HeiBuddy™ Privacy Policy

IMPORTANT — PLEASE READ CAREFULLY

This Privacy Policy (the “Policy”) explains how we collect, use, share, retain, and protect Personal Data when you use the Platform or otherwise interact with Yugasys. It forms part of our Terms and Conditions.

By accessing or using the Platform, you confirm that you have read this Policy and understand how your Personal Data will be processed. Where consent is required under applicable law, we will ask for it separately and in a clear, granular, withdrawable manner — not through continued use alone.

Special notices:

• If you are a resident of the European Economic Area (EEA), the United Kingdom, or a jurisdiction with mandatory data-protection rules that cannot be contractually waived, the applicable Jurisdiction-Specific Schedule in Section 24 supplements — and where it conflicts, overrides — the main body of this Policy to the minimum extent required.
• If you are a parent or guardian of a minor, please also read Section 18 and Schedule D.
• If you use our AI or voice features, please also read Sections 9, 10, and 11, which address voice biometrics, speech-to-text, and LLM processing in detail.

1. About This Policy

1.1 Who we are

Yugasys Software Private Limited is a company incorporated in India (CIN: U72900KA2019PTC125835), with its registered office at NO. 558, 9TH CROSS, J P NAGAR 3RD PHASE, BENGALURU, Karnataka, India - 560078, Bengaluru, Karnataka, India. For the purposes of the Digital Personal Data Protection Act, 2023 (India), we act as a Data Fiduciary. For the purposes of the EU/UK GDPR, we act as a Data Controller for most processing described in this Policy, and as a Processor for certain Partner-facing services (addressed in a separate Data Processing Agreement).

1.2 Scope

This Policy applies to:

• all Users of the Platform — registered Consumers, Partners, Delivery Partners, and visitors — regardless of role or access method;
• all Platform interfaces — mobile applications, websites, APIs, partner dashboards, voice interfaces, notifications, and customer-support channels;
• all jurisdictions from which the Platform is lawfully accessed, subject to the Jurisdiction-Specific Schedules.

This Policy does not cover the independent processing of your Personal Data by third-party Merchants, Delivery Partners, payment aggregators, or medical professionals. Their processing is governed by their own privacy notices.

1.3 Relationship to other documents

This Policy is read alongside the Terms and Conditions, the AI & Voice Biometrics Notice, the Cookies & SDK Notice, the Sub-Processor Register, and service-specific notices. In the event of conflict, a specific notice prevails over the general Policy for the subject matter it covers.

2. Definitions

2.1 “Personal Data” — any data relating to an identified or identifiable natural person (“Data Principal” under the DPDP Act; “Data Subject” under GDPR/UK GDPR; “Consumer” under CCPA/CPRA).

2.2 “Sensitive Personal Data” — Personal Data requiring heightened protection, including: financial information, health information, biometric data (including voiceprints), genetic data, children’s data, religious/caste/tribe/political beliefs, sexual orientation, and other categories treated as “sensitive personal data or information” (SPDI) under the SPDI Rules 2011, “special category data” under GDPR/UK GDPR, “sensitive personal information” under CPRA, or equivalent under other Applicable Law.

2.3 “Processing” — any operation performed on Personal Data, including collection, recording, structuring, storage, retrieval, use, disclosure, combination, erasure, and destruction.

2.4 “Processor” / “Data Processor” — a service provider that processes Personal Data on our behalf under contract.

2.5 “Sub-processor” — a third party engaged by us or by a Processor to perform specific processing on our behalf (e.g., AI providers, cloud hosts, analytics providers).

2.6 “Applicable Law” — all data-protection, privacy, cybersecurity, financial, healthcare, and consumer-protection laws in force from time to time, including those listed in Section 25.

Other capitalised terms carry the meanings assigned in the Terms and Conditions.

3. Categories of Personal Data We Collect

3.1 Data you provide directly

3.2 Data collected automatically

3.3 Data from third parties

• Social/SSO providers (if you link your account).
• Payment aggregator for transaction status and risk signals.
• Verification and fraud-prevention providers (e.g., KYC verification, bot detection).
• Marketing partners for attribution and anti-fraud (aggregated only, where lawful).
• Publicly available sources (e.g., sanctions lists, regulator registers, driver licence registries) for compliance screening.

