. APPLE HEALTHKIT, ANDROID HEALTH CONNECT, AND DEVICES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 913. DEVICE PERMISSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914. WHEN WE SHARE PERSONAL DATA . . . . . . . . . . . . . . . . . . . . . . . . . . 1015. NO SALE, ADVERTISING USE, OR CROSS-APP TRACKING OF HEALTH DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016. COOKIES, SDKS, AND SERVICE ANALYTICS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117. DE-IDENTIFIED DATA, QUALITY IMPROVEMENT, AND RESEARCH
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118. DATA RETENTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219. ACCOUNT AND DATA DELETION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1220. YOUR PRIVACY RIGHTS AND CHOICES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1321. CHILDREN AND UNDER-18 DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1322. INTERNATIONAL DATA TRANSFERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1323. SECURITY AND CONFIDENTIALITY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1424. PERSONAL DATA BREACHES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1425. THIRD-PARTY SERVICES AND LINKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1426. ADDITIONAL REGIONAL INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1527. CHANGES TO THIS POLICY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1528. CONTACT, PRIVACY REQUESTS, AND GRIEVANCES
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 41. SCOPE OF THIS POLICY1.1 This Policy applies to the ODRISC website, patient-facing mobile and web applications, clinician-facingportal, and related services, content, support, communications, integrations, reports, and analytics that link tothis Policy (the "Services").1.2 The Services may support preconception and pregnancy profiles; health history; gestational diabetesmellitus risk assessment, including the RAS Test; BMI and weight trajectories; nutrition and physical-activityguidance; reminders and goals; ultrasound and fetal biometry records; estimated fetal weight, centiles,growth trajectories and velocity; TOW-related, GROW-based, WHO-based, or other configured calculations;clinician dashboards; reports; exports; longitudinal maternal-fetal views; and enabled integrations.1.3 Not every feature or data category described below is active for every user, country, care setting, productversion, or device. We collect a category only when it is needed for an available feature, supplied by anauthorised source, or otherwise described at the point of collection.1.4 This Policy does not govern information controlled independently by Apple, Google, a healthcare provider,laboratory, imaging centre, device maker, payment processor, employer, insurer, or third-party website. Theirnotices apply to their independent processing.2. WHO IS RESPONSIBLE FOR YOUR DATA2.1 Direct consumer use. When you create and use an ODRISC consumer account directly, ODRISC generallydetermines why and how your personal data is processed and acts as the data fiduciary, controller, orequivalent responsible organisation under applicable law.2.2 Healthcare organisation use. When a clinician, hospital, clinic, research institution, or other healthcareorganisation provides your account or submits information in connection with its care or operations, thatorganisation may be the data fiduciary or controller and ODRISC may process the information on itsdocumented instructions as its processor or service provider. The organisation's own privacy notice andpatient-record obligations may also apply.2.3 Separate responsibilities. For limited processing such as ODRISC account administration, platform security,billing records, legal compliance, and product communications, ODRISC may remain independently responsibleeven when the account is organisation-managed. Any enterprise or data-processing agreement controls theallocation of responsibilities for that organisation's environment.2.4 If you are unsure which organisation controls a clinical record, contact the clinic or clinician that invited youand ODRISC at support@odrisc.com.3. OUR HEALTH-DATA COMMITMENTS3.1 We apply data minimisation and purpose limitation. We seek to collect only information reasonablynecessary for a disclosed ODRISC feature, authorised clinical workflow, security need, contractual obligation,or legal requirement.3.2 We do not sell personal data or sensitive health data. We do not share personal data with data brokers. Wedo not use pregnancy, reproductive, clinical, ultrasound, HealthKit, Health Connect, or other health data forthird-party advertising, cross-context behavioural advertising, or marketing profiles.3.3 We do not publish your name, initials, clinical record, diagnostic results, ultrasound information, or otheridentifiable case information. Publication, a case report, testimonial, or human-subject research use requires aseparate lawful basis and any specific consent, ethics approval, and safeguards required for that activity.