Disclaimer: Amara Health does not provide medical advice, diagnosis, or treatment. Information shown in the app is for information and record keeping only and may contain errors. Always consult a qualified doctor or healthcare provider for questions about your health, test results, or medicines. Do not use Amara Health in an emergency. We are currently in beta. If you would like to share feedback, please email us at support@metanovaai.com

Amara Health Logo
LoginSign Up
← Back to home

Privacy Policy

Amara Health (Public Beta) Privacy Policy and DPDP Notice | v1.4 Amara Health by MetaNova AI · amara@metanovaai.com Amara Health (Public Beta) Privacy Policy and DPDP Notice Public Beta | Paid Service | Last Updated: November 5, 2026 | Version: Beta v1.4 www.amarahealth.tech Data Fiduciary / Operator: MetaNova AI Pvt. Ltd. Registered office: Hno.423, Navodaya Colony, Sagar Society, Banjara Hills, Road No. 2, Hyderabad, Telangana, India - 500034 Contact: amara@metanovaai.com | India: +91 96180-89966 | North America: +1 737-983-2213 Plain English summary Amara Health helps users upload, organize, extract, summarize, explain, and track health reports and related health documents during public beta. We use your data only to provide, secure, support, maintain, debug, and legally operate Amara. We do not sell your personal information or health information. We do not use your identifiable health data for advertising, resale, external research, or public/general AI model training unless you give separate explicit written opt-in consent and the use is legally permitted. Amara does not provide medical advice, diagnosis, treatment, prescriptions, emergency support, or clinical decision making. Always verify outputs with original reports and qualified healthcare professionals. 1. Scope and beta notice This Privacy Policy explains how Amara Health collects, uses, stores, protects, shares, transfers, and deletes personal information and health-related information when you use our website, public beta product, applications, dashboards, AI tools, upload tools, family profile features, sharing features, support channels, and related services. We call these the Service in this Policy. Amara Health is operated by MetaNova AI Pvt. Ltd. and its applicable affiliates, representatives, contractors, and service providers. In this Policy, Amara Health, Amara, we, us, and our refer to MetaNova AI Pvt. Ltd. where applicable. The Service is currently a public beta. Beta software may have bugs, interruptions, incomplete features, changing functionality, inaccurate AI outputs, and operational limitations. We are thankful that you are trying Amara during beta. Please send feedback, privacy questions, deletion requests, and safety concerns to amara@metanovaai.com. If Amara enters into a separate business associate agreement, PHIPA service agreement, data processing agreement, hospital pilot agreement, clinic agreement, enterprise agreement, or other written contract, that contract may add or override privacy, security, retention, and processing obligations for that relationship only. 2. Important medical and AI notice Amara Health is not a doctor, clinic, hospital, diagnostic provider, emergency service, pharmacy, insurer, or medical device unless expressly stated in writing after required regulatory clearance or approval. Amara does not diagnose, treat, cure, prevent, or manage any disease or medical condition. Amara does not provide medical advice, clinical advice, treatment recommendations, prescriptions, medication instructions, emergency advice, or decisions that replace a licensed healthcare professional. AI outputs, OCR, extraction, translations, summaries, trends, flags, charts, medicine explanations, and plain-language explanations may be inaccurate, incomplete, outdated, mistranslated, misread, misclassified, or misleading. Lab reference ranges vary by lab, country, age, sex, pregnancy status, clinical condition, and medical context. You must verify all outputs against the original source document and consult a qualified doctor, pharmacist, lab, hospital, clinic, or other licensed healthcare professional before making any medical, medication, treatment, lifestyle, insurance, employment, or health-related decision. Do not use Amara in an emergency. In an emergency, call 911 in the United States or Canada, 112 or 108 in India where available, or your local emergency number immediately. 3. Regional compliance position We are designing and operating Amara with privacy and health-data sensitivity in mind, including preparation for India DPDP obligations, Canadian privacy obligations, United States consumer health-data obligations, and provider-specific health privacy frameworks where applicable. This does not mean Amara is certified under every law, and we do not make unsupported compliance claims. 