Legal

DPDP Notice

Digital Personal Data Protection Act 2023 compliance

Privacy Policy Terms of Service Medical Disclaimer Fair Usage Policy Refund Policy DPDP Notice Cookie Policy
Questions?

Contact our data protection officer at

[email protected]
Last updated: August 29, 2026

Effective: June 2026 · Version 2.0 · Tinystack Private Limited

This Notice is published by Tinystack Private Limited (“ourlio”, “we”, “us”) under the Digital Personal Data Protection Act 2023 (“DPDP Act”) and informs Data Principals of their rights and how we process personal data.

This Notice supplements and should be read together with our Privacy Policy and Terms of Service.

1. Who We Are

For the purposes of the DPDP Act, the Data Fiduciary responsible for your personal data is:

Tinystack Private Limited
Pune, Maharashtra, India
CIN: U47912PN2026PTC255163
DPIIT Recognised Startup
Email: [email protected]

2. Personal Data We Process

We process the following categories of personal data:

2.1 Identity and Contact Data

  • Name, email address, phone number, profile photograph
  • For Doctors: medical council registration number, professional qualifications, clinic address

2.2 Health Data (Sensitive Personal Data)

  • Child health tracking: feeding patterns, sleep duration, growth measurements, vaccinations, medications, temperature, diapers, mood
  • Maternal health: wellness logs, mental health entries, pregnancy data
  • Clinical data: prescriptions, lab reports, voice notes, SOAP notes, consultation records

2.3 Usage Data

  • Device information, IP address, app version, operating system
  • Features used, screens viewed, session duration
  • Approximate location (with permission)

2.4 Payment Data

  • Transaction history, payment method indicator (we do not store full card details)
  • Subscription status

3. Purpose of Processing

We process your personal data for the following specific purposes:

  • Service provision: creating and managing your account, delivering Service features, facilitating doctor-parent communication
  • Health tracking: recording and analysing child health data you choose to log
  • Clinical assistance: AI-powered SOAP notes, voice transcription, pre-appointment briefs (for Doctors)
  • Communications: service notifications, security alerts, support responses
  • Improvement: understanding usage patterns to improve the Service (using aggregated and de-identified data where possible)
  • Security: detecting fraud, preventing abuse, enforcing Terms
  • Compliance: meeting legal obligations and responding to lawful authority requests

4. Legal Basis

We process personal data on the following legal bases under the DPDP Act:

  • Consent: for processing that requires explicit consent, such as health data tracking and AI assistance
  • Specified legitimate use: where processing is necessary for performance of the Service
  • Legal obligation: where required by Indian law

5. Your Rights as a Data Principal

Under the DPDP Act, you have the following rights:

5.1 Right to Information

You have the right to obtain confirmation from us as to whether personal data concerning you is being processed, and where that is the case, to access:

  • The personal data we hold about you
  • The purposes of processing
  • Details of any disclosure to third parties
  • Other information required by the DPDP Act

5.2 Right to Correction and Erasure

You have the right to request correction of inaccurate or misleading personal data, completion of incomplete personal data, and erasure of personal data which is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.

5.3 Right to Grievance Redressal

You have the right to readily available means of grievance redressal in respect of any act or omission of ourlio regarding your personal data. See section 9 below for our Grievance Officer details.

5.4 Right to Nominate

You have the right to nominate any other individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

5.5 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal may affect Service availability.

6. How to Exercise Your Rights

To exercise any of your rights under the DPDP Act:

  1. Email [email protected] with the subject line corresponding to your request (e.g., “ACCESS REQUEST”, “CORRECTION REQUEST”, “ERASURE REQUEST”)
  2. Provide sufficient information to identify yourself (typically your registered email and name)
  3. Specify clearly what you are requesting
  4. Provide any supporting documents if applicable

We shall:

  • Acknowledge receipt within 24 hours
  • Verify your identity within 48 hours
  • Respond to your request within statutory timeframes (typically within 30 days, or sooner for specific rights)
  • Provide reasons if we are unable to fully accommodate your request

7. Children’s Data

We process personal data of children (individuals under 18 years) only with the verifiable consent of a parent or lawful guardian, in accordance with Section 9 of the DPDP Act.

The parent or lawful guardian is responsible for the child’s data on the Service. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

If you believe a child’s data has been processed without parental consent, please contact us immediately at [email protected].

8. Data Localisation and Cross-Border Transfer

Your account data, health tracking data, and the substantial majority of personal data processed through the Service is stored and processed on cloud infrastructure located within India.

Clinical AI processing — SOAP notes, voice/call transcription, and the Ouri assistant — runs exclusively on India-hosted AI infrastructure, with no fallback outside India. Some other AI features, such as meal and nutrition photo analysis, may route data through AI service providers located outside India (including the United States) as part of a multi-provider processing chain. Your data may be transmitted outside India for the purpose of this processing, even though it is not permanently stored there.

Similarly, where you communicate with us via WhatsApp, that communication is processed by Meta Platforms, Inc. on infrastructure outside India, in accordance with Meta’s own privacy practices.

Where your data is transferred outside India, we take reasonable steps to ensure it continues to receive an appropriate standard of protection. See Section 6 of our Privacy Policy for further detail.

9. Grievance Officer

In accordance with Section 8(10) of the DPDP Act:

Grievance Officer:
Vijay Belgaumkar, Co-founder
Tinystack Private Limited
Pune, Maharashtra, India
Email: [email protected]

The Grievance Officer shall acknowledge receipt of a grievance within 24 hours and resolve it within 15 days of receipt, in accordance with the timeframes prescribed under the DPDP Act and IT Act.

10. Data Protection Officer

Under the DPDP Act, certain Data Fiduciaries classified as Significant Data Fiduciaries are required to appoint a Data Protection Officer. ourlio shall comply with this requirement if and when classified as such by the Central Government. Until such time, all data protection queries should be directed to the Grievance Officer.

11. Data Protection Board

If you are not satisfied with the response to your grievance, you have the right to lodge a complaint with the Data Protection Board of India once established under the DPDP Act.

12. Security Safeguards

We implement reasonable security safeguards as required by the DPDP Act and the SPI Rules, including:

  • Encryption of data in transit and at rest
  • Access controls and authentication
  • Regular security assessments
  • Incident response procedures
  • Staff training on data protection
  • Vendor management for third-party processors

13. Data Breach Notification

In the event of a personal data breach, we shall notify the Data Protection Board of India and affected Data Principals in accordance with the requirements of the DPDP Act and applicable timeframes.

14. Cookies and Tracking

Our use of cookies and similar technologies is described in our Cookie Policy.

15. Changes to This Notice

We may update this Notice from time to time to reflect changes in law, our practices, or the Service. Material changes will be notified by email or in-app notification not less than 30 days before they take effect.

16. Contact

For any matter relating to your personal data, this Notice, or your rights under the DPDP Act:

Tinystack Private Limited
Pune, Maharashtra, India
Email: [email protected]

Version 2.0 · Effective June 2026 · Tinystack Private Limited