3.4 Data we do not collect or store

• Full payment-card numbers, CVV, or expiry (held by the payment aggregator and network in tokenised form).
• Passwords in plaintext (only salted + hashed via Argon2id / bcrypt cost ≥ 12).
• Contents of your other apps, SMS inbox, or contact list — unless you grant specific permission for a named feature (e.g., refer-a-friend contact picker), and even then, only the contacts you select are transmitted.
• Background audio when the voice assistant is not actively invoked.

4. Sources of Personal Data

We collect Personal Data:

(a) Directly from you when you register, use features, place orders, upload content, or contact support;

(b) Automatically through your device, app, and interactions as described in Section 3.2;

(c) From Partners and Service Providers (e.g., Merchants confirming order fulfilment, Delivery Partners confirming drop-off, RMPs uploading prescriptions);

(d) From third-party sub-processors (e.g., payment aggregator, KYC vendor, fraud-detection);

(e) From public or governmental sources where needed for verification, regulatory compliance, or sanctions screening.

5. Legal Bases for Processing

Under GDPR/UK GDPR, DPDP, LGPD, and similar laws, we process Personal Data only where a lawful basis applies. The primary basis per activity is mapped below (multiple bases may apply):

Where we rely on legitimate interests, we conduct a documented Legitimate Interests Assessment (LIA) and balance our interests against your rights and freedoms. You have the right to object (see Section 19).

6. Purposes of Processing

We use Personal Data to:

(a) operate and secure the Platform, including account creation, authentication, and device binding;

(b) deliver the services you request — orders, bookings, consultations, payments, notifications, support;

(c) operate AI Features (voice assistant, Smart Meal, AI chat) where you have consented;

(d) personalise recommendations, routine orders, and location-based suggestions;

(e) facilitate communication between you and Partners/Delivery Partners/RMPs;

(f) detect, prevent, and investigate fraud, abuse, money-laundering, sanctions violations, and security incidents;

(g) monitor system health, diagnose faults, and improve reliability and performance;

(h) comply with legal, regulatory, tax, and audit obligations;

(i) conduct internal research, product development, and analytics (using aggregated, anonymised, or pseudonymised data wherever feasible);

(j) send transactional, service, and — where you have opted in — marketing messages;

(k) establish, exercise, or defend legal claims.

We do not use Personal Data for purposes incompatible with those set out here without obtaining fresh consent or confirming another lawful basis.

7. Sensitive Personal Data — Additional Safeguards

Where we process Sensitive Personal Data (health, financial, biometric, children’s, etc.), we apply additional safeguards:

• Explicit, granular consent (where consent is the basis), captured and logged through our Consent Management Platform;
• Purpose limitation — sensitive data is not used for advertising, behavioural profiling, or secondary analytics;
• Access control — role-based, least-privilege, logged; break-glass access is reviewed weekly;
• Encryption — sensitive data is encrypted in transit (TLS 1.3) and at rest (AES-256-GCM using keys managed in AWS KMS with automatic rotation and envelope encryption);
• Segmentation — stored in isolated data stores with separate access boundaries;
• Minimisation — collected only to the extent strictly necessary for the specified purpose;
• Retention — retained per the Retention Schedule in Section 17, with automated purge.

8. Health Data (Doctor Consultation and Pharmacy)

8.1 Status. Health data — including symptoms, medical history, prescriptions, diagnostic reports, and teleconsultation notes — is treated as Sensitive Personal Data.

8.2 Framework. We process health data in line with:

• the DPDP Act, 2023 (India) heightened consent requirements;
• the Telemedicine Practice Guidelines, 2020 (India);
• GDPR/UK GDPR Article 9 (where EEA/UK users are involved);
• HIPAA (where US Business Associate Agreements apply — if and when the Platform operates in scope);
• the forthcoming DISHA / National Digital Health Mission frameworks (India) as and when effective.

8.3 Use limitations. Health data is used only to facilitate your consultation, prescription, or pharmacy order; to maintain the medical record as required by law; and to comply with regulatory obligations. It is not used for advertising or non-essential analytics.