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 53.4 We do not use identifiable health data to train a general-purpose artificial intelligence model. De-identifiedor aggregated information may be used for security, service measurement, quality improvement, validation,and development only where lawful and subject to the safeguards in Section 16.3.5 Service providers that process personal data for ODRISC must be bound by confidentiality, security,purpose limitation, deletion, and other protections that are the same as or equivalent to the protectionsdescribed in this Policy and required by applicable law and platform rules.4. HOW WE OBTAIN INFORMATIONWe may obtain personal data from the following sources:You. Information you type, upload, record, photograph, scan, import, submit through a questionnaire, provideto support, or permit the Services to access.Clinicians and healthcare organisations. Information supplied by an authorised doctor, midwife, dietitian,physiotherapist, sonographer, clinic, hospital, laboratory, imaging centre, administrator, or care-team member.Enabled integrations. Data you authorise ODRISC to read from or write to Apple HealthKit, Android HealthConnect, a wearable, connected device, electronic health record, laboratory, imaging system, or organisationsystem.Automatic collection. Device, network, usage, diagnostic, security, and log information generated when theServices are used.App stores and service providers. Subscription status, transaction identifiers, authentication events, deliverystatus, support information, or other limited information needed to provide a requested service. ODRISC doesnot receive a full payment-card number from Apple or Google for store purchases.Lawful representatives. Information provided by an authorised representative, parent or guardian whereapplicable, nominee, caregiver, or person acting under valid authority.5. PERSONAL DATA WE MAY COLLECT5.1 Account, identity, and contact data. Name, user name, date of birth or age, email address, phone number,postal or residential address, language, profile image, account identifier, encrypted or hashed authenticationcredentials, verification status, and communication preferences.5.2 Demographic and profile data. Sex or gender where relevant to the service, height, weight, location orregion, nationality or ethnicity only where lawfully required for a validated feature, and other profilecharacteristics you choose or are required to provide.5.3 Pregnancy and reproductive data. Preconception status, menstrual and reproductive history, lastmenstrual period, estimated due date, gestational age, gravida and parity, prior pregnancies and outcomes,pregnancy stage, fertility-related information, pregnancy complications, and other pregnancy-history inputs.5.4 Health and clinical data. Medical and family history; symptoms; diagnoses reported by you or a provider;allergies; medications and supplements; clinical observations; blood pressure and other vital signs; BMI;current, preconception, and gestational weight; glucose and metabolic information; gestational diabetes riskinputs and outputs; laboratory or diagnostic results; care plans; referrals; appointments; clinician notes; andother information relevant to the enabled health feature.5.5 Ultrasound and fetal-growth data. Ultrasound reports and images when uploaded; pregnancy dating; fetalbiometry measurements; estimated fetal weight; centiles or percentiles; growth trajectory and velocity; TOWcorrection inputs and outputs; configured GROW, WHO, or other growth-standard outputs; Doppler, placental,amniotic-fluid, and related clinical observations where enabled; measurement dates, units, methods,equipment or operator context where supplied; and report history.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 65.6 Lifestyle, nutrition, and activity data. Dietary preferences and restrictions, meal or nutrition entries,physical activity and exercise, step or movement data, sleep or wellness data where enabled, weight goals,reminders, adherence and progress information, and responses to wellness or risk questionnaires.5.7 Location data. Address, city, state, country, approximate location derived from an IP address, and precisedevice location only if an enabled feature requests it and you grant permission. The disclosure shown beforeaccess will explain the specific purpose, such as a location-dependent service or regional availability.5.8 User content and communications. Messages to an authorised care or support team, appointment orservice requests, notes, feedback, survey responses, documents, photographs, reports, exported files, andinformation included in support calls or correspondence. Do not use ordinary support channels foremergencies.5.9 Clinician and organisation data. Professional name, work contact details, credentials, licence orregistration details, specialty, role, organisation, facility, authorised patient assignments, permissions,administrative actions, attestations, and audit history.5.10 Device, technical, usage, and log data. IP address; device and operating-system type and version; appversion; language and time zone; device or app instance identifiers; network and configuration information;login events; date, time, duration, and feature interactions; referral source; cookie or similar identifiers; crashlogs; performance data; error reports; security events; and diagnostic statistics.5.11 Subscription and transaction data. Plan, entitlement, subscription status, renewal or cancellation status,purchase date, currency, amount, receipt