Privacy Policy

YouInYou Philtech Foundation (“Ojas.me”)

Effective Date: 1 July 2025

Version 1.0

Governed by the Laws of India

Introduction and Scope

Welcome to Ojas.me ("Platform", "we", "our", or "us"). Ojas.me is a digital wellness and self-discovery platform rooted in ancient Indian wisdom traditions. This Privacy Policy ("Policy") describes how we collect, use, store, process, share, and protect the personal data of users ("you" or "User") who access our mobile and web application. This Policy is published in compliance with applicable Indian laws.

By registering, accessing, or using any part of the Ojas.me Platform, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, please discontinue use of the Platform immediately.

Data Fiduciary — Who We Are

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDPA 2023”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Data Fiduciary (the entity that determines the purpose and means of processing your personal data) is:

• Legal Entity: YouInYou Philtech Foundation
• Email: connect@ojas.me
• Grievance Officer: Bhushan Pathak
• Platform Name: Ojas.me

Information We Collect

We collect the following categories of personal data through your voluntary interaction with the Platform:

Account and Identity Information

• Full name
• Email address
• Mobile number (used for OTP/authentication)
• Date of birth (used to confirm eligibility and for personalised wellness features)
• Gender identity
• Profile photograph (optional)
• Username or display name

Wellness and Assessment Data

Ojas.me offers charts (playbooks), and personalised guidance. As we roll out wellness assessment features, we may also collect:

• Responses to wellness questionnaires and psychometric or prakriti-based assessments
• Lifestyle indicators (sleep patterns, stress levels, dietary preferences, spiritual practices)
• Goals and intentions shared by the user
• Dosha or constitution profiles generated from assessments
• Progress records and longitudinal wellness data

These assessment features and the related data collection apply only once such features become available in your version of the Platform, and only with the explicit consent described below. Where this data reveals information about your physical or mental health, it is treated as Sensitive Personal Data or Information.

AI Interaction Data

Our Platform includes an AI-powered assistant grounded in ancient Indian wisdom traditions (Ayurveda, Yoga, Vedanta, Jyotisha, etc.). When you interact with this feature:

• Your questions, queries, and conversation history are processed
• Contextual data from your profile and assessments may be referenced to personalise responses
• Conversation logs may be retained for the purpose of improving AI safety and accuracy, subject to the retention limits set out below

Important: AI-generated responses on Ojas.me are for informational and wellness guidance purposes only and do not constitute medical, psychiatric, legal, or financial advice. Always consult a qualified professional for such needs.

Technical and Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser/app version
• Log files, crash reports, and diagnostics
• Cookies, session tokens, and similar identifiers
• Referral source and UTM parameters

Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, the following categories, where collected, are classified as Sensitive Personal Data or Information and are afforded heightened protection:

• Physical and mental health information (as derived from wellness assessments)
• Medical history or condition indicators (if voluntarily disclosed)
• Financial information related to donations

Your explicit, informed consent will be obtained before we collect any SPDI.

Legal Basis and Consent

We process your personal data on the following lawful grounds under the DPDPA 2023 and the SPDI Rules:

• Consent: Your voluntary, informed, and specific consent, obtained at the time of data collection or use of a specific feature. You may withdraw consent at any time.
• Contractual Necessity: Processing necessary to provide the services you have registered for and the features you have accessed.
• Legal Obligation: Processing required to comply with applicable Indian laws, regulatory orders, or court directions.
• Certain Legitimate Uses (as permitted under the DPDPA 2023): Processing for fraud prevention, platform security, where you voluntarily provide data for a specified purpose, for compliance with law, and internal analytics, subject to your interests not overriding ours.

Where we rely on consent, we present a clear, granular, itemised consent notice in plain language at or before the point of collection. You are entitled to withdraw such consent at any time through your in-app privacy settings or by contacting our Grievance Officer. Withdrawal will not affect the lawfulness of processing carried out prior to withdrawal, and may result in your inability to access certain features.

