Privacy Policy

1. Who we are

Zarur Technologies Private Limited ("Zarur", "we", "us") runs Zarur (https://zarur.in), an AI voice and WhatsApp receptionist for hospitals.

We play different roles under the DPDP Act, depending on whose data it is:

Data processing agreement: each hospital accepts our DPA online. A person authorised by the hospital accepts it either with an email and one-time code (OTP) or by ticking a checkbox, and we keep a record of the acceptance. The DPA lists our sub-processors by name and includes the hospital's agreement that Zarur may use anonymised data to improve the service (Section 3.1).

If you contacted a hospital: that hospital is responsible for your data. Please send requests about your appointment, call or chat to the hospital first. You may also write to us (Section 13), and we will pass your request to the hospital and help it respond.

2. What data we collect

2.1 Website visitors and enquiries (Zarur is the Data Fiduciary)

• - What you send us: your name, hospital name, role, phone number, email address and message, when you contact us by email or WhatsApp or ask for a demo or trial.
• - Technical data: our website does not use analytics or tracking scripts. It loads no third-party resources or trackers, and its fonts are hosted on our own servers. Like most websites, our hosting providers may process your IP address and basic request details to deliver the site and protect it from abuse.

2.2 Live voice demo (Zarur is the Data Fiduciary)

If you try the live demo on our website, your microphone audio is processed while the demo runs, so the AI can understand you and reply. The demo starts only after you click to start it and allow microphone access in your browser. Demo audio is stored for 12 months so we can check quality, fix problems and prevent abuse, and is then deleted.

Please do not share real health information or anyone else's personal information during the demo.

2.3 Hospital staff accounts

• - Account details: name, username, phone number, role (admin, receptionist, nurse, doctor, pharmacy or auditor), account status, last login and account creation date. Passwords are stored only in hashed form.
• - Login sessions: IP address, device, and browser (user agent).
• - Audit log entries (see Section 8).
• - Billing: plan, call usage, balance and billing records.
• - DPA acceptance record: who accepted the DPA, when they accepted it, and how (email OTP or checkbox).

2.4 Hospital, patient and caller data (processed for hospitals)

• - Patients: name, phone number, age, gender and address.
• - Appointments: doctor, date, token number, time, fee, status, source (for example, phone or WhatsApp), and cancellation reason. We do not store symptoms or medical notes.
• - Doctors: name, department, schedules, fee, registration number, and images of the doctor's signature and seal.
• - Phone calls: call recordings (audio), call transcripts, the caller's phone number, and call details such as time, duration and line. Conversation text is also written to our server logs for troubleshooting (see Section 7).
• - WhatsApp: message content and conversation state.
• - Anything else the caller chooses to say. This may include health information, even though Zarur does not ask for it and does not give medical advice.

3. Why we use the data

3.1 Service improvement and AI training (anonymised data only)

Each hospital agrees in its contract/DPA that Zarur may use anonymised data to improve the service and train the AI behind Zarur. That means:

• - Audio is deleted first. Call recordings are never used for this purpose.
• - Anonymised text only: call transcripts and WhatsApp chats are stripped of names, phone numbers, ages, addresses, patient and doctor names and any other identifiers, so that no person can be identified.
• - Synthetic data: we may also use synthetic (made-up) sample calls.
• - Not sold: anonymised data is used only to improve Zarur, and it is not sold.

Our providers: our contracts bar our speech and AI providers from training their own models on call data. Some providers may keep limited data for their own purposes, such as abuse-monitoring logs (see Section 5).

4. Legal basis, notice and consent

• - Website enquiries and the demo: we process your data with your consent (Section 6, DPDP Act), which you give when you contact us or start the demo. Where it applies, we also rely on legitimate uses (Section 7), for example when you voluntarily give us your data for a specific purpose. You can withdraw consent at any time (Section 13). Withdrawal does not affect processing done before it.
• - Patient, caller and chat data: the hospital, as Data Fiduciary, is responsible for having a valid legal basis. To support it, Zarur gives every caller and WhatsApp user the notices below (Rule 3 of the DPDP Rules; Rule 5(3) of the SPDI Rules).
• - Staff accounts: we process this data to provide the service the hospital has signed up for.

Call-start announcement

Zarur plays this announcement at the start of every call, in the hospital's default call language. If the caller asks, or does not understand, Zarur repeats it in the caller's language.

*English master:*

"Hello, you're speaking with [Hospital]'s AI assistant. This call is recorded and may be used to improve our service. Details are at zarur.in/privacy."

Local-language versions are translated from this English master.

WhatsApp notice (first auto-reply)

"Hi, you're chatting with [Hospital]'s AI assistant. Chats are stored and may be used to improve our service. Details are at zarur.in/privacy."

5. Sharing and sub-processors

We do not sell personal data. We do not use any third-party CRM, because our dashboards are built in-house. We share data only with service providers who help us run Zarur, and only as needed:

These providers are bound by contract to protect the data and use it only to provide their service to us. Connections to them are encrypted. The named list of sub-processors is given to each hospital in its DPA.

Each hospital's data, including its WhatsApp chats, is kept separate at the database level, and no other hospital can see it. We may also disclose data when the law requires it, to comply with a valid request from a government authority, or to protect people's rights and safety.