8.4 Sharing. Health data is shared only with: (a) the RMP or pharmacy you have chosen; (b) the dispensing pharmacist and delivery agent (minimum necessary — typically a prescription reference and delivery address, not full history); (c) regulators or courts where legally required; (d) sub-processors bound by contractual confidentiality and security commitments.

9. Biometric Data — Voiceprints and Related

9.1 Definition. Biometric Data includes voiceprints and voice-audio signatures derived from your interactions with the voice assistant where used for identification, authentication, or personalisation.

9.2 Explicit consent. Biometric Data is processed only on the basis of your separate, written, informed, explicit consent, consistent with:

• the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/;
• the Texas CUBI and Washington Biometric Privacy Act;
• GDPR/UK GDPR Article 9(2)(a);
• DPDP Act Section 6 read with Section 9 (for children) and sensitive-data norms.

9.3 Retention and destruction. Biometric Data is retained only for so long as the purpose requires and, in any event, destroyed no later than the earliest of: (a) the period specified in the published Biometric Data Retention and Destruction Schedule; (b) three (3) years after your last interaction; or (c) prompt destruction upon withdrawal of consent or account deletion, subject only to any residual legal-hold.

9.4 No sale, no profit. We do not sell, lease, trade, or otherwise profit from Biometric Data, and we do not disclose Biometric Data to third parties except: (a) to sub-processors acting on our instructions under binding confidentiality and security commitments; (b) where required by law or valid legal process.

9.5 Security. Biometric templates are stored in an isolated biometric vault, encrypted with dedicated keys, and are never transmitted or stored as raw audio files for biometric purposes once the template has been generated.

10. AI Features and Third-Party AI Sub-Processors

10.1 What AI Features do

The Platform uses AI to power the voice assistant (“Hei Buddy”), Smart Meal recommendations, and natural-language chat. AI Features operate through a combination of in-house models and licensed third-party providers.

10.2 Our current AI sub-processors

We will update this Policy and the Sub-Processor Register (available at https://www.heibuddy.ai/subprocessors) when we add, change, or remove AI sub-processors. Material changes trigger the notification mechanism in Section 22.

10.3 What we do not share with AI sub-processors

Your account details, authentication credentials, payment information, KYC documents, health records, location history, device identifiers, contact list, and persistent identifiers are not shared with Google Cloud Speech-to-Text or OpenAI. Only the minimum data needed for the specific AI task is shared.

10.4 Training and model improvement

Our enterprise contracts with Google Cloud and OpenAI contractually restrict the use of Platform-submitted data for training the providers’ foundation models. This is the current contractual position at the Last Updated date; we monitor provider terms and will update this Policy if the position changes. You may withdraw consent at any time (Section 11).

10.5 Automated decision-making

No legally or similarly significant decision about you (e.g., financial approvals, significant refunds, account restrictions, healthcare decisions) is taken solely by automated means without meaningful human review. You have the right, where provided under Applicable Law, to obtain human intervention, contest the decision, and express your point of view. See Schedules A–C for jurisdiction-specific automated-decision rights.

10.6 AI content labelling

Where required by the EU AI Act (Regulation (EU) 2024/1689, Article 50) or equivalent frameworks, AI-generated responses are labelled to indicate their machine origin.

11. Consent — Granting, Granular Control, and Withdrawal

11.1 Granting consent. Before we first transmit your voice audio to a speech-to-text provider, your text prompt to an LLM provider, or generate a voice biometric template, the App shows a clear, standalone consent screen naming each sub-processor, the data involved, and the purpose. You must tap “Allow” — silent or bundled consent is not sufficient for these features.

11.2 Granular controls. In Settings → Privacy, you can independently control:

• voice assistant (speech-to-text);
• AI chat / Smart Meal (LLM processing);
• voice biometrics (template generation);
• precise location;
• push notifications;
• marketing communications;
• personalised recommendations;
• sharing of analytics data.

11.3 Withdrawal of consent. You may withdraw consent at any time. Withdrawal: (a) disables the dependent feature prospectively; (b) triggers deletion of voice biometric templates and transient AI working data within 30 days, subject only to lawful retention obligations; (c) does not affect the lawfulness of processing performed before withdrawal.