or transaction identifier, and limited billing records. A paymentprovider or app store independently handles full payment credentials under its own privacy notice.5.12 Consent, permission, and rights records. Privacy and Terms acceptance, permission choices, consent andwithdrawal records, sharing authorisations, research consent where separately obtained, deletion requests,access or correction requests, grievance records, and evidence needed to demonstrate compliance.5.13 Sensitive inferences and outputs. Risk categories, trends, alerts, recommended review points, calculatedgoals, and other outputs generated from the information above. These are decision-support or informationaloutputs and are not an autonomous or final diagnosis or treatment decision.6. APP-STORE DATA CATEGORY SUMMARYApp stores group data differently from this Policy. Depending on the enabled features and actual app build,ODRISC data may fall within the following Apple App Privacy or Google Play Data safety categories:Contact information: name, email address, phone number, physical address, and other contact details.Health and fitness: pregnancy, reproductive, medical, diagnostic, laboratory, ultrasound, fetal-growth,nutrition, weight, activity, fitness, wellness, and HealthKit or Health Connect information.Location: approximate location and, only with permission for an enabled feature, precise location.Identifiers: user ID, account ID, app instance ID, device identifiers, and transaction identifiers.User content and communications: documents, photographs, ultrasound files, reports, notes, messages,support content, and other uploaded content.Purchases: subscription status, purchase history, receipt, and entitlement information, but not the fullpayment-card details handled by the store or payment provider.Usage data: product interactions, feature use, session information, and other app activity.Diagnostics: crash data, performance data, error information, and other technical diagnostics.Other data: clinician credentials, organisation details, permission records, security events, and audit logswhere the store taxonomy does not provide a more specific category.The disclosures in Apple App Store Connect and Google Play Console must reflect the data actually collectedor shared by every distributed build and every embedded SDK. Store disclosures may use different definitionsof "collection" and "sharing" and should be read together with this Policy and any in-app notice.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 77. WHY AND HOW WE USE PERSONAL DATAWe may process personal data for the following purposes:create, authenticate, administer, secure, and support accounts;provide the feature you request and maintain a longitudinal pregnancy record;calculate and display BMI, weight trajectories, risk estimates, centiles, growth trajectories, velocity, configuredstandards, reminders, goals, and explanatory information;personalise nutrition, physical-activity, weight, educational, and pregnancy-stage support based on permittedinputs;enable clinician dashboards, patient lists, notes, reports, exports, communication, review, referral, andauthorised care workflows;connect, import, synchronise, or export information through an integration you enable;verify data quality, identify missing or implausible entries, troubleshoot errors, and maintain feature safety andreliability;send account, security, appointment, service, subscription, and clinical-workflow communications;provide customer support, respond to rights requests and grievances, and maintain request records;process subscriptions and confirm entitlements;prevent fraud, abuse, unauthorised access, security incidents, and violations of the Terms;monitor performance, measure service use, debug, test, validate, and improve the Services using appropriatelylimited data;comply with contracts, law, regulation, professional obligations, court orders, and lawful government requests;andestablish, exercise, or defend legal claims and protect users, clinicians, ODRISC, and others from harm.We will not use personal data for a materially different and incompatible purpose without giving an updatednotice and obtaining consent where required.8. LEGAL BASES AND CONSENT8.1 The legal basis depends on your location, the feature, the type of data, and whether ODRISC or a healthcareorganisation controls the processing. We process personal data only when a valid basis applies.8.2 Bases may include your specific, informed, freely given, and unambiguous consent; explicit consent forhealth or other specially protected data; performance of a contract or steps you request before a contract;compliance with law; protection of vital interests; provision or management of healthcare by authorisedprofessionals where law permits; public-interest or approved research grounds; and legitimate interests thatare not overridden by your rights where that basis is recognised by applicable law.8.3 In India, ODRISC will process personal data based on consent or another use permitted by the DigitalPersonal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisionscome into force, together with other applicable Indian law.8.4 Where consent is optional, refusing or withdrawing it will not affect unrelated features. It may prevent thefeature that requires the data from working. Withdrawal does not make earlier lawful processing unlawful.8.5 System permission, acceptance of this Policy, and medical or research consent are different. A devicepermission only allows the technical access described in the prompt. We seek separate consent when the lawor purpose requires it.