With effect from October 14, 2026

Welcome to Soulthing (the “Platform”). This Platform and its suite of products and services are owned and operated by Soulhealth Tech Private Limited, having its registered office at A 13 A, Block A, Industrial Area, Sector 62, Noida, Uttar Pradesh, 201309, which expression shall mean and include its officers, successors and permitted assigns). The Company operates a platform that facilitates discovery, booking, payment and coordination of therapy and wellness services delivered at the customer’s location by qualified professionals. Some professionals may be independent practitioners engaged under separate agreements; some may be employed by the Company. The professional’s status and the service provider’s identity should be disclosed to the customer where required by applicable law. Soulthing manages platform access, practitioner onboarding and verification procedures, service standards, booking coordination, payment processing and complaint handling. The platform is not an emergency service, hospital or substitute for appropriate medical evaluation. The Services may be provided by the Company through the Platform, and its suite of products and services, as may be identified by the Company from time to time. This Privacy Policy (“Privacy Policy”) sets out the Company's privacy practices with respect to the entire scope of Services provided by the Company. Depending on the service and applicable arrangements, independent practitioners may also process relevant personal data for delivering requested services and maintaining professional records, subject to applicable law and their respective contractual and legal obligations. The identity and relevant privacy responsibilities of a practitioner or service provider shall be communicated where required by applicable law.

This Privacy Policy describes the privacy practices of Soulhealth Tech Private Limited (“Soulthing” or the “Company”) and is intended to support compliance with applicable information technology and data protection laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made thereunder, as and when the relevant provisions become applicable. The Company shall comply with the provisions in force from time to time. This Privacy Policy should be read together with the Terms of Use.

For the purposes of this Privacy Policy, the words “Soulthing”, “Company”, “we”, “us” or “our” refer to the Company and all references to “you”, “your”, or “user”, as applicable, mean the person who accesses, uses, and/or participates in the Platform in any manner or capacity.

The Company is committed to protecting personal data and will implement reasonable and appropriate measures in accordance with applicable law and the risks associated with the personal data processed. No method of transmission or storage can be guaranteed to be completely secure.

General Terms:

1. The Company shall not be held liable for disclosure of any information if such disclosure is in accordance with this Privacy Policy, the Terms of Use, and/or applicable law.

2. By accessing or using the Platform, or by otherwise giving us your information, you confirm that you have the capacity to enter into a legally binding contract under the laws of India, and have read, understood, and agreed to the practices and policies outlined in this Privacy Policy and agree to be bound by the Privacy Policy.

3. You hereby consent to our collection, use, sharing, and disclosure of your information as described in this Privacy Policy. We reserve the right to change, modify, add, or delete portions of the terms of this Privacy Policy, at our sole discretion, at any time, and any continued use of the Platform, following any such amendments to the Privacy Policy, will be deemed as an implicit acceptance of the Privacy Policy in its amended form. You are requested to review the Privacy Policy from time to time to keep yourself updated with any changes or modifications made to the terms hereof.

4. If you are accessing or using this Platform from an overseas location, you do so at your own risk and shall be solely liable for compliance with any applicable local laws.

5. If you do not agree with any of the terms and conditions of this Privacy Policy, please do not proceed further to use this Platform. This Privacy Policy is subject to change at any time without notice. To make sure you are aware of any changes, please review this policy on this Platform periodically.

6. If you object to your information being transferred or used in accordance with this Privacy Policy, please do not use the Platform.
   
   

All capitalized terms used but not defined herein shall have the meaning ascribed to in the Terms of Use.

1. Data we Collect
   
   

   1. Account and contact data: name, mobile number, OTP authentication records, optional email address, gender, age/date of birth where provided or needed, profile details, and account status.

   2. Booking and location data: service selected, booking date and time, saved home address, visit address, approximate or precise location coordinates used for dispatch, booking status, cancellation and rescheduling history, and customer-practitioner communications.