11.4 Consent ledger. We maintain an auditable, timestamped consent ledger to satisfy DPDP, GDPR, and sector-specific accountability requirements.

12. Do Not Track, Global Privacy Control, and Universal Opt-Outs

We honour:

• the Global Privacy Control (GPC) browser signal for web traffic, where required under CPRA and Colorado/Connecticut/Virginia laws;
• “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” links and in-App controls for US-state users;
• App Tracking Transparency (ATT) decisions on iOS.

13. How We Share and Disclose Personal Data

We share Personal Data only as described below. We do not sell Personal Data for monetary consideration, and we do not engage in “sharing” for cross-context behavioural advertising, as those terms are defined under the CPRA.

13.1 Parties with whom we share

13.2 Sub-Processor Register

A current list of our material sub-processors, including the processing location and transfer mechanism, is published at https://www.heibuddy.ai/subprocessors and updated when changes occur.

13.3 Aggregated / de-identified data

We may use, disclose, and retain aggregated or de-identified data that cannot reasonably be used to identify you, for research, benchmarking, and product development, consistent with the CPRA de-identification standard and applicable guidance.

14. Cross-Border Data Transfers

14.1 Parts of the Platform and certain sub-processors are located outside India. When Personal Data is transferred across borders, we rely on one or more of the following mechanisms:

• EU Standard Contractual Clauses (SCCs) (Commission Decision (EU) 2021/914), with the relevant Module applied per role;
• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs;
• Transfer Impact Assessments (TIAs) consistent with Schrems II jurisprudence;
• DPDP Act Section 16 — transfers limited to countries not restricted by the Central Government of India (we monitor notifications issued under this Section);
• APEC Cross-Border Privacy Rules (CBPR), where relevant;
• Binding Corporate Rules (BCRs) for intra-group transfers, where adopted;
• Adequacy decisions where available.

14.2 Data localisation — payments. Pursuant to RBI’s Storage of Payment System Data Directive, payment-system data relating to Indian customers is stored within India. Copies may be transmitted abroad solely for transaction processing and recalled to India within the prescribed timelines.

14.3 Configurable residency. Partners and enterprise tenants may configure preferred data-residency options via the Partner Dashboard.

15. Security of Your Information

15.1 Our programme

We operate an information-security programme aligned with (and, where certified, compliant with) the following standards — currently at [state certification status: Certified / In audit / Targeted]:

• ISO/IEC 27001:2022 (Information Security Management System);
• ISO/IEC 27701 (Privacy Information Management System);
• SOC 2 Type II (Security, Availability, Confidentiality, Processing Integrity, Privacy);
• PCI-DSS v4.0 for payment-related components;
• NIST Cybersecurity Framework 2.0 and CIS Controls v8;
• OWASP ASVS v4.0 Level 2 (Level 3 for financial/authentication modules) and OWASP MASVS for mobile.

Certification details, where held, are published at https://www.heibuddy.ai/trust.

15.2 Representative controls

• Encryption in transit: TLS 1.3 (minimum TLS 1.2 with strong cipher suites); certificate pinning for mobile apps.
• Encryption at rest: AES-256-GCM with keys managed in AWS KMS / HSM; automatic rotation; envelope encryption.
• Authentication: phone + OTP, MFA for admin and sensitive operations, passkeys/WebAuthn support where available.
• Access control: least-privilege RBAC/ABAC enforced at the service layer; just-in-time access for sensitive operations; detailed audit logging.
• Password storage: Argon2id or bcrypt (cost ≥ 12); never plaintext.
• Network security: segmented VPCs, zero-trust service mesh, WAF, DDoS protection, egress filtering.
• Secret management: AWS Secrets Manager / Parameter Store with rotation; no secrets in source.
• Vulnerability management: SAST, DAST, SCA in CI/CD; annual third-party penetration testing; continuous dependency monitoring against CVEs.
• Threat monitoring: 24×7 SOC coverage with SIEM, EDR, behavioural analytics, anomaly detection.
• Backup & DR: encrypted, geographically redundant backups; tested recovery procedures.
• Personnel: background verification where lawful, mandatory security training, confidentiality agreements.