3.1 India For India users, MetaNova AI Pvt. Ltd. is the Data Fiduciary for the personal data it determines how and why to process. This Policy is also intended to serve as a DPDP notice for the public beta. Health data is treated by us as highly sensitive in practice, even where a specific law does not use the term sensitive personal data in the same way as older privacy frameworks. We process personal data for the purposes listed in this Policy, including creating accounts, storing uploaded reports, extracting and organizing data, generating summaries and trends, providing user-selected sharing, securing the Service, supporting users, fixing bugs, improving stability and extraction reliability during beta, and complying with law. 3.2 Canada For Canada, Amara is intended to align with principles under PIPEDA and applicable substantially similar provincial privacy laws where relevant, including consent, limited collection, limited use, safeguards, openness, access, correction, breach handling, and accountability. For Ontario, PHIPA may apply depending on the role Amara plays. In direct-to-consumer use, Amara may not be a health information custodian. If Amara provides services to an Ontario health information custodian, clinic, hospital, physician, or other regulated organization, Amara may act as an agent, electronic service provider, or service provider depending on the final facts and written agreement. In that case, a separate PHIPA-aligned agreement must be signed before production use. Amara is working toward PHIPA-aligned safeguards and contracting practices where applicable. We do not claim that Amara is fully PHIPA compliant for every use case unless confirmed in a signed agreement and after legal and technical review. For Quebec residents, we apply the Act respecting the protection of personal information in the private sector as amended by Law 25, including transparency about processing of personal information outside Quebec. Our designated Privacy Officer (responsable de la protection des renseignements personnels) is Sharath Bhavaraju, reachable at amara@metanovaai.com. 3.3 United States For the United States, HIPAA generally applies to covered entities and business associates. Amara is not currently a healthcare provider, health plan, healthcare clearinghouse, or emergency service merely because an individual user uploads personal records. Direct-to-consumer data may not be HIPAA protected health information unless Amara is acting for a HIPAA covered entity or business associate under a written business associate agreement. If Amara signs a business associate agreement with a HIPAA covered entity or business associate, Amara will process protected health information under that agreement and HIPAA-related safeguards for that relationship. Until then, Amara should be described as HIPAA-aligned or preparing for HIPAA business associate readiness, not as fully HIPAA compliant or HIPAA certified. For direct-to-consumer health apps in the United States, the FTC Health Breach Notification Rule, consumer protection laws, state privacy laws (such as the California Consumer Privacy Act as amended), and state consumer health data laws (such as the Washington My Health My Data Act, Nevada SB 370, and Connecticut's consumer health data provisions) may apply depending on user location, data flows, business model, size thresholds, and integrations. Amara will assess and comply with applicable notice, consent, and breach notification obligations. Where state consumer health data laws apply: we collect and share consumer health data only with consent or as necessary to provide the Service you request; we do not sell consumer health data and will not do so without the valid written authorization those laws require; and this Policy serves as our Consumer Health Data Privacy Notice. Washington residents may appeal a refusal of a rights request by replying to our decision email, and if the appeal is denied, may contact the Washington Attorney General. Where the California Consumer Privacy Act applies, you have rights to know, access, correct, delete, and opt out of sale or sharing. We do not sell personal information. If you choose "Accept" in our cookie banner, the Google Ads tag and Meta Pixel on our public website and checkout page (Section 20) receive device and browsing information, such as cookie identifiers, pages visited and, when you subscribe, the amount paid, which may count as "sharing" for cross-context behavioral advertising under California law. No health data, name, email address or phone number is ever shared this way. You can opt out at any time by choosing "Decline" under "Cookie preferences" in the website footer, and we honor legally recognized opt-out preference signals where required. We will not discriminate against you for exercising any privacy right. 