How We Use Your Information

We use your personal data for the following purposes:

Core Platform Services

• Creating and managing your user account
• Delivering and personalising wellness assessments and playbooks
• Generating AI-powered guidance grounded in your profile and preferences
• Enabling workshop registrations and delivering workshop content

Communication

• Sending daily updates on charts, what’s new, etc. (with your opt-in consent)
• Sending transactional notifications (e.g., account creation)
• Platform updates, new feature announcements, and policy changes
• Responding to your support queries and grievances
• Wellness tips and content newsletters — with your prior opt-in consent only

Research, Safety, and Improvement

• Improving the accuracy and quality of AI responses through anonymised, aggregated analysis
• Conducting internal research on wellness outcomes (using aggregated, de-identified data)
• Detecting and preventing fraud, abuse, and unauthorised access
• Platform testing, bug resolution, and performance optimisation

Legal and Regulatory Compliance

• Fulfilling obligations under applicable Indian laws and regulatory requirements
• Responding to lawful requests from law enforcement or government authorities
• Enforcing our Terms of Service and other applicable agreements

We do not use your personal data for the purpose of targeted advertising to third parties, nor do we sell your personal data.

Sharing and Disclosure of Personal Data

Service Providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf under contractual obligations consistent with this Policy:

• Cloud infrastructure and hosting providers (e.g., AWS, Google Cloud, or equivalent)
• SMS, email, and push notification service providers
• Analytics and crash reporting services
• AI model and infrastructure providers (for processing AI queries)
• Payment gateway providers (where donation features are made available)

All such processors are required to maintain confidentiality, process data only as instructed by us and may engage their own subprocessors only under equivalent obligations.

Legal Disclosures

We may disclose personal data if required to do so:

• By a court order, tribunal direction, or government authority under applicable Indian law
• To enforce our legal rights or protect the rights, property, or safety of our users or the public
• In connection with an investigation of fraud, IP infringement, piracy, or other unlawful activity

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity. We will provide prior notice and ensure the successor is bound by terms no less protective than this Policy.

Aggregated and De-identified Data

We may share aggregated, anonymised, or de-identified information that cannot reasonably be used to identify you, for research, publication, or partnership purposes.

Cross-Border Data Transfers

We may engage service providers or infrastructure partners located outside India to process Personal Data on our behalf. Accordingly, your Personal Data may be transferred to and processed in jurisdictions outside India, subject to the applicable laws.

Where such transfers occur, we take reasonable steps to ensure that your Personal Data remains protected through appropriate contractual, technical and organisational safeguards. We shall not transfer Personal Data to any country or territory where such transfer is prohibited or restricted under Applicable Law.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law:

• Account data: Retained for the duration of your active account. Upon verified deletion, we erase your personal data promptly and retain only (a) a minimal, non-personal record that the account existed and was deleted, and (b) any data we are required by law to keep for no longer than the period prescribed by law or 3 years, whichever is shorter.
• Assessment and wellness data: Retained for up to 3 years from the date of last active use, to enable longitudinal wellness tracking, unless you request earlier deletion.
• AI conversation logs: Retained for up to 12 months for safety, quality and improvement purposes, after which the underlying conversation records are permanently deleted. We may retain only aggregated, non-identifying statistics derived from them.
• Financial and donation records (if any): Retained for the period required under applicable tax, RBI, and financial regulations (which may exceed the periods above).
• Legal hold data: Retained for as long as required by a competent legal authority.

Upon expiry of the applicable retention period, data will be securely deleted or rendered anonymous in a manner that prevents re-identification.

Data Security

We implement reasonable security practices and procedures as mandated by Rule 8 of the SPDI Rules and the DPDPA 2023. Our security measures include:

• Encryption of personal data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Role-based access controls (RBAC) limiting data access to authorised personnel only
• Periodic security reviews and vulnerability assessments
• Multi-factor authentication for privileged administrative access
• Secure coding standards and OWASP-aligned development practices
• Incident response and breach notification procedures

While we take all reasonable precautions, no system is completely impenetrable. In the event of a personal data breach that is likely to result in harm to you, we will notify you and the relevant authorities as required under applicable law.

Children's Privacy

Ojas.me is intended only for individuals who are 18 years of age or older. By accessing or using the Platform, you represent and warrant that you are at least 18 years of age.

We do not knowingly collect or process the Personal Data of individuals under the age of 18 years. If we become aware that Personal Data of an individual under 18 has been collected or processed through the Platform, we will take reasonable steps to delete such Personal Data, unless its retention is required under applicable law. If you believe that an individual under the age of 18 has provided Personal Data on our Platform, please contact us immediately at connect@ojas.me.