15.3 Your role in security

No system is impenetrable. You must safeguard your credentials, device, SIM, and authentication factors. Report suspected compromise to security@heibuddy.ai.

16. Breach Notification

16.1 Internal response. We operate a 24×7 incident-response capability. Incidents are triaged, contained, eradicated, and reviewed under a documented playbook.

16.2 Regulatory notifications. Where a Personal Data breach occurs, we will notify:

• CERT-In within 6 hours of becoming aware, per the CERT-In Directions of 28 April 2022;
• the Data Protection Board of India and affected Data Principals as prescribed under the DPDP Act and any implementing rules;
• the relevant EU/UK supervisory authority within 72 hours, per GDPR Art. 33 / UK GDPR Art. 33;
• US state regulators and affected individuals per applicable state breach-notification laws;
• HIPAA-covered entities where a Business Associate relationship applies;
• RBI / payment networks for payment-related incidents, per the applicable framework;
• other regulators as legally required.

16.3 Your notification. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, using clear language and describing the nature of the breach, likely consequences, and steps you can take.

17. Data Retention Schedule

We retain Personal Data only for as long as needed for the purposes described, the duration of any lawful hold, and applicable statutory retention. The table below is indicative — specific retention is driven by purpose, jurisdiction, and law.

When a retention period ends, data is deleted or irreversibly anonymised. Anonymisation uses techniques aligned with ISO/IEC 20889 and relevant DPA guidance.

18. Your Rights

Subject to verification and applicable law, you have the following rights. The jurisdiction-specific Schedules (Section 24) describe local variations, exemptions, and timelines.

(a) Right of access — to know what Personal Data we hold about you and how we process it.

(b) Right to correction / rectification — to correct inaccurate or incomplete data.

(c) Right to erasure / deletion — to request deletion, subject to legal-retention exceptions.

(d) Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.

(e) Right to restrict processing (GDPR/UK GDPR).

(f) Right to object (GDPR/UK GDPR), including to direct marketing and legitimate-interests processing.

(g) Right to withdraw consent at any time, without affecting prior lawful processing.

(h) Right to opt out of sale, sharing, or targeted advertising (CPRA and similar US-state laws).

(i) Right to limit use of sensitive personal information (CPRA).

(j) Right to nominate another person to exercise rights in the event of your death or incapacity (DPDP Section 14).

(k) Right to grievance redressal (DPDP Section 13 and IT Rules; see Section 23).

(l) Right to lodge a complaint with your national Data Protection Authority / supervisory authority (see Schedules).

(m) Right not to be subject to a solely automated decision with legal or similarly significant effects (GDPR Art. 22; equivalent local laws).

(n) Right against retaliation / non-discrimination for exercising your rights.

18.1 How to exercise your rights

• In the App: Settings → Privacy → Data Rights;
• Email: privacy@heibuddy.ai;
• Postal: Data Protection Officer, Yugasys Software Private Limited, [registered address], Bengaluru, Karnataka, India.

18.2 Verification and response timelines

We verify requests using information reasonably available to us (e.g., mobile OTP, account credentials, or additional proof for sensitive requests). Indicative response timelines:

18.3 No fee; exceptions

Requests are generally free. We may charge a reasonable fee or refuse manifestly unfounded, excessive, or repetitive requests, to the extent permitted by law, with written reasons.

19. Children’s Privacy

19.1 Age gates. The Platform is not directed to children under 18 in India (DPDP Act Section 9), or under 13 in the United States (COPPA), or under the applicable digital-consent age in the EEA/EU Member States (between 13 and 16 under GDPR Article 8).

19.2 Verifiable parental consent. Where a child uses the Platform, we require verifiable parental consent through mechanisms compliant with COPPA, DPDP Section 9, GDPR Article 8, and the UK Age-Appropriate Design Code.

19.3 No tracking / no targeted ads. We do not track, behaviourally profile, or serve targeted advertising to children. DPDP Section 9(3) prohibitions apply by design.

19.4 California AADC and UK AADC. For California and UK users, we apply the relevant Age-Appropriate Design Code defaults (high-privacy defaults, minimal data collection, geolocation off by default, etc.) where a user is identified or reasonably likely to be a child.