4. Personal data we collect We collect only the personal data reasonably needed to provide, secure, support, maintain, improve reliability of, and legally operate the Service. Depending on how you use Amara, we may collect the following categories: • Account data: name, phone number, email address, login method, OTP events, authentication metadata, country or region, language preference, account settings, communication preferences, and consent records. • Uploaded health documents: medical reports, lab reports, diagnostic reports, prescriptions, discharge summaries, medication information, images, PDFs, screenshots, camera photos, and related health documents that you choose to upload. • Extracted health information: test names, values, units, reference ranges, report dates, abnormal markers, medicine names, dosage text from uploaded documents, trend data, and structured information derived from your documents. • AI-generated information: summaries, explanations, translations, charts, flags, user questions, AI responses, report comparisons, trend descriptions, and other outputs generated from your data or prompts. • Family and caregiver profile data: information you enter or upload for a child, parent, spouse, dependent, family member, caregiver, or other person whose profile you manage. • Sharing data: share links, invited recipients, access settings, expiry settings, revocation records, access logs, and information about doctors, caregivers, family members, or organizations you choose to share with. • Usage, device, and technical data: IP address, approximate location from IP, device identifiers, browser type, device type, operating system, app events, timestamps, session logs, crash logs, diagnostic logs, performance logs, security logs, and fraud-prevention logs. • Support data: emails, messages, attachments, screenshots, call notes, feedback, bug reports, and other information you send to support or beta feedback channels. • Payment data: when you buy a subscription, payment status, plan, coupon applied, invoice details, billing contact information, and limited payment identifiers from payment processors. We do not intentionally store full credit card numbers on Amara servers. • Cookies and similar technologies: essential cookies, session storage, authentication tokens, security tools, and limited analytics needed to operate, secure, debug, and improve reliability of the Service. We do not require Aadhaar, PAN, Social Insurance Number, Social Security Number, or other government identity numbers for ordinary public beta use. Do not upload these unless specifically required by a future feature and clearly requested by Amara. 5. Where data comes from • You, when you create an account, upload reports, ask questions, create profiles, configure settings, contact support, or use sharing features. • People you authorize, such as a caregiver, parent, spouse, family member, or invited recipient who interacts with your profile or shared record. • Healthcare providers, clinics, hospitals, or organizations only where you authorize the connection or where a separate written agreement and lawful basis apply. • Service providers, systems, devices, logs, and security tools that help us operate, authenticate, secure, debug, and support the Service. 6. Why we use data We use personal data and health data only for limited and disclosed purposes, including: • Provide the Service: create and maintain accounts, upload and store reports, extract data from documents, organize health records, show summaries, generate trend charts, enable search, enable family profiles, and enable user-controlled sharing. • Generate user-requested AI outputs: answer questions about uploaded reports, explain health parameters in plain language, compare current and prior reports, translate information, and summarize information for user review. • Support users and beta testers: respond to support requests, deletion requests, privacy requests, feedback, bug reports, and safety concerns. • Maintain safety and security: authenticate users, detect unauthorized access, prevent fraud and abuse, protect accounts, investigate suspicious activity, and maintain audit logs. • Improve reliability during beta: fix bugs, troubleshoot crashes, improve uptime, test stability, measure system errors, improve extraction reliability, and improve product quality without using identifiable health data for advertising or resale. • Comply with law and enforce rights: respond to lawful requests, comply with applicable legal obligations, enforce Terms, investigate violations, defend claims, and protect users, Amara, and the public. 7. Consent, authority, and lawful basis By creating an account, clicking consent checkboxes, uploading a report, creating a family profile, or using a feature that requests health information, you provide clear affirmative consent for Amara to process the personal data and health data needed for the purposes described in this Policy. If you upload health documents, you confirm that you have the legal right, consent, guardianship, power of attorney, caregiving authority, or other lawful authority to upload and process that information through Amara. You may withdraw consent by deleting the relevant report, turning off a feature where available, revoking a share link, deleting your account, or emailing amara@metanovaai.com. Withdrawal does not affect processing already completed before withdrawal. Some features may stop working if consent is withdrawn. Where applicable law permits processing without consent for limited purposes, such as security, fraud prevention, legal