Privacy Policy

1. About this policy

Urjio collects health data only to coach you, never sells it, and never shares your individual health data with your employer. This policy explains what we collect, why, who sees it, and how you stay in control.

Urjio is operated by Urjio Health Innovations Private Limited (“Urjio”, “we”, “us”), a company incorporated under the Companies Act, 2013, with its registered office in Thane, Maharashtra, India. Under Indian law we are the Data Fiduciary for your personal data, and you are the Data Principal.

This policy applies to the Urjio mobile app, website and related services (the “Services”). It is published under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (together, “DPDP law”), and the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

This policy is currently available in English.

Key terms

Personal data: Any data about you from which you can be identified
Health data: Data about your physical or mental health, including reports, conditions, medications and wearable readings. It is sensitive personal data under the SPDI Rules
Data Fiduciary: Urjio, which decides why and how your data is processed
Data Principal: You, the person the data is about
Data Processor: A vendor that processes data for Urjio under a written contract
Consent: Your free, specific, informed and unambiguous agreement, given by a clear action such as ticking a box
AI insights: Trends, summaries and habit suggestions generated by Urjio’s AI from your data

2. Personal data we collect

We collect only what we need to coach you. Items marked Sensitive are health or sensitive personal data under the SPDI Rules, and we handle them with extra care.

Account and contact: Name, mobile number, email, OTP verification details, preferred language (English or Hindi) (How we get it: you, at sign-up and in Profile)
Basic profile: Age or date of birth, gender, city, height, weight, profile photo (optional) (How we get it: you)
Health profile (Sensitive): Existing conditions, medications, family history, goals, diet type (e.g. vegetarian, eggetarian, Jain), sleep, activity, smoking and alcohol habits, and stress or mood if you choose to share them (How we get it: you, in onboarding and chat)
Diagnostic reports (Sensitive): Lab report PDFs and photos you upload, and the values we extract from them (e.g. HbA1c, lipid profile, Vitamin D, B12, TSH), with report dates (How we get it: you upload them)
Coaching activity: Habits in your Plan, check-ins, streaks, and your conversations with the AI coach (How we get it: created as you use Urjio)
Coach call-backs: Your call-back request, phone number, preferred time and language, and the coach’s notes; and the call recording, if a call is recorded (we tell you at the start of the call) (How we get it: you and our coaches)
Wearable data (Sensitive, only if you connect): Steps, heart rate, resting heart rate, HRV, sleep stages, workouts, SpO2 and similar data (How we get it: the connected app, only with your permission)
Support and feedback: Messages, emails and tickets you send us, survey answers and ratings (How we get it: you)
Device and usage: Device model, OS, app version, IP address, approximate city, crash logs, screens used, notification tokens (How we get it: collected automatically)

We do not collect Aadhaar numbers, and we do not need your exact location.

Health apps and wearables (when available)

If you connect Google Health Connect, Apple Health or a wearable, Urjio reads only the data types you approve on your device. We use them only to show your trends and personalise your coaching, never for advertising, and we do not sell them. You can revoke access anytime in your phone’s Health Connect or Health settings. Disconnecting stops new syncing; data already imported stays until you delete it or your account.

3. Why we use your data, and your consent

We process your personal data on the basis of your consent, which you give in the app before we collect it, and which you can withdraw at any time by deleting your data or account in the app, or by writing to us (section 11). Coach call-backs and wearable syncing are used only if you choose them.

Create and secure your account: Account and contact, device (Needed to use Urjio: yes)
Read your reports and track your markers over time: Diagnostic reports, health profile (Needed to use Urjio: yes, for core coaching)
Personalised AI coaching and habit plans: Health profile, reports, coaching activity (Needed to use Urjio: yes, for core coaching)
Arrange a call-back from a human coach: Contact, call-back details, relevant health data (Needed to use Urjio: only if you request a call)
Use wearable data in your coaching: Wearable data (Needed to use Urjio: only if you connect a device)

We may also process data without consent where Indian law allows it, such as to comply with a law, a court order, or a request from a government agency, or to respond to a medical emergency involving a threat to your life or health.

