Privacy Policy

Effective: 1/8/2026 · Version 2.2 · Tinystack Private Limited

This Privacy Policy describes how Tinystack Private Limited (“ourlio”, “we”, “us”) collects, uses, stores, shares, and protects your personal data when you use the ourlio mobile application and website (collectively, the “Service”).

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act 2023 (“DPDP Act”), the Information Technology Act 2000 and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPI Rules”).

By using the Service, you consent to the collection and processing of your personal data as described in this Policy.

1. Data Controller

The data controller (or “Data Fiduciary” under the DPDP Act) responsible for your personal data is Tinystack Private Limited, a company incorporated under the Companies Act 2013, CIN U47912PN2026PTC255163, having its registered office in Pune, Maharashtra, India.

2. Data We Collect

2.1 Information You Provide

When you create an account or use the Service, you provide:

• Identity: name, email address, phone number, profile photograph
• For Doctors: medical council registration number, clinic name and address, specialisation, qualifications, years of experience, bank account details (if receiving payments)
• For Parents: child’s name, date of birth, gender, health tracking data (feeding, sleep, growth, vaccines, medications, temperature, diapers, mood)
• For Mothers: wellness data, mental health logs, pregnancy data where applicable
• Communications: messages, voice notes, prescriptions, lab reports, and other content you upload
• Walk-in registration: where you register in person at a clinic reception before creating an account, reception staff may collect your name, phone number, and your child’s name on your behalf, to create your initial record and complete your connection to the clinic. This information is provided to reception directly by or on behalf of you, and is subject to the same protections as other data described in this Policy.
• Teleconsultations: video/audio calls between you and a connected doctor are recorded and transcribed, for continuity of care and the clinical record. You are notified of this before a call begins.

2.2 Information We Collect Automatically

• Device data: device model, operating system, app version, IP address, language, time zone
• Usage data: features used, screens viewed, actions taken, session duration
• Location data: your precise device location (with your permission), used to show nearby doctors and clinics and to display distance
• Diagnostic data: crash reports, error logs, performance metrics

2.3 Information from Third Parties

• Authentication providers you choose to use to log in, such as Google or Apple, provide your email and profile information
• Payment processors provide payment confirmation (we do not receive your card details)
• Push notification and messaging providers, including WhatsApp (operated by Meta Platforms, Inc.), provide delivery confirmation for notifications and communications sent through those channels

2.4 Sensitive Personal Data

Health information about you or your child constitutes sensitive personal data under the SPI Rules. We treat such data with additional safeguards as set out in this Policy.

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide the Service: create and manage your account, deliver features you request, track child health, facilitate doctor-parent communication
• To improve the Service: analyse usage patterns, fix bugs, develop new features, train and improve AI models on de-identified data
• For AI assistance: generate SOAP notes, transcribe voice notes and call recordings, power the Ouri conversational assistant, analyse meal and symptom photos, and provide health insights. Clinical documentation (SOAP notes), voice/call transcription, and the Ouri assistant are processed exclusively on India-hosted AI infrastructure, with no fallback outside India. Some other AI features including meal and nutrition photo analysis and general educational content generation may currently be processed using service providers located outside India, as described in Section 6.
• To communicate with you: send service notifications, respond to support requests, deliver content you have subscribed to including via WhatsApp, where you have not opted out
• For safety and security: detect fraud, prevent abuse, enforce our Terms of Service
• For compliance: comply with applicable law, respond to lawful requests from authorities, enforce our rights

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: you have given explicit consent for specific purposes
• Contract: processing is necessary to provide the Service you have requested
• Legitimate interests: processing is necessary for our legitimate interests, including operating the Service, security, and improvement
• Legal obligation: processing is necessary to comply with applicable law

5. Sharing of Personal Data

We do not sell your personal data. We share data only in the following circumstances:

5.1 With Your Connected Doctor

When you connect your child’s profile to a Doctor using a clinic code, the Doctor is given access to the health tracking data associated with that connection. Some categories of data are shared by default upon connection so that your doctor has the clinical context needed to provide care; where we offer a specific sharing control for a data category, your choice through that control is respected. We are working to extend granular, category-by-category sharing controls across all tracked data types. You can disconnect from a doctor at any time.

Where your connected Doctor’s clinic has designated a Clinic Administrator, that administrator may also access health tracking data for all patients connected to any Doctor at that clinic, for the purpose of clinical oversight and administrative management of the clinic. This access is controlled by the clinic and is subject to the same confidentiality and security obligations as your connected Doctor’s own access.

5.2 With Service Providers

We work with service providers who help us operate the Service, including:

• Cloud infrastructure and database providers (located in India)
• AI processing providers, some of which are located outside India — see Section 6
• Payment processors
• Email and notification providers
• WhatsApp (operated by Meta Platforms, Inc., headquartered in the United States) for delivering messages and notifications you have opted to receive through that channel
• Error-monitoring and diagnostics providers, which process crash reports and error logs to help us detect and fix technical faults — see Section 6

These providers process your data on our instructions and, where we have a direct contractual relationship with them, under contractual confidentiality obligations.