compliance, dispute handling, or protecting rights and safety, we may rely on those legal grounds only to the extent permitted by law. 8. Family profiles, caregivers, and minors Amara may allow family or caregiver profiles. If you upload data for another person, you are responsible for having valid authority and for using that person's information lawfully and respectfully. Children and minors may not create or use Amara directly unless permitted by applicable law and with verified parent or legal guardian consent. If you create a child profile, you confirm that you are the parent or legal guardian and that you will complete reasonable verification steps, such as OTP verification and a guardian declaration. We may suspend or delete child profiles if authority cannot be reasonably established. We do not knowingly use children's health data for targeted advertising, behavioral advertising, profiling for advertising, or sale. We do not knowingly process children's information in a way that is detrimental to their well-being. 9. What we do not do with your data • We do not sell, rent, broker, or trade your personal information, uploaded health documents, extracted health data, AI questions, AI answers, or family profile health information. • We do not use identifiable health data for advertising, targeted advertising, marketing profiling, resale, or data-broker activity. • We do not use your health information to market third-party products or services to you. • We do not provide your identifiable health data to employers, insurers, pharmaceutical companies, advertisers, data brokers, or external researchers unless you specifically direct us to do so or applicable law requires it. • We do not use identifiable uploaded reports, extracted health data, medicine data, symptoms, AI questions, AI answers, or family profile information to train public or general AI models unless you give separate explicit written opt-in consent and the use is legally permitted. • We do not place third-party advertising pixels or behavioral marketing trackers inside authenticated health-report pages unless a future version obtains any legally required consent and updates this Policy first. 10. AI processing and product improvement Amara may use AI, OCR, language models, extraction tools, translation tools, and related software to process documents and generate outputs requested by users. These tools may be operated by Amara or by trusted service providers acting under contractual restrictions. No identifiable training by default: We do not use identifiable personal data, identifiable health reports, extracted identifiable lab values, medicine information, family profile information, or identifiable AI chats to train public or general AI models unless you provide explicit, separate, optional opt-in consent in the app or in writing and the processing is legally permitted. Anonymized and aggregated improvement: We may use irreversibly anonymized data, aggregated data, error metrics, crash patterns, extraction-quality metrics, and operational analytics that cannot reasonably identify you to improve extraction accuracy, product reliability, safety, and user experience. We will not attempt to re-identify anonymized data. Service providers that process AI requests for Amara must process the data only as necessary to provide services to Amara, unless we disclose otherwise and obtain any required consent. We will work to configure AI vendors so that user health data is not used by the vendor to train public models where such controls are available and contractually supported. Where AI processing runs today: report text, extracted values, and the questions you ask are sent to Google Vertex AI (Gemini models). In the India deployment, report extraction (reading and structuring your uploaded reports and classifying report images with Gemini) is processed in Google's Mumbai region (asia-south1), the same region where your data is stored; conversational answers to the questions you ask are processed at Google's global endpoint, which routes the request to Google infrastructure that may be outside that region (see Section 13). In the Canada and United States deployments, all Gemini processing uses Google's global endpoint. Scanned pages are read by Google Cloud Vision OCR: the United States deployment uses Google's US endpoint; the India and Canada deployments use the global endpoint because Cloud Vision offers no endpoint in those regions. Voice input uses Google Speech-to-Text at the endpoint for the deployment's region. Text-to-speech in the India and Canada deployments runs in your browser, so the text never leaves your device. Under Google Cloud's Vertex AI and Cloud AI data-governance terms, Google does not use your content to train its models; any short-term caching Google performs for abuse monitoring is governed by those terms. 