19.5 Deletion. If we learn that a child has provided Personal Data without the required consent, we will delete it promptly and take steps to prevent recurrence.

20. Cookies, SDKs, and Similar Technologies

Our detailed Cookies & SDK Notice is available at https://www.heibuddy.ai/cookies and within Settings. In summary:

• Strictly necessary technologies (authentication, load balancing, fraud prevention) are used without consent, where permitted.
• Analytics and functional technologies are used with consent (EEA/UK/certain US states) or an opt-out (other jurisdictions).
• Advertising/tracking technologies are used only with explicit consent or, where applicable, not at all for children and sensitive contexts.

A cookie banner (web) and consent panel (app) provide granular controls.

21. Third-Party Links and Services

The Platform may link to or integrate with third-party services (maps, payment gateways, AI providers, government portals, airlines, insurers). Their processing of your Personal Data is governed by their own privacy policies, not this Policy. We encourage you to review them.

22. Changes to This Policy

We may update this Policy. Material changes will be communicated via:

(a) an in-App notification;

(b) email to your registered address (where applicable);

(c) an updated “Last Updated” date and a summary of material changes published at the top of this Policy;

at least fifteen (15) days before the effective date, except where a shorter period is required by law, security, or regulatory order.

Non-material changes (clarifications, formatting, sub-processor substitutions at equivalent protection) take effect on posting.

23. Grievance Redressal and Contact

23.1 Data Protection Officer (DPO)

Email: dpo@heibuddy.ai

Postal: Data Protection Officer, Yugasys Software Private Limited, [registered address], Bengaluru, Karnataka, India.

23.2 Grievance Officer (India — per IT Rules 2021 and DPDP Act)

Name: Mr. Chetan S M (appointed; current details published in-App and on our website)

Designation: Grievance Officer

Email: grievance@heibuddy.ai

Acknowledgement: within 24 hours of receipt. Resolution: within 15 days, or such other period as Applicable Law may prescribe.

23.3 EU / UK Representative (Articles 27 GDPR / UK GDPR)

Where required, our EU and UK Representative details are published in Schedule A and on our website.

23.4 Breach Reporting Contact (internal)

security@heibuddy.ai; 24×7 in-App and web reporting channels.

23.5 Regulatory escalation

You may lodge a complaint with the applicable supervisory authority:

• India — Data Protection Board of India (once operational); CERT-In; your consumer forum.
• EU/EEA — your national Data Protection Authority.
• UK — Information Commissioner’s Office (ICO).
• US — California Privacy Protection Agency (CPPA), Attorney General of your state; FTC.
• Other — your national or regional authority.

24. Jurisdiction-Specific Schedules

Schedule A — EEA and European Union (GDPR)

A.1 Controller: Yugasys Software Private Limited.

A.2 EU Representative (Art. 27): [●] (published on our website when appointed).

A.3 Legal bases: as set out in Section 5.

A.4 Rights: access, rectification, erasure, restriction, objection, portability, withdraw consent, lodge complaint with the DPA of your Member State.

A.5 Automated decision-making (Art. 22): see Section 10.5.

A.6 Transfers: SCCs (Modules 1 and 2 as applicable); TIAs.

A.7 Retention: as per Section 17, read subject to Member State–specific rules.

A.8 EU AI Act disclosures: see Section 10.6.

Schedule B — United Kingdom (UK GDPR)

B.1 UK Representative (Art. 27 UK GDPR): [●].

B.2 Transfers: UK IDTA or UK Addendum to the EU SCCs.

B.3 Complaints: Information Commissioner’s Office (ICO), https://ico.org.uk.

Schedule C — United States

C.1 California (CCPA/CPRA).

• Rights: right to know, delete, correct, opt out of sale/share, limit use of SPI, non-discrimination.
• Sale / share: we do not sell Personal Information and do not share it for cross-context behavioural advertising.
• Sensitive Personal Information is used only for purposes permitted under CPRA §1798.121.
• Metrics: we publish annual request metrics where the threshold applies.
• Shine the Light (California Civil Code §1798.83): email privacy@heibuddy.ai with subject line “Shine the Light Request”.