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 89. MATERNAL, FETAL, AND CLINICAL INFORMATION9.1 Pregnancy, reproductive, ultrasound, fetal-growth, diagnostic, and clinical data is sensitive. We restrictaccess according to role, purpose, organisation, and care relationship and record relevant access andadministrative actions where appropriate.9.2 Fetal measurements and observations form part of the pregnant user's or healthcare provider's pregnancyrecord. They do not create a separate consumer account for an unborn child.9.3 ODRISC may combine information across time to display maternal and fetal trajectories and relationships.For example, the Services may use gestational age, health history, weight, laboratory data, ultrasoundmeasurements, selected standards, and prior observations to generate a risk estimate, growth chart, trend, ormatter for clinician review.9.4 ODRISC does not independently diagnose a condition, select treatment, direct an intervention, or make anautonomous or final patient decision. A qualified clinician must independently interpret source data andoutputs and decide whether assessment, testing, diagnosis, monitoring, referral, management, or treatmentis appropriate.9.5 If a clinician or organisation submits data about another person, it must have authority, provide anyrequired notice, obtain any required consent, and use the minimum information necessary for the authorisedpurpose.10. CLINICIAN AND ORGANISATION ACCOUNTS10.1 Organisation administrators may create or manage accounts, assign roles, control access, configureintegrations, view audit information, and access records within their authorised environment. Their actions aregoverned by the organisation's policies and agreement with ODRISC.10.2 ODRISC processes provider-controlled clinical records according to the provider's documentedinstructions, applicable healthcare-record law, professional duties, and the relevant data-processingagreement. Requests concerning such records may need to be directed to the provider so it can verify identity,authority, record integrity, and legal retention requirements.10.3 When your access to an organisation-managed account ends, the organisation may retain the clinicalrecord and ODRISC may preserve, return, restrict, or delete it according to that organisation's instructions andapplicable law. Closing a consumer login does not necessarily erase a healthcare provider's independentrecord.10.4 Clinicians must not export, screenshot, message, or share patient information through an unauthorisedchannel. ODRISC may log exports, sharing actions, access events, and administrative changes for security,accountability, and patient-record governance.11. ALGORITHMS, ANALYTICS, AND HUMAN OVERSIGHT11.1 ODRISC may use clinical rules, statistical methods, predictive models, interpolation, reference standards,and other algorithms to organise information and generate estimates, scores, categories, trajectories,recommendations, alerts, or explanations.11.2 These features process the inputs described in Section 5 and may compare them with configuredevidence, thresholds, reference populations, or prior measurements. ODRISC may retain the input, output,model or rule version, timestamp, and review history to support traceability, safety, and interpretation.11.3 ODRISC outputs are designed for meaningful human review. We do not use the platform to make a solelyautomated decision that produces a legal, insurance, employment, access-to-care, or similarly significanteffect. Clinicians and organisations must not use an ODRISC output as the sole basis for such a decision.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 911.4 You may ask for information about a relevant output, correct an inaccurate input, or raise a concernthrough support@odrisc.com or the responsible healthcare provider. Some methodology, validation, orproprietary information may be provided in summary form where full disclosure would compromise security,intellectual property, or another person's rights.12. APPLE HEALTHKIT, ANDROID HEALTH CONNECT, AND DEVICES12.1 Where enabled, ODRISC requests access only to the specific health and fitness data types reasonablynecessary for the feature shown to you. You choose whether to grant each supported permission and mayrevoke it in Apple Health, device settings, Android Health Connect, or the relevant integration.12.2 HealthKit and Health Connect information is used only to provide, secure, support, and improve permittedhealth-related functionality. It is not used for advertising, marketing, data-broker activity, creditworthiness, orunrelated profiling. We do not attempt to bypass a permission or infer a denied data type through anotherpermission.12.3 If ODRISC transmits imported health information to its systems, we will explain the relevant access andpurpose before permission or collection where required. Health information is shared with a clinician, careteam, or another third party only when the sharing