11. Sharing and disclosures We share personal data only in limited circumstances: • With service providers and processors: trusted cloud hosting, storage, authentication, OTP or email delivery, security, monitoring, crash reporting, support tooling, AI infrastructure, analytics for reliability, and payment processing providers, only as needed to operate the Service and under confidentiality and security obligations. • With advertising measurement partners, only if you accept them in the cookie banner: Google and Meta receive device and browsing information from our public website and checkout page, never health data, as described in Section 20. • With recipients you choose: doctors, caregivers, family members, clinics, hospitals, or other people or organizations you choose to share with through the Service. You are responsible for selecting recipients and revoking access where appropriate. • With healthcare organizations under separate agreement: if you use Amara through a clinic, hospital, doctor, employer-sponsored benefit, insurer, research program, or other organization, additional terms and privacy notices may apply. We will not use this route for production healthcare workflows without appropriate agreements. • For legal and safety reasons: when required by law, court order, valid government direction, regulator request, legal process, security investigation, fraud prevention, or to protect rights, safety, users, Amara, or the public. • During business changes: in connection with a merger, acquisition, financing, restructuring, transfer of assets, or similar transaction, subject to confidentiality, applicable law, and protection of user data. • With your direction or consent: for any other purpose you specifically request or consent to. We do not treat user feedback as permission to disclose personal health information. If we use beta feedback to improve the product, we will avoid exposing personal health information in public materials or unrelated internal channels. 12. Sharing links and user-directed sharing If you generate or send a share link, invite a recipient, export a summary, download a file, or otherwise share information from Amara, you control that action. Recipients may copy, download, forward, screenshot, or further disclose information after they receive it. Amara cannot fully control what recipients do outside the Service. Use sharing features carefully. Check recipient identity, expiry settings, access settings, and revocation options before sending health information. 13. Where your data is stored and processed Your account data, uploaded reports, extracted values, sharing grants, consent records, and audit logs are stored in Google Cloud Firestore and Cloud Storage. Each Amara deployment stores them in one Google Cloud region. You are served by the public beta in the United States unless you signed up on one of the regional deployments: • Public beta (amarahealth.tech): United States. • India deployment (in.amarahealth.tech): asia-south1 (Mumbai, India). Until DNS is pointed at it, this deployment is also reached directly at its Cloud Run address. • Canada deployment (ca.amarahealth.tech): northamerica-northeast1 (Montréal, Canada). • United States deployment (us.amarahealth.tech): us-central1 (Iowa, United States). In the India deployment, Gemini report extraction runs in the Mumbai region listed above; conversational answers in the India deployment, and all Gemini processing in the Canada and United States deployments, use Google's global Vertex AI endpoint and may therefore run outside the region above. Every stored copy of your data remains in the region listed; the AI request itself is not kept by Amara anywhere else. Privacy laws in these locations may differ from the laws in your country or province/state. For India users, we will process or transfer personal data outside India only as permitted by applicable Indian law; if the Government of India notifies restrictions on transfers to specific countries or territories, we will comply and adjust transfers where required. For Canada users, personal information may be accessed from India or the United States for processing and support, and may be subject to lawful access requests in those jurisdictions. For United States users, personal information may be accessed from India for support as needed to provide and secure the Service. 14. Security We use reasonable administrative, technical, and organizational safeguards appropriate for a beta health-data product. These may include encryption in transit, encryption at rest where supported, authentication controls, restricted internal access, role-based access, secure cloud infrastructure, monitoring, logging, vendor controls, incident response practices, and security reviews. Only authorized personnel and service providers should access personal data when needed for service operations, support, security, legal compliance, incident response, or debugging. We work to limit internal access to health data. No system is perfectly secure. Beta systems may carry higher operational risk than mature products. We cannot guarantee that unauthorized access, data loss, bugs, outages, or security incidents will never occur. You should keep your own copies of medical records outside Amara. 