We never sell your personal data, and we never use your health data for advertising.

4. How the AI coach uses your data

Urjio’s AI reads your reports and profile to spot trends and suggest habits; it does not diagnose, prescribe or replace your doctor.

What it does. It extracts values from your reports, compares them across dates (for example, how your HbA1c moved between two tests), and suggests everyday habits that fit your routine and diet.
What it does not do. It does not make decisions that produce legal or similarly significant effects for you, such as insurance or employment decisions. Urjio is a wellness coaching service, not a medical device or a telemedicine service.
Model providers. To generate responses, we send the minimum data needed to trusted AI model providers acting on our instructions, some of which may process data outside India (see section 6). Our contracts with them prohibit using your data to train their models. They may keep it only for a short period, at most 90 days, for security and abuse monitoring, and then delete it.
Errors. AI can misread a report or get things wrong. Check important values against the original report, and talk to a doctor before changing medication or treatment.
Human coaches. When you request a call-back, a trained Urjio coach can see the health data needed to help you. Coaches are bound by confidentiality obligations.

No medical advice, no doctor-patient relationship

Everything in Urjio, including AI insights and coach conversations, is for wellness and preventive awareness only. It is not a diagnosis, treatment or prescription. Using Urjio does not create a doctor-patient relationship with Urjio or its coaches. Urjio coaches are wellness coaches, not Registered Medical Practitioners. Under India’s Telemedicine Practice Guidelines, 2020, AI tools cannot counsel patients or prescribe medicines, and Urjio does neither. If you have a health concern, consult a qualified doctor, and never delay or ignore medical advice because of something you read in Urjio.

Your part

AI insights are only as good as the data behind them. Please keep your profile, medications and reports accurate and up to date. Urjio is not responsible for insights that are wrong because the information provided was wrong or incomplete.

5. Who we share your data with

We share personal data only with the parties below, only for the purposes in this policy, and never for sale.

Service providers (Data Processors): cloud hosting, AI model providers, SMS/OTP, email, push notifications, analytics, crash reporting: To run the Services on our behalf, under written contracts that bind them to our instructions and to security safeguards (What they get: only what each task needs)
Urjio coaches: To handle the call-backs you request (What they get: contact details and relevant health data)
Your employer (if you joined through a workplace programme): To report programme uptake (What they get: aggregated, de-identified statistics only (for example, “120 employees joined; 40% improved a habit streak”). Never your reports, conditions or chats)
Your doctor or family member: Only when you choose to share a report or summary from the app (What they get: what you choose to share)
Government, courts, law enforcement: When required by Indian law or a lawful order (What they get: what the order requires)
A buyer or successor: If Urjio merges, is acquired or sells assets, under the same protections (What they get: data needed to continue the Services; we will notify you)

Insurers and advertisers do not receive your personal data.

When we must disclose data to an authority, we will tell you where the law allows us to. We may also share fully anonymised, aggregated data that cannot identify anyone, for example for research or public health reporting.

Cookies and analytics. Our website uses only cookies needed for it to work, unless you agree to analytics cookies in the cookie banner. In the app, analytics and crash-reporting tools see usage and device data, not your reports or health profile.

6. Where your data is stored, and how we protect it

Your data is stored on servers in India. Some service providers, such as AI model providers, may process limited data outside India. We transfer data abroad only to countries the Government of India has not restricted, and only under contracts with safeguards equal to this policy.

We use reasonable security practices in line with the SPDI Rules and the DPDP Rules, including:

Encryption in transit (TLS 1.2 or higher) and at rest
Role-based access, so staff and coaches see only what their job needs
Logging and monitoring of access to personal data
Pseudonymised or dummy data in development and testing, never real health data
Regular backups, secure coding practices and code reviews
Data-protection training for everyone who handles personal data
Confidentiality and data-protection terms in every staff and vendor contract
A written information security policy and incident response plan, reviewed annually

No system is perfectly secure. Keep your phone locked and your OTPs private.