is user-directed, organisation-authorised, legally permitted,and subject to the required consent and safeguards.12.4 Revoking a system permission stops future access but may not automatically delete information alreadyimported into ODRISC. Use the ODRISC deletion controls or contact us to request deletion. Deleting ODRISCdata does not delete a copy held independently in Apple Health, Health Connect, a source device, another app,or a provider record.12.5 Data that ODRISC writes to HealthKit, Health Connect, or another service remains subject to that service'scontrols. Review and delete it through that service where necessary.13. DEVICE PERMISSIONS13.1 Depending on the feature, ODRISC may request access to camera, photos, files, notifications, calendar,activity or fitness data, Bluetooth, microphone, location, HealthKit, Health Connect, or another protecteddevice resource.13.2 We request a permission at or before the point it is needed and provide a purpose description. Whereaccess to personal or sensitive data would not be reasonably expected, we first present a prominent in-appdisclosure describing the data, purpose, and relevant sharing, obtain affirmative consent where required, andonly then request the system permission. For example, camera, photos, or files may support upload of a report;notifications may deliver a reminder; calendar may add an appointment; and Bluetooth may connect anauthorised device.13.3 Optional permissions can be refused or later revoked through ODRISC or device settings. The relatedfeature may stop working. Where reasonably possible, we provide an alternative such as manual entry or fileselection instead of continuous access.13.4 ODRISC does not require an unrelated permission as a condition of paid functionality and does notmanipulate or pressure users to grant unnecessary access.14. WHEN WE SHARE PERSONAL DATAWe may share the minimum relevant data with the following recipients for the stated purposes:
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 10Clinicians, care teams, and healthcare organisations when you direct or authorise sharing, when the account isorganisation-managed, or when another lawful care workflow applies.Processors and service providers that provide cloud hosting, storage, database, authentication,communications, notifications, customer support, security, monitoring, error reporting, analytics, documentprocessing, backup, payment support, or professional services on ODRISC's behalf.User-enabled integrations such as HealthKit, Health Connect, a device, health-record interface, laboratory,imaging system, or other service that you or an authorised organisation connects.Apple, Google, and payment providers for app distribution, subscription administration, receipt validation, fraudprevention, support, and store compliance. They independently handle payment and store-account data.Professional advisers, auditors, insurers, and regulators where access is necessary and subject toprofessional, contractual, or legal confidentiality.Courts, law enforcement, emergency responders, government authorities, or affected parties when disclosureis required by law, necessary to respond to valid legal process, or reasonably necessary to protect life, safety,rights, security, or prevent serious harm.Corporate transaction parties in connection with a proposed or completed merger, financing, investment,reorganisation, sale, or transfer, subject to confidentiality, due diligence limits, applicable notice, andcontinued protection.Research institutions or investigators only under Section 16 and any separate consent, ethics approval, andagreement required for identifiable or coded data.We do not permit a recipient to use ODRISC health data for its independent advertising or data-brokerpurposes. A recipient acting as an independent controller must give its own privacy notice and is responsiblefor its independent processing.15. NO SALE, ADVERTISING USE, OR CROSS-APP TRACKING OF HEALTHDATA15.1 ODRISC does not sell or rent personal data. It does not share personal data for money with data brokers.15.2 ODRISC does not use or disclose health, pregnancy, reproductive, diagnostic, ultrasound, fetal-growth,HealthKit, or Health Connect data for third-party advertising, marketing, or tracking across apps or websitesowned by other companies.15.3 ODRISC may send first-party information about an ODRISC feature or service only as permitted by law andyour communication preferences. Health information will not be used to select a marketing audience. You mayopt out of optional marketing without losing essential account, security, appointment, or service messages.15.4 If ODRISC ever introduces a practice that is considered "tracking", "sale", or "sharing" under applicable lawor platform definitions, we will update the relevant disclosure and obtain any required opt-in permission beforethat practice begins. Health-platform data will remain subject to the stricter restrictions above.16. COOKIES, SDKS, AND SERVICE ANALYTICS16.1 The website may use cookies, local storage, pixels, or similar technologies for sign-in, security, language,preferences, session continuity, accessibility, performance, and consented analytics. Mobile applications mayuse software development kits or similar code for authentication, security, crash reporting, notifications,subscription support, and service analytics.16.2 Strictly necessary technologies operate because they are needed to provide or secure the requestedservice. Where law requires consent for non-essential cookies or analytics, we will request it and provide acontrol to withdraw it.