Cookies and Tracking Technologies

We use essential and functional cookies and similar local-storage technologies on our web Platform:

• Essential Cookies: Necessary for the Platform to function (e.g., session management, authentication tokens). Cannot be disabled.
• Functional Cookies: Remember your preferences and personalise your experience (e.g., language, theme).

Where we introduce analytics or performance cookies, we will do so only with your consent, managed through a cookie consent banner and preference controls on our web Platform.

You may manage cookie preferences through your browser settings. Disabling essential cookies may impair your ability to use certain features.

Your Rights as a Data Principal

Under the DPDPA 2023 and the SPDI Rules, you have the following rights with respect to your personal data:

Right to Access

You have the right to obtain a summary of the personal data we hold about you and the processing activities undertaken in respect of such data.

Right to Correction and Erasure

You may request correction of inaccurate or incomplete personal data. You may also request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time by accessing your account settings or by writing to us. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal. Withdrawal may result in inability to access certain features.

Right to Grievance Redressal

You have the right to have your grievance relating to personal data processing redressed by our Grievance Officer within the timelines prescribed under applicable law.

Right to Nominate

You may nominate another individual to exercise your rights on your behalf in the event of your incapacity or death, in accordance with the DPDPA 2023.

Right to Complain to the Data Protection Board

If you are not satisfied with our response, you have the right to approach the Data Protection Board of India (once constituted under the DPDPA 2023) with a complaint.

How to Exercise Your Rights

You may exercise the rights to access, correction, erasure, and consent withdrawal directly through your in-app account settings, or by submitting a written request to:

Data Protection / Grievance Officer

Email: connect@ojas.me

Withdrawal of Consent and Account Deletion

You may withdraw consent or delete your account at any time through your in-app account settings or by writing to our Grievance Officer at connect@ojas.me.

Upon receipt of a valid, verified request, we will erase your personal data promptly, retaining only the minimal non-personal and legally-required records described in the Data Retention section. Where retention is required under applicable law, such personal data shall be retained only for the period prescribed or permitted by such Applicable Law.

Please note that deletion of your account may result in the permanent loss of access to the Platform and associated content, records and preferences, which may not be recoverable.

Grievance Redressal Mechanism

In accordance with the SPDI Rules and the DPDPA 2023, we have designated a Grievance Officer to address complaints and concerns regarding the processing of personal data. If you have a grievance, please contact:

Grievance Officer — Ojas.me

• Name: Bhushan Pathak
• Designation: Manager
• Email: connect@ojas.me

We will acknowledge and address your grievance as reasonably practicable in accordance with applicable law within the timelines prescribed under applicable law.

If you are not satisfied with our response, you may avail such remedies as are available under applicable law.

AI-Powered Wellness Assistant

Our AI assistant draws on ancient Indian knowledge systems to provide guidance on wellness, lifestyle, and self-discovery. Regarding the processing of your data through this feature:

• Conversations are processed using AI/ML models. Your queries may be transmitted to our AI service providers for the purpose of providing the requested services, subject to reasonable contractual and technical safeguards.
• Conversations may be reviewed by authorised Ojas.me personnel where reasonably necessary for quality assurance, safety, security, troubleshooting and service improvement purposes, in accordance with applicable law.
• We design and instruct the AI assistant not to solicit sensitive medical or financial information beyond what is necessary for wellness guidance and we advise you not to share such details or any third-party personal information in your conversations.
• AI-generated responses are provided for informational and wellness purposes only and are not a substitute for professional medical, psychological, legal, or financial advice.
• You should not share personally identifiable information of third parties in your AI conversations.
• Where supported by our AI service providers and technically feasible, we configure our AI infrastructure to minimise or eliminate retention of prompts and responses beyond what is necessary to provide the requested services.

Third-Party Links and Services

The Platform may contain links to third-party websites, content, or services (including workshop partner platforms, social media, or payment gateways). We are not responsible for the privacy practices or content of such third parties. We encourage you to read the privacy policies of any third-party service you engage with through our Platform.

Amendments to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Material changes will be notified to you by:

• A prominent notice on the Platform (in-app notification or banner)
• An email notification to your registered email address
• Updating the "Effective Date" at the top of this Policy

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must discontinue use of the Platform and may request deletion of your account.

Older versions of this Policy will be archived and made available upon request.

Governing Law and Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any dispute arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts located in New Delhi, India.

In case of any conflict between this Policy and applicable Indian law, the applicable law shall prevail to the extent of the conflict.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us at connect@ojas.me.