15. Data retention and deletion You can delete individual reports or your whole account in-app, or by emailing amara@metanovaai.com. For account safety, we may verify your identity before processing an emailed deletion request. The periods below are the ones our systems enforce today: • Reports you delete, and everything deleted with your account (reports, weight entries, doctor-access grants, consent records, private profile data, and uploaded files), are removed from the live database and file storage immediately when the request runs, not queued for a later purge. • Uploads our classifier finds are not a health report are deleted automatically 8 hours after upload. Uploads that fail processing are deleted automatically 10 hours after upload. Both run hourly. • Temporary OCR output created while reading a scanned PDF is deleted as soon as extraction finishes. • Doctor access you grant ends at the expiry you chose (24 hours, 7 days, or until revoked); expired grants are enforced by our access rules and swept hourly. • Audit-log entries about your account (sharing grants and revocations, doctor AI access, exports, deletions) are kept for 180 days and then pruned daily. They are not deleted with your account; the entry recording the deletion itself is kept for the same 180 days. • Records of any personal-data breach are kept for at least 24 months (the Canadian PIPEDA minimum) and pruned after. • Rate-limit counters are keyed by your account ID or IP address and hold only a count and a timestamp for the duration of the limit window. • Partner enquiries submitted through the landing-page form (name, organisation, phone, email, message, and a one-way hash of the sending IP address for abuse prevention) are kept until you ask us to delete them. • Support communications, consent logs, deletion request records, and legal records may be retained longer where needed for lawful purposes. • Anonymized or aggregated data that cannot reasonably identify you may be retained longer because it is not treated as personal data under many privacy laws. • If you received Amara through a doctor, clinic, hospital, or organization, deletion may also be subject to that organization's legal retention duties and written agreement with Amara. Where a deployment has database point-in-time recovery enabled, deleted data can persist in that recovery window for up to 7 days before it expires; we do not use it to restore individual deleted accounts. Deletion may make reports, trends, summaries, AI outputs, family profiles, share links, and account history unavailable permanently. Keep copies of important medical records outside Amara. 16. Your rights and requests Depending on where you live and how you use the Service, you may have rights to access, correct, update, delete, export, withdraw consent, restrict certain processing, request information about processing, nominate a person to exercise rights after death or incapacity where applicable, and complain to a privacy authority or data protection board. To exercise rights, email amara@metanovaai.com. Include the email or phone number linked to your account and the request type. We may ask for verification before fulfilling a request. We aim to process verified requests within 30 days unless a different timeline is required or permitted by law. We may decline or limit a request where permitted by law, including where we cannot verify identity, the request is fraudulent or excessive, the data belongs to another person, disclosure would reveal another person's information, retention is legally required, or retention is necessary for security, fraud prevention, dispute resolution, or legal compliance. 17. Canada rights and breach notices For Canada users, we aim to provide meaningful notice and consent for collection, use, and disclosure of personal information. Health information is sensitive, so express consent should generally be obtained for health-data processing unless another legal basis applies. If a breach of security safeguards involving personal information under Amara's control creates a real risk of significant harm, we will take steps required by applicable Canadian law, which may include notifying affected individuals, notifying the Office of the Privacy Commissioner of Canada or applicable provincial regulator, keeping breach records, and notifying organizations or government institutions that may reduce risk. 18. United States rights and breach notices For United States users, state privacy laws, state consumer health data laws, unfair or deceptive practices laws, and the FTC Health Breach Notification Rule may apply depending on the user location, data involved, product design, integrations, and business thresholds. We will assess and comply with applicable obligations. If the FTC Health Breach Notification Rule applies to a breach involving unsecured personal health record identifiable health information, Amara will notify affected users without unreasonable delay and no later than 60 calendar days after discovery, notify the FTC as required (including without unreasonable delay where 500 or more individuals are affected), and notify