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 1116.3 We configure service analytics to minimise data, avoid clinical content where possible, and prevent theanalytics provider from using ODRISC data for advertising or unrelated profiling. We assess embedded SDKbehaviour and require it to match this Policy and store disclosures.16.4 Your browser or device may allow you to block cookies or reset identifiers. Blocking necessary technologymay affect sign-in or service operation. A browser "Do Not Track" signal is not uniformly defined; we respond tolegally recognised opt-out signals where required.17. DE-IDENTIFIED DATA, QUALITY IMPROVEMENT, AND RESEARCH17.1 We may create aggregated or de-identified information using measures designed to prevent it fromreasonably identifying an individual. We may use that information for service statistics, security, qualityimprovement, validation, scientific analysis, and product development where permitted by law.17.2 We do not attempt to re-identify information represented as de-identified, and we contractually prohibitrecipients from doing so where appropriate. If information can reasonably be linked back to a person, wecontinue to treat it as personal data.17.3 Use of ODRISC does not by itself enrol you in research. Human-subject research involving identifiable,coded, or sensitive data will be presented separately and will obtain informed consent and independent ethicsreview where required. The research notice will explain purpose, sponsor, investigator, procedures, duration,risks, benefits, confidentiality, data sharing, withdrawal, and contacts.17.4 We will not publish an identifiable case, testimonial, image, quotation, or result merely because youaccepted this Policy. Any such use requires separate, specific authorisation unless law permits publicationwithout consent after robust anonymisation.18. DATA RETENTION18.1 We retain personal data only for as long as reasonably necessary for the disclosed purpose, an authorisedhealthcare or organisation workflow, legal or professional recordkeeping, security, dispute resolution,research consent, or another lawful requirement. Retention may differ when a healthcare organisationcontrols the record.18.2 Unless a different period is required by law, contract, clinical-record duty, safety need, or afeature-specific notice, our operational schedule is:Account, profile, pregnancy, health, ultrasound, fetal-growth, lifestyle, and user content: while the account orauthorised service relationship is active and until deletion is completed under Section 19.Imported HealthKit, Health Connect, or device data: for the same period as the related ODRISC record, unlessyou delete it sooner or the integration is configured for shorter storage.Usage, diagnostic, and routine security logs: ordinarily up to 12 months; selected security, access, audit, andincident records may be kept longer where necessary to investigate an event or meet law, contract, orhealthcare accountability requirements.Support, consent, rights, and grievance records: ordinarily up to 3 years after closure, or longer where neededto demonstrate compliance or resolve a claim.Subscription, transaction, tax, and accounting records: for the period required by financial, tax, company,consumer, and anti-fraud law, which may be up to 8 years or longer where a proceeding or hold applies.Organisation-managed clinical records: for the period instructed by the healthcare organisation and requiredby applicable healthcare-record law, accreditation, contract, or professional standards.Research records: for the period stated in the separate research consent, protocol, ethics approval, sponsoragreement, and applicable research law.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 1218.3 When data is no longer needed, we delete it, irreversibly de-identify it, or isolate it until secure deletion ispossible. Legal holds, safety investigations, fraud prevention, unresolved disputes, audit duties, andmandatory clinical-record rules may extend a period.19. ACCOUNT AND DATA DELETION19.1 You may initiate deletion through App Settings > Account > Delete My Account. If you cannot access theapp, use the external account-deletion request page linked in the applicable app-store listing or emailsupport@odrisc.com. The process will allow deletion of the account and associated ODRISC personal data, notmerely temporary deactivation.19.2 We may use proportionate verification, reauthentication, or confirmation to prevent accidental deletionand protect another person's data. We will not create unnecessary obstacles. We will tell you if additional time,information, or a lawful retention exception applies.19.3 After a verified request, we ordinarily remove personal data from active ODRISC systems within 30 days.Encrypted residual backups are protected from ordinary use and ordinarily expire or are overwritten within 90days. Data subject to a legal hold, mandatory record period, security or fraud need, unresolved