5.3 With Authorities

We may disclose data to governmental, regulatory, or judicial authorities where required by applicable law, court order, or lawful direction. Where legally permitted, we shall notify the affected User of any such disclosure.

5.4 In Business Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, your data may be transferred to the acquiring or surviving entity, subject to the same protections as set out in this Policy.

5.5 With Your Consent

We may share data with other parties where you have given explicit consent.

6. Data Localisation and International Transfers

Your account data, health tracking data, and the substantial majority of personal data collected through the Service is stored on cloud infrastructure located within India.

Clinical documentation (SOAP notes), voice/call transcription, and the Ouri conversational assistant are processed exclusively on India-hosted AI infrastructure. These features do not fall back to infrastructure outside India, even if the India-hosted service is temporarily unavailable.

Some other AI-assisted features — including meal and nutrition photo analysis, symptom-photo analysis, and general educational content generation — may route data through AI service providers located outside India (including the United States) as part of a multi-provider processing chain. This means that for these specific features, your data may be transmitted outside India for the purpose of processing, even though it is not permanently stored there. We are working to reduce reliance on non-India AI infrastructure over time.

Diagnostic data — crash reports, error logs, and performance metrics — is processed by our error-monitoring provider on infrastructure located outside India. This diagnostic data does not include your health records or the content of your notes, messages, prescriptions, or documents, and identifying fields such as your email address and IP address are removed before it is transmitted. It is used solely to detect and diagnose technical faults in the Service.

Similarly, where you communicate with us via WhatsApp, that communication is processed by Meta Platforms, Inc. on infrastructure outside India, in accordance with Meta’s own privacy practices.

Where your data is transferred outside India, we take reasonable steps to ensure it continues to receive an appropriate standard of protection.

7. Data Retention

We retain your personal data for as long as necessary to provide the Service and for the following additional periods:

• Account data: until you delete your account, then 30 days for backup purposes
• Health data: as required by applicable medical record retention laws, typically 5-7 years
• Payment data: 8 years as required by the Income Tax Act
• Communications: 3 years from the last interaction
• Diagnostic and crash data: 90 days
• Doctor Directory data: until removal request, then deleted within 72 hours
• Marketing preferences: until you opt out

8. Your Rights

Under the DPDP Act, you have the following rights in respect of your personal data:

• Right to Information: obtain confirmation that we process your data, and access the data
• Right to Correction: correct inaccurate or incomplete data
• Right to Erasure: request deletion of your data, subject to legal retention requirements and Section 7 above
• Right to Grievance Redressal: raise complaints with our Grievance Officer
• Right to Nominate: nominate another individual to exercise your rights in the event of death or incapacity
• Right to Withdraw Consent: withdraw consent at any time (which may affect Service availability)

To exercise any of these rights, email [email protected]. We shall respond within statutory timeframes.

9. Data Security

We implement reasonable security practices and procedures as required by the SPI Rules, including:

• Encryption of data in transit (TLS) and industry-standard encryption at rest
• Row-level security controls on database access, scoping each user’s access to their own data and its intended recipients
• Signed, verifiable tokens for sensitive server-to-server communications, including payment webhook verification
• Regular internal security review, including adversarial testing of authentication and access-control logic
• Access controls limiting internal access to personal data to what is operationally necessary
• Secure development practices and code review

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children’s Data

The Service tracks health information about children with the explicit consent and lawful authority of their parent or legal guardian. Parents are responsible for managing their child’s data through the Service. We do not knowingly collect personal data directly from children under 18 without parental consent. If you believe a child’s data has been provided without parental consent, please contact us at [email protected] for immediate removal.

11. Cookies and Tracking

The Service uses cookies and similar technologies to operate the website, remember your preferences, analyse usage, and improve the Service. For details, see our Cookie Policy.

12. Marketing and Service Communications

We may send you service and marketing communications about new features, content, and offers, by email, in-app notification, or WhatsApp.

• Email: you can opt out at any time by clicking “unsubscribe” in any email, or by updating your preferences in the Service.
• WhatsApp: you can opt out at any time by sending “STOP” to the WhatsApp number we message you from. We are working to add an in-app control for this as well.

13. AI Training and Improvement

We may use de-identified, aggregated data to train and improve our AI models. De-identified data cannot be used to identify any individual. We do not use your identifiable health data to train AI models without explicit consent.

14. Third-Party Services

The Service may link to or interoperate with third-party services. We are not responsible for the privacy practices of third parties. We encourage you to read their privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email or in-app notification not less than 30 days before they take effect. The latest version is always available at ourlio.com/privacy-policy.

16. Grievance Officer

Grievance Officer:
Vijay Belgaumkar, Co-founder
Tinystack Private Limited
Pune, Maharashtra, India
Email: [email protected]

The Grievance Officer shall acknowledge receipt of a grievance within 24 hours and resolve it within 15 days.

17. Contact

For any questions about this Privacy Policy or our data practices:

Tinystack Private Limited
Pune, Maharashtra, India
Email: [email protected]

Version 2.2 · Effective 1/8/2026 · Tinystack Private Limited