prominent media outlets where the Rule requires it. If HIPAA applies under a signed business associate agreement, HIPAA breach obligations will be handled under that agreement and applicable law. 19. India rights, grievance, and incident handling For India users, you may request access to information about your personal data, correction, completion, updating, deletion, withdrawal of consent, grievance redressal, and nomination where applicable. You may also complain to the Data Protection Board of India in the manner prescribed by law. If we detect a personal data breach, we will take reasonable steps to contain, assess, and remediate it, and we will notify affected users and the Data Protection Board of India within the timelines required by the DPDP Act, 2023 and the DPDP Rules, 2025. We also maintain an incident response process to assess and handle cybersecurity incidents, including reporting to CERT-In and other relevant authorities where required. If MetaNova is notified as a Significant Data Fiduciary under the DPDP Act based on the volume and sensitivity of data processed, we will meet the additional obligations that apply, including appointing a Data Protection Officer based in India, conducting periodic Data Protection Impact Assessments, and undergoing independent data audits. Grievance Officer / Data Protection Contact for India: Sharath Bhavaraju, MetaNova AI Pvt. Ltd. Email: sharath@metanovaai.com. Phone: +91 96180-89966. Address: Hno.423, Navodaya Colony, Sagar Society, Banjara Hills, Road No. 2, Hyderabad, Telangana, India - 500034. We aim to acknowledge privacy grievances within 72 hours and resolve them within 30 days, subject to verification and applicable law. 20. Cookies, analytics, and tracking We use essential cookies and browser storage for login, authentication, security, session management, preferences, fraud prevention, diagnostics, and Service reliability. We use limited operational logging to understand errors, crashes, and performance during beta. Advertising measurement tags (Google Ads and Meta Pixel): our public website pages and our plan-selection and checkout page can load a Google Ads tag (gtag.js) and the Meta Pixel, which measure whether visitors arriving from our advertisements go on to create an account or buy a subscription. They load only after you choose "Accept" in the cookie banner; choosing "Decline", or making no choice, means they are never loaded and set no cookie. Your choice is stored in your browser and can be changed at any time using "Cookie preferences" in the website footer. When a subscription is bought, they receive only the amount paid, the currency and a payment reference. They are never loaded on pages that show your health reports or other health data, automatic page scanning and advanced matching are turned off, and no health data, name, email address or phone number is sent to them. We do not use health data for advertising or targeted advertising, and we do not place third-party advertising pixels, retargeting tags, or behavioral marketing trackers on authenticated health-report pages. 21. Communications We may contact you by email, SMS, phone, in-app notification, or other contact details you provide for account verification, OTP, security alerts, legal notices, support responses, deletion confirmation, product changes, beta feedback, and service-related communications. We do not use health data for marketing. If future marketing communications are introduced, you may opt out as required by law. Service, security, legal, and transactional messages may still be sent. 22. Doctor, clinic, hospital, and provider usage Amara may offer features for doctors, clinics, hospitals, care teams, and enterprise healthcare organizations. Production provider workflows should be governed by separate written agreements that define roles, permitted uses, security obligations, retention, audit rights, incident handling, and applicable HIPAA, PHIPA, PIPEDA, DPDP, and other compliance obligations. No provider should use Amara as the sole clinical record, sole diagnostic tool, sole medication decision tool, or sole basis for patient care unless a separate written agreement, regulatory assessment, clinical validation, and legal review expressly authorize that use. 23. Changes to this Policy We may update this Policy as the Service, business model, laws, or beta program changes. Material changes will be communicated through the website, app, email, SMS, or in-product notice where appropriate. We may request renewed acceptance or consent where legally required. The Last updated date at the top shows when this Policy was last changed. Continued use after a change means you accept the updated Policy where permitted by law. 24. Contact us General privacy and support contact: amara@metanovaai.com India phone: +91 96180-89966 North America phone: +1 737-983-2213 Registered office: Hno.423, Navodaya Colony, Sagar Society, Banjara Hills, Road No. 2, Hyderabad, Telangana, India - 500034 India Grievance Officer / Data Protection Contact: Sharath Bhavaraju, sharath@metanovaai.com, +91 96180-89966