transaction,dispute, research obligation, or provider instruction may be retained only for that purpose and then deleted orde-identified.19.4 Deleting an ODRISC account does not delete information independently held by a clinician, hospital, Apple,Google, payment provider, HealthKit, Health Connect, connected device, source app, or other controller.Contact that party or use its controls.19.5 Account deletion does not automatically cancel an Apple App Store or Google Play subscription. Cancelthrough the applicable store account settings before renewal. We may retain limited transaction evidenceafter deletion as required by law.19.6 Once deletion is completed, recovery of the account, reports, history, or purchased access may not bepossible. Where feasible and permitted, export information you need before deletion.20. YOUR PRIVACY RIGHTS AND CHOICES20.1 Depending on applicable law and ODRISC's role, you may have the right to:receive a clear notice about processing;confirm whether we process your personal data and obtain access or a summary;correct, complete, or update inaccurate or incomplete data;request erasure or deletion;withdraw consent and manage optional device or integration permissions;object to or restrict certain processing;receive data in a portable format where the right applies;obtain meaningful information about relevant automated processing and request human review whererequired;opt out of optional marketing, sale, sharing, or targeted advertising where applicable;nominate another individual to exercise rights in the event of death or incapacity where Indian law providesthat right;raise a grievance and appeal or complain to the competent privacy or data-protection authority; andbe free from unlawful discrimination or retaliation for exercising a right.20.2 Use available account and privacy settings or email support@odrisc.com with the subject "PrivacyRequest". Describe the account and request. Do not send unnecessary health information by ordinary email.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 1320.3 We may verify identity and authority using information proportionate to the risk. An authorisedrepresentative may be required to provide signed or legally valid authority. We will respond within the periodrequired by applicable law and explain any lawful refusal or extension.20.4 For a provider-controlled clinical record, ODRISC may forward the request to or ask you to contact theprovider. A correction may preserve the original clinical entry and add an amendment where record-integrity orprofessional rules require it.20.5 You may complain first to the Privacy and Grievance Contact in Section 28. You may also approach theData Protection Board of India or another competent authority when and as applicable. This does not limit aright to seek urgent relief or use another lawful process.21. CHILDREN AND UNDER-18 DATA21.1 ODRISC consumer accounts are intended for adults aged 18 or older. We do not knowingly allow a child tocreate a direct consumer account or intentionally collect a child's personal data through that account.21.2 If we learn that a child created an account or supplied data without valid authority, we will restrict anddelete it as required, subject to safety, clinical-record, and legal obligations. A parent or guardian may contactsupport@odrisc.com.21.3 A healthcare professional or organisation may process information about a pregnant patient under 18through an authorised clinical account only when it has a valid legal basis, any required verifiable parent orguardian consent, and the safeguards and exceptions permitted by applicable law. The provider is responsiblefor the clinical relationship and required notices.21.4 An unborn baby's measurements form part of the pregnant user's or provider's pregnancy record and donot create a separate child account.22. INTERNATIONAL DATA TRANSFERS22.1 ODRISC is based in India. We and authorised service providers may process information in India and othercountries where we or they operate. Privacy and healthcare laws may differ from those in your location.22.2 Before a cross-border transfer, we assess the purpose, data, recipient, location, and applicablerestrictions. We use safeguards required by law, which may include data-processing agreements,confidentiality and security duties, approved contractual clauses, transfer assessments, access controls,localisation, or consent where appropriate.22.3 We will comply with restrictions or localisation requirements notified under Indian law and applicable rulesfor healthcare, research, government, or other protected data. An organisation agreement may require aspecific hosting region.22.4 Contact support@odrisc.com for information about safeguards relevant to your data, subject to security,confidentiality, and third-party rights.23. SECURITY AND CONFIDENTIALITY23.1 ODRISC uses administrative, technical, contractual, and organisational safeguards designed for thesensitivity of maternal, fetal, and clinical information. These include, as appropriate, encryption in transit andat rest, role-based access, least privilege, authentication controls, logging and monitoring, environmentseparation, secure development and change control, vulnerability and patch management, backups, vendordue diligence, workforce confidentiality, incident response, and periodic review.