   3. Health and wellness data: symptoms, duration and severity of concerns, relevant history and lifestyle answers, information submitted during AI screening, optional uploaded medical reports, relevant allergies or contraindications disclosed by the customer, and practitioner-generated session notes and reports.

   4. Payment and transaction data: order ID, payment ID or reference, amount, status, payment method type, refund information and invoice/accounting records. The Company states that it does not store card, UPI or bank-instrument credentials; these are handled by Razorpay or the applicable payment provider.

   5. Technical and usage data: device identifiers, app version, operating system, IP address, login and security logs, push-notification token, crash and diagnostic data, analytics events, call metadata and support interactions, to the extent the relevant features and providers are enabled.

   6. Reviews and communications: ratings, review tags, feedback, complaint details, messages to support and marketing preferences.

   7. Children’s data: if a parent or lawful guardian books a service for a child or infant, we may process the child’s age, symptoms and information necessary to assess and deliver the requested service. The app must use a suitable parental/guardian notice and verifiable-consent process before processing a child’s personal data where required by applicable law.
      
      

2. Notice, Choice and Consent
   
   

We will present a clear and standalone notice, in plain language, before or when requesting consent for processing that relies on consent. The notice should identify the specific personal data requested, each specified purpose, the service or feature enabled, how consent may be withdrawn, how rights may be exercised and how a complaint may be made. Where required, the notice will be available in English and an applicable language specified in the Eighth Schedule to the Constitution. Consent, where relied upon, must be freely given, specific, informed, unconditional and unambiguous through clear affirmative action, and limited to personal data necessary for the stated purpose. We will not treat silence, inactivity or a pre-ticked box as consent where affirmative action is required. We will maintain records sufficient to demonstrate the notice and consent obtained. You may decline optional information or optional processing. If information is necessary to make a booking or provide a particular feature safely, declining to provide it may mean that we cannot provide that booking or feature. We will distinguish mandatory information from optional information where practicable. You may withdraw consent at any time through the app or by contacting us using the details in Section 11. The method of withdrawal will be designed to be as easy to use as the method by which consent was given. Withdrawal does not invalidate processing lawfully carried out before withdrawal. It may affect our ability to provide the feature or service for which the data was necessary. Where processing is permitted on a lawful ground other than consent under the DPDP Act, or is required by another applicable law, we will process only to the extent permitted and necessary for that ground and will explain the relevant purpose where required.

3. AI and Automated Processing
   
   

Soulthing may use an LLM/AI service to generate informational therapy suggestions or responses based on information you enter. AI output is not a diagnosis, prescription or substitute for assessment by a suitably qualified professional, and may be inaccurate or unsuitable. Where AI processing is enabled, the information necessary to generate the requested output may be sent to the configured AI provider. We will not state that prompts are never stored or used for training unless this has been verified. Do not submit information that is not needed for the requested feature. Health information will not be sent to an AI provider for unrelated purposes. If a feature uses personal data for a materially different purpose, we will provide an appropriate notice and obtain consent where required. Where an AI feature uses personal data to generate an output, the Company shall process and disclose the relevant data in accordance with the applicable notice, consent requirements and other applicable law. The Company shall verify the actual AI provider, the information transmitted, applicable retention arrangements and whether prompts or outputs may be used for model training before making any specific assurance on these matters.

4. Sharing and Recipients
   
   

We may disclose the minimum data reasonably necessary to: 

1. the practitioner assigned to your booking; 

2. payment and refund providers, including Razorpay if configured; 

3. hosting, storage and database providers, including AWS if configured; 

4. authentication, notification and messaging providers, including Firebase/Google or MSG91 if configured; 

5. mapping/location providers, including Google Maps if configured; 

6. masked-call or communications providers, including Exotel if configured; 

7. the AI provider actually used; and 

8. authorised personnel and service providers supporting customer service, security, accounting, legal compliance and safety.
   
