How Respiro Health collects, uses, and protects your information.

Who This Policy Covers

This Privacy Policy applies to Respiro Health Private Limited ("Respiro Health", "we", "us"), covering (a) visitors to respirohealth.ai, and (b) participants in our clinical research programme whose cough recordings and clinical information are collected at partner hospitals and outpatient departments ("OPDs"). If you are a research participant, this policy supplements — and does not replace — the informed consent form you sign or verbally agree to at your site of enrolment, which remains the primary, authoritative document governing your participation.

Information We Collect Through This Website

If you use the contact form on this site, we collect the name, email address, organisation, and message you provide, solely to respond to your enquiry. We do not sell or share this information with third parties for marketing purposes.

This site uses Google Analytics to understand aggregate visitor traffic (pages viewed, general location, device type). This is not linked to your identity as a research participant and does not track you across other websites we don't control.

Information We Collect Through the Research Programme

If you are enrolled as a research participant at a partner site, we collect:

Identity Information

Your name, phone number, and (where applicable) a caregiver's name, phone number, and relationship to you — collected only for consent verification and to contact you for follow-up visits.

Clinical & Demographic Information

Structured clinical history, symptoms, vitals, and demographic details (such as age, occupation, and residence) captured by a trained coordinator, plus your confirmed diagnosis once available.

Cough Recordings

A short voice-note recording of your cough, sent via WhatsApp, used to train and evaluate our acoustic screening model.

Identity information is stored in a separate, access-restricted database from your clinical and acoustic data. Wherever your data is used for model training, research analysis, or shared with co-authoring institutions, it is de-identified — your name and phone number are not included.

Legal Basis & Your Consent

We process personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For research participants, we rely on your explicit, informed consent — obtained through a documented consent process at your site of enrolment, which explains what is collected, why, and how it may be used before you agree to participate. You may withdraw this consent at any time by contacting us (see below); withdrawal does not affect data already used in aggregate, de-identified research analysis prior to withdrawal.

How We Use Your Information

• Model development: Training and validating our acoustic respiratory disease screening model.
• Clinical research: Academic publication and analysis, always using de-identified, aggregated data.
• Follow-up care coordination: Contacting you (or your caregiver) for scheduled follow-up visits as part of the study protocol.
• Regulatory & institutional compliance: Meeting requirements of Institutional Ethics Committees, ICMR, and applicable Indian law.

We do not use your data for advertising, and we do not sell personal data to any third party.

Data Storage & Security

Data is stored on AWS cloud infrastructure with encryption at rest. Identity data and clinical/research data are held in logically separate databases, so that a system compromise of one does not, by itself, expose the other. Access is restricted to authorised personnel and systems that require it to perform their function.

No system is completely immune to risk, and we cannot guarantee absolute security — but we design our infrastructure specifically to minimise what is exposed if any single part of it is compromised.

Who We Share Data With

• Co-authoring research institutions: De-identified sub-cohort data, for academic publication and analysis under the terms of our research collaboration agreements.
• Service providers: Infrastructure providers (such as AWS) and communication platforms (such as WhatsApp/Meta, for message delivery) that process data on our behalf, under contractual confidentiality obligations.
• Legal or regulatory bodies: Only where required by applicable law, or to protect the rights, safety, or property of Respiro Health, our research participants, or the public.

We do not sell personal data, and we do not share identifiable personal data with any party for their own independent marketing purposes.

Data Retention

Identity information is retained only as long as needed for consent verification and study follow-up, and is deleted or anonymised once no longer required for these purposes. De-identified clinical and acoustic research data may be retained longer, to support the longitudinal, multi-year nature of the research programme and future academic analysis, consistent with what was disclosed in your consent process.

Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete personal data.
• Withdraw consent and request erasure of your identity information, subject to any data already used in de-identified research analysis.
• Raise a grievance regarding how your data has been handled, and receive a response within a reasonable time.

To exercise any of these rights, contact us using the details below.

Minors

Our research programme does not enrol minors. Participation is limited to adult patients who can provide their own informed consent, consistent with our Institutional Ethics Committee-approved study protocol.

Changes to This Policy

We may update this policy from time to time as our research programme evolves. The "Last reviewed" date at the top of this page reflects the most recent update. Material changes affecting research participants will also be communicated through your site of enrolment where appropriate.