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 1423.2 Access is limited to authorised personnel and service providers with a need to perform their role.Healthcare organisations are responsible for their user access, source records, devices, exports, localsystems, and staff conduct.23.3 No system is completely secure. Internet transmission, device compromise, misdirected sharing, weakcredentials, or a third-party failure can create risk. Protect your password and verification codes, use devicesecurity, sign out from shared devices, verify recipients, and notify us promptly of suspected unauthorisedaccess.23.4 Do not send emergency information or unnecessary clinical records through ordinary email. Use thesecure in-app or provider-approved channel when available.24. PERSONAL DATA BREACHES24.1 We maintain processes to identify, contain, investigate, document, remediate, and learn from a suspectedpersonal data breach. Service providers must notify us of relevant incidents and support our response.24.2 When a breach creates a notification obligation, we will notify affected individuals, healthcareorganisations, regulators, app platforms, or others in the manner and time required by applicable law andcontract. A notice may describe the nature and timing, likely consequences, mitigation, protective steps, andcontact details, subject to lawful investigative restrictions.24.3 If you believe information has been accessed, disclosed, lost, or altered without authorisation, contactsupport@odrisc.com promptly. Do not include passwords or unnecessary medical details.25. THIRD-PARTY SERVICES AND LINKS25.1 ODRISC may link to or interoperate with independent clinicians, organisations, devices, laboratories,imaging systems, app stores, websites, and services. A link or integration does not make ODRISC responsiblefor the other party's independent privacy or security practices.25.2 Before directing information to an independent third party, review its privacy notice, security practices,permissions, and terms. You are responsible for confirming the intended recipient when you export or share areport.25.3 Information is protected by this Policy while ODRISC controls it. After you direct it to an independentrecipient, that recipient's notice may also govern.26. ADDITIONAL REGIONAL INFORMATION26.1 India. ODRISC is a data fiduciary for processing it determines and a data processor where it acts onanother data fiduciary's instructions. We apply the Digital Personal Data Protection Act, 2023 and the DigitalPersonal Data Protection Rules, 2025 according to their staged commencement, together with otherapplicable Indian privacy, information-technology, consumer, healthcare, and recordkeeping law.26.2 European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies, health data andcertain pregnancy or reproductive information are special-category data. We rely on an Article 6 legal basisand an applicable Article 9 condition, such as explicit consent, healthcare management, vital interests, publicinterest, or approved research as appropriate. Applicable rights may include access, rectification, erasure,restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority.26.3 United States. HIPAA does not apply to every consumer health app. If ODRISC processes protected healthinformation for a HIPAA-covered healthcare organisation as its business associate, the applicable businessassociate agreement and provider notice govern that processing. For direct-to-consumer information outside
ODRISCPrivacy Policy | Effective 5 September 2026ODRISC TECHNOLOGIES LLP | support@odrisc.comPage 15HIPAA, applicable federal and state consumer-health, breach-notification, and privacy laws may apply. We donot sell consumer health data or use it for targeted advertising.26.4 Other locations. We honour mandatory local rights and protections where the Services are offered. Ajurisdiction-specific notice or healthcare-organisation notice may supplement this Policy. It will identify anymaterially different processing.27. CHANGES TO THIS POLICY27.1 We may update this Policy to reflect changes in the Services, data practices, security, law, regulation,research, or Apple and Google requirements. The current version will show its effective date.27.2 We will provide reasonable notice of a material change through the Services, email, or another appropriatechannel where required. We will request renewed consent before materially different processing when lawrequires it.27.3 We will not retroactively reduce protection or use previously collected health data for a materiallyincompatible purpose without a valid legal basis and required notice or consent.28. CONTACT, PRIVACY REQUESTS, AND GRIEVANCESODRISC TECHNOLOGIES LLPPrivacy and Grievance Contact1st Floor, Building No. 23/25, Flat No. 04Vasil Khan Marg, Surti MohallaMumbai, Maharashtra 400008, IndiaEmail: support@odrisc.comPhone: +91 98206 79567Website: https://www.odrisc.comFor a privacy request, use the subject "Privacy Request". For a security concern, use the subject "SecurityConcern". For account deletion, use the in-app deletion control, the external deletion page linked in theapp-store listing, or the email above.Copyright 2026 ODRISC TECHNOLOGIES LLP. All rights reserved.