   

The assigned practitioner may receive your name or limited profile details, service and appointment information, visit address/map location when needed for dispatch, and relevant health information required to deliver the service. Access should be restricted to the assigned booking and legitimate care or safety needs. We may disclose personal data where required by law or a binding legal process, or where reasonably necessary to respond to a lawful request, protect safety, investigate fraud, enforce our terms or establish, exercise or defend legal claims. We do not sell personal data as a business model. Any new use or disclosure for an unrelated purpose will be assessed under applicable law and notified where required. Where a service provider processes personal data on behalf of the Company, the Company shall put in place appropriate contractual and organisational safeguards in accordance with applicable law. Such service providers shall not be authorised to use personal data for purposes unrelated to the services they provide, except where otherwise permitted or required by applicable law.

5. Retention, Erasure and Account Closure
   
   

We retain personal data only for as long as reasonably necessary for the specified purpose for which it was collected, or for a longer period where retention is required or permitted by applicable law, a legal obligation, a dispute, a safety investigation or the establishment, exercise or defence of legal claims. Different categories may have different retention periods. Indicative retention criteria are: 

1. account and booking data for account administration and dispute handling; 

2. health/session records for continuity and safety of the requested service and applicable professional/legal record keeping; 

3. payment and invoice records for tax, accounting and legal requirements; 

4. security logs for platform security and incident investigation; and 

5. location/dispatch records for service coordination and disputes. 
   
   

This Policy does not promise a fixed number of days or years unless the Company has adopted and implemented that period. You may request erasure of personal data through the means in Section 11. We will erase data when required under applicable law, including when consent is withdrawn and no other lawful ground permits continued processing, subject to legal retention exceptions and data that must be retained for a lawful purpose. Where only part of the data must be retained, we will limit continued processing to that part and purpose. Closing or deleting an account is not necessarily the same as immediately erasing every record. We may retain records that we are legally required or permitted to keep, but must not retain data indefinitely merely for convenience. Data in backups should be deleted or rendered inaccessible in accordance with a documented backup-retention cycle. The Company shall maintain an internal data-retention schedule specifying the applicable retention period or criteria for each material category of personal data. Upon expiry of the applicable period, personal data shall be erased or disposed of securely unless continued retention is required or permitted by applicable law or is otherwise necessary for a lawful purpose. Where particular records must be retained, access to and use of those records shall be limited to the relevant lawful purpose. Requests for account closure or erasure shall be handled through the procedure made available to users, subject to applicable legal retention requirements.

6. Information Security and Personal Data Breaches
   
   

The Company will implement reasonable technical and organisational measures appropriate to the risks of the personal data processed, including measures such as access controls, authentication, restricted access to health-related records, appropriate encryption, logging, vendor controls, backups and security reviews, as applicable to the production system. Access will be limited to personnel and practitioners who need the information for an authorised purpose. No system can be guaranteed completely secure. The Company shall maintain an appropriate process for identifying, assessing, reporting, investigating and responding to personal data breaches. Where a breach occurs, the Company shall take reasonable steps to contain the incident, mitigate its effects, preserve relevant evidence and notify affected users and the competent authority within the manner and timelines prescribed by applicable law. Service providers handling personal data shall be required to notify the Company of relevant security incidents in accordance with applicable contractual arrangements. The Company shall not claim a particular safeguard unless it is implemented and verified.

7. Your Rights and How to Exercise Them
   
   

Subject to the applicable provisions and commencement of the DPDP Act, you may have the right to: 

1. obtain information about personal data being processed and related processing activities;

2. request correction, completion or updating of inaccurate or incomplete personal data; 

3. request erasure of personal data where legally available; 

4. withdraw consent; 

5. use the grievance-redressal process; and 

6. nominate another individual to exercise rights in the event of death or incapacity, in the manner permitted by law.