7. How long we keep your data

We keep your data while your account is active and erase it when you delete your account or withdraw consent, unless a law requires us to keep it longer.

Profile, reports, coaching history: Until you delete them or your account; erased within 30 days after
Data for a withdrawn consent: Erased within 30 days, unless needed for another purpose you still consent to
Wearable data: While the integration is useful to you; disconnecting stops syncing, and imported data is erased when you delete it or your account
Coach call notes and recordings: 12 months after the call
Support messages and feedback: 2 years after your issue is resolved
Records of your consents: As long as the processing lasts, plus 3 years, to prove we had your consent
Access logs and processing records: At least 1 year, as the DPDP Rules require
De-identified, aggregated data: May be kept, since it no longer identifies you

If your account is inactive for 3 years, we will tell you at least 48 hours before erasing your data, so you can log in to keep it.

Deleting your account permanently removes your reports, trends and coaching history, and we cannot restore them. Erased data is removed from active systems and securely destroyed; copies in backups are overwritten within 30 days.

8. Your rights

You can delete your data or your account yourself in the app. For any other right, write to our Grievance Officer (section 11). We may verify your identity first, and we will not charge you.

Access: Get a summary of the personal data we hold, what we do with it, and who we have shared it with
Correction and updating: Fix inaccurate or incomplete data, such as a wrongly read report value
Erasure: Delete specific data, a report, or your whole account
Withdraw consent: Withdraw at any time by deleting your data or account in the app, or by emailing support@urjio.com to stop a specific purpose. Past processing stays lawful; withdrawing consent for core coaching means we can no longer coach you
Nominate: Name a person to exercise your rights if you die or become unable to
Grievance redressal: Complain to us, and if unsatisfied, to the Data Protection Board of India

You also have a duty under DPDP law to give accurate information and not to file false complaints.

9. Children

Urjio is for adults aged 18 and above. Under DPDP law anyone under 18 is a child, and processing their data requires verifiable consent from a parent or lawful guardian. We do not knowingly collect data from children, and we never track children’s behaviour or target ads at them. If we learn that a child has signed up without that consent, we will deactivate the account and erase its data. If you believe this has happened, write to the Grievance Officer.

10. If there is a data breach

If a breach affects your personal data, we will tell you without delay through the app, SMS and your registered email. We will explain what happened, what data was involved, its likely impact on you, what we are doing about it, and steps you can take. We report cyber security incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions, 2022 require, and inform the Data Protection Board of India within the timelines in the DPDP Rules. We keep an internal record of every breach, including minor ones.

To report a suspected breach or security weakness, write to support@urjio.com.

11. Grievance Officer and complaints

For any question, request or complaint about your data, contact our Grievance Officer, who also serves as our contact for data protection:

Name: Ajinkya Deshmukh, Co-founder & CEO
Email: support@urjio.com
Post: Urjio Health Innovations Private Limited, Flat No 302, Skyline Apartment, PN 227 Shivganganagar, Ambernath, Kalyan, Thane 421501, Maharashtra

We will acknowledge your request within 48 hours and resolve it within 30 days, and never later than the 90 days DPDP law allows. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

12. Changes to this policy

We will update this policy when our practices or the law change. For material changes, such as a new purpose or a new category of recipient, we will notify you in the app and by email at least 15 days before they take effect, and ask for fresh consent where required. If you disagree, you can delete your account before the changes take effect. The effective date at the top shows the latest version, and earlier versions are available on request.

13. Governing law

This policy is governed by the laws of India. Courts in Mumbai, Maharashtra have exclusive jurisdiction, without affecting your right to approach the Data Protection Board of India or any other regulator. The laws that apply to how we handle your data include:

Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
Information Technology Act, 2000 and the SPDI Rules, 2011
CERT-In Directions, 2022
Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020
Telemedicine Practice Guidelines, 2020, where a doctor consultation is offered through Urjio