C.2 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other state laws: equivalent rights honoured per each statute; universal opt-out signals (GPC) recognised where required.

C.3 Nevada (SB 220): you may direct us not to sell covered information — although we do not sell, we honour the opt-out request.

C.4 Illinois (BIPA), Texas (CUBI), Washington: Biometric Data handled per Section 9.

C.5 COPPA: see Section 19.

C.6 HIPAA: where applicable, covered PHI is handled under a Business Associate Agreement; this Policy does not override the BAA.

C.7 TCPA / CAN-SPAM: opt-out mechanisms provided; transactional messages remain enabled.

Schedule D — Children (All Jurisdictions)

D.1 Verifiable parental consent per COPPA, DPDP §9, GDPR Art. 8, UK and California AADCs.

D.2 No behavioural advertising, profiling, or location tracking for known children.

D.3 High-privacy defaults.

Schedule E — Other Jurisdictions (Summary)

• Brazil (LGPD): ANPD complaint channel; equivalent rights; DPO contact at dpo@heibuddy.ai.
• Japan (APPI): Personal Information Protection Commission (PPC) channel; cross-border consent protocol.
• South Korea (PIPA): strict consent; PIPC complaint channel.
• Singapore (PDPA): PDPC complaint channel; DNC Registry honoured.
• Australia (Privacy Act): OAIC complaint channel; APP-aligned practices.
• UAE / KSA / Qatar / Bahrain (PDPLs): local authority channels; applicable localisation rules respected.
• South Africa (POPIA), Nigeria (NDPR), Kenya (DPA), Egypt (PDPL), Ghana (DPA): authority channels; consent / retention per each statute.

25. Regulatory Reference (Non-Exhaustive)

This Policy is designed in alignment with, among others: DPDP Act 2023 (India); IT Act 2000 and IT Rules 2021 (India); CERT-In Directions 2022; Telemedicine Practice Guidelines 2020; RBI Master Directions on PA/PG, PPI, KYC, Digital Lending, Outsourcing, and Storage of Payment System Data; PMLA 2002; GDPR; UK GDPR; EU AI Act; ePrivacy Directive; DSA/DMA; PSD2/PSD3; HIPAA; GLBA; COPPA; CCPA/CPRA; VCDPA/CPA/CTDPA/UCPA; BIPA/CUBI; TCPA/CAN-SPAM; FTC Act §5; PCI-DSS v4.0; ISO/IEC 27001:2022, 27701, 27017, 27018, 42001; SOC 2; NIST CSF 2.0; CIS Controls v8; OWASP ASVS/MASVS; LGPD; APPI; PIPA; PDPA (SG/TH/MY/PH); PDP Law (Indonesia); PDPD (Vietnam); UAE PDPL; Saudi PDPL; POPIA; NDPR; Australian Privacy Act.

26. Governing Law

This Policy is governed by and construed in accordance with the laws of India, without regard to conflict-of-laws principles, subject to mandatory data-protection and consumer-protection laws of your place of habitual residence where those laws cannot be contractually displaced. Disputes are resolved per the Terms and Conditions (Section 21 of those Terms).

27. Contact

Yugasys Software Private Limited

Registered Office: NO. 558, 9TH CROSS, J P NAGAR 3RD PHASE, BENGALURU, Karnataka, India - 560078, Bengaluru, Karnataka, India

CIN: U72900KA2019PTC125835

• General privacy: privacy@heibuddy.ai
• DPO: dpo@heibuddy.ai
• Grievance Officer (India): grievance@heibuddy.ai
• Security / Breach: security@heibuddy.ai
• Website: https://www.heibuddy.ai
• Sub-Processor Register: https://www.heibuddy.ai/subprocessors
• Trust & Compliance: https://www.heibuddy.ai/trust

Acknowledgement. By continuing to use the Platform after the Effective Date, you confirm your agreement to these privacy policies referenced herein.

Document control: Privacy Policy v2.0 | Owner: HeiBuddy Legal, DPO, Security | Reviewers: CISO, Product, Engineering | Next review: 3 months from Effective Date or upon material regulatory change, whichever is earlier.