To submit a request, email info@soulthingcompany.com or use the privacy-request facility within the Platform, if and when available. The Company shall publish and maintain the available means of submitting such requests and the information reasonably required to identify the requester. Requests shall be verified proportionately to the nature of the request and handled within the applicable statutory or published grievance-response period. Do not send unnecessary identity or medical documents by email. If a request cannot be fully complied with, the Company shall communicate the reason to the extent permitted by applicable law. Any in-app facility referred to in this Policy should be retained in this wording only if it is operational.

8. Children’s Personal Data
   
   

This app is not intended to permit a child to independently create an account unless the relevant feature and legal requirements support it. Where a parent or lawful guardian books for a child, the parent/guardian is responsible for providing accurate information and must be authorised to act for the child. Where required by the DPDP Act and Rules, Soulthing will obtain verifiable consent of the parent or lawful guardian before processing a child’s personal data, take due diligence steps to verify the adult’s identity and age as prescribed, and comply with applicable restrictions relating to tracking, behavioural monitoring or targeted advertising to children, subject to any applicable statutory exceptions. 

9. International Processing and Third-Party Services
   
   

Some service providers may process personal data in India or another jurisdiction. The Company shall assess the locations in which its service providers store, access or otherwise process personal data and shall comply with any applicable restrictions or conditions governing transfers of personal data outside India. Provider access will be limited by contractual and technical safeguards appropriate to the service. The actual list of providers may change as the Platform develops. The Company will keep privacy information reasonably current and provide additional notice where a change materially affects the purposes or manner of processing and notice is required by applicable law.

10. Cookies, Analytics and Communications
    
    

The website or app may use cookies, SDKs, analytics, diagnostics and push-notification technologies where enabled. These technologies may collect device, usage and diagnostic information to operate, secure and improve the service. Non-essential analytics or marketing technologies will be used in accordance with applicable consent and notice requirements and the choices made available to you. Service messages about bookings, safety, payments and account security may be sent where necessary to provide the service or comply with law. Promotional messages will be sent only where required consent or permission has been obtained, and you may opt out through the available mechanism.

11. Grievance Officer 
    
    

If you have any grievance with respect to the Platform or the Services, including a concern about personal data processing or consent withdrawal, you may contact the Company’s designated Grievance Officer using the details below. The Company shall publish and maintain a working contact route and shall address grievances within the period stated below, provided that this period is consistent with applicable law.

Name: Vaibhav Gupta

Email: info@soulthingcompany.com

Contact Number: +91 8796193853

The Company will endeavour to redress grievances expeditiously and within one (1) month from receipt, provided that this published period is consistent with applicable law and the applicable DPDP Rules. The Company cannot ensure a response to questions or comments unrelated to this Policy or the Company’s privacy practices, except where a response is required by law.

12. Contact person in data protection matters
    
    

For questions regarding the processing of personal data, please contact us via the following: Data Protection Officer: Mr. Yuvraj Raghuvanshi Email id: support@soulthingcompany.com
 

13. Changes to this Policy
    
    

We may update this Policy to reflect changes in services, data practices, technology, providers or applicable law. We will display the current version and effective date and communicate material changes through the app, website, email or another appropriate channel. Where a change requires fresh consent or a new notice, we will provide it before the relevant processing begins.

14. Miscellaneous
    
    

1. Indemnity: You agree and undertake to indemnify us in any suit or dispute by any third party arising out of the disclosure of information by you to third parties, either through our Platform or otherwise, and your use and access of websites, applications, and resources of third parties. We assume no liability for any actions of third parties with regard to your personal information, which you may have disclosed to such third parties.
   
   

2. Severability: Each clause of this Privacy Policy shall be and remain separate from and independent of and severable from all and any other clauses herein except where otherwise expressly indicated or indicated by the context of the Privacy Policy. The decision or declaration that one or more clauses are null and void shall have no effect on the remaining clauses of this Privacy Policy.
   
   

This Privacy Policy describes the Company’s privacy practices. Where consent is required, it shall be obtained through the applicable notice and clear affirmative action and not solely by the user’s access to or continued use of the Platform.