6. Transfers outside India

We use trusted cloud and AI providers, primarily in India. Where a provider processes data outside India, appropriate safeguards apply. For example, live-call speech processing takes place in India, while our AI language model provider may process some data, including its abuse-monitoring logs, outside India. Section 16 of the DPDP Act and Rule 15 of the DPDP Rules allow transfers outside India, except to countries or under conditions that the Central Government restricts, and we will follow any such restrictions.

7. How long we keep data

When a retention period ends, we erase the data or make it anonymous, unless the law requires us to keep it longer.

8. Security

We use reasonable security safeguards, including:

• - Data separation: each hospital's data, including WhatsApp chats, is kept separate at the database level (row-level security), and no other hospital can see it.
• - Passwords: stored with strong hashing (Argon2).
• - Logins: attempts are rate-limited, and accounts lock after repeated failures (admins can unlock them). Password setup and reset use one-time codes.
• - Sessions: secure, httpOnly, SameSite cookies, with short-lived access tokens.
• - Encryption in transit: HTTPS with HSTS and security headers, and encrypted connections to our service providers.
• - Role-based access: admin, receptionist, nurse, doctor, pharmacy and auditor roles. Sensitive actions, such as managing doctors and user accounts, viewing and exporting the audit log, and deleting patients, are limited to admins.
• - Audit log: insert-only, so entries cannot be edited. It records changes, logins and failed logins, views of sensitive records, bookings, and any access by Zarur's platform team (shown as "platform"). Hospital admins can view and export it.
• - Backups: rolling backups, overwritten within about 30 days.

We do not currently offer two-factor authentication for logins.

Data breaches: if a personal data breach happens, we will notify affected hospital customers without delay, as soon as we become aware of it, so they can meet their duties as Data Fiduciary, and we will help them do so. For data where Zarur is the Data Fiduciary, we will:

• - notify affected people without delay;
• - notify the Data Protection Board of India without delay, and send it a detailed report within 72 hours (Rule 7, DPDP Rules); and
• - report qualifying cyber-security incidents to CERT-In within 6 hours, as CERT-In's directions require today.

9. Your rights

Under the DPDP Act (Sections 11–14), you have the right to:

• - Access a summary of your personal data and how it is processed.
• - Correct, complete or update your personal data.
• - Erase your personal data, unless we must keep it to meet a legal requirement.
• - Raise a grievance with us. We will respond within a reasonable period of no more than 90 days (Rule 14(3), DPDP Rules).
• - Nominate someone to exercise your rights if you die or become unable to do so.
• - Complain to the Data Protection Board of India if our response does not resolve your grievance.

How to make a request: email support@zarur.in with your name, the phone number or email linked to your data, and what you are asking for. We may need to verify your identity first.

Patients: please contact the hospital you called or messaged, because it is the Data Fiduciary for your data. If you write to us, we will forward your request to that hospital and help it respond.

Under Section 15 of the DPDP Act, you also have duties, for example not to file false or frivolous complaints and not to impersonate anyone.

10. Children's data

Our website and demo are not meant for children (anyone under 18 under the DPDP Act), and we do not knowingly collect children's data through them. Hospitals may book appointments for children through Zarur, usually when a parent or guardian calls. In those cases the hospital, as Data Fiduciary, is responsible for getting verifiable parental consent where Section 9 of the DPDP Act and Rule 10 require it. The Fourth Schedule of the DPDP Rules sets out exemptions for healthcare settings.

11. Cookies and browser storage

Our website does not use analytics, advertising or tracking cookies. It loads no third-party resources or trackers, and its fonts are self-hosted.

The hospital dashboard uses only strictly necessary storage:

• - Session cookies: secure, httpOnly, SameSite cookies that keep you signed in. The access token lasts 15 minutes. The refresh token lasts 1 day, or 30 days if you choose "remember me".
• - localStorage (stays on your device): your hospital identifier, display preferences, and a flag that remembers you closed a notice.
• - sessionStorage (cleared when you log out or close the browser tab): screen settings and any unsaved booking draft, which may contain patient details you have typed. Staff on shared computers should log out after use.

We do not show a cookie banner, because we use no tracking and only strictly necessary storage. You can block cookies in your browser, but the dashboard will not work without its session cookies.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. For important changes, we will tell hospital customers by email in advance and ask for fresh consent where needed.

13. Contact and Grievance Officer

This section is the contact point required by Rule 9 of the DPDP Rules. Zarur is not a Significant Data Fiduciary, so it is not required to appoint a Data Protection Officer.

Grievance Officer: Muhammad Shammas, Co-founder Zarur Technologies Private Limited, Kozhikode, Kerala Email: support@zarur.in

Trial and business enquiries: business@zarur.in WhatsApp: +91 95265 15290

Demo call notice (show before asking for microphone access)

This demo uses your microphone to talk to Zarur's AI receptionist. Your voice is processed by our speech and AI providers so the AI can reply, and the recording is kept for 12 months, then deleted. Please don't share real health or personal details. Privacy Policy

Not medical advice (disclaimer)

Zarur is an AI receptionist for appointments and general hospital information only. It does not give medical advice, diagnosis or treatment. In an emergency, Zarur transfers the call to the hospital desk. For life-threatening emergencies, call 108.