Privacy Policy

AeroDiary Mobile Application

AeroDel Technology Innovations Private Limited ("AeroDel", "we", "us", "our") is committed to protecting the privacy, security, and confidentiality of personal and health information collected and processed through the AeroDiary mobile application ("App"). This Privacy Policy explains how we collect, use, store, share, and protect your information, and how you can exercise your rights over your data.

By downloading, installing, or using AeroDiary, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App. This Policy applies to all users worldwide, with jurisdiction-specific provisions for India (DPDP Act 2023), the United States (HIPAA), and the European Union / United Kingdom (GDPR / UK GDPR).

1. About AeroDiary

AeroDiary is a Software as a Medical Device (SaMD) companion application designed to help patients and caregivers monitor aerosol therapy adherence, track respiratory symptoms, manage medications, and share therapy data with authorised healthcare professionals. The App is classified as a SaMD under applicable regulatory frameworks including CDSCO (India), FDA (USA), and CE/MDR (EU).

AeroDiary collects sensitive health information. We treat this data with the highest standard of care and process it only for the purposes described in this Policy.

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide Directly

• Registration data: Full name, email address, date of birth, gender, country of residence, and password.
• Health profile: Disease selection (e.g., asthma, COPD, allergic rhinitis), prescribed medications, and dosage information.
• Symptom and therapy logs: Responses to health questionnaires, adaptive symptom entries, and therapy scores (e.g., ACQ, CAT scores).
• Medication records: Medication names, dosages, and administration schedules entered in the App.
• Healthcare professional (HCP) details: Name and contact information of doctors or clinicians you choose to share your data with.
• Customer support communications: Messages, feedback, and issue reports you send us.
• Guardian/caregiver information: For paediatric users, the name and contact details of the parent or legal guardian providing consent.

2.2 Information Collected Automatically

• Device information: Device model, operating system version, unique device identifier (UDID), and mobile network.
• App usage data: Screens visited, features used, session duration, and interaction patterns, collected through AeroDel's own proprietary analytics. No third-party analytics SDKs are used.
• Crash and diagnostic logs: Error logs and technical diagnostics to identify and fix issues, processed exclusively within AeroDel's infrastructure.
• Push notification token: Required to send therapy reminders and health alerts (only if you grant notification permission).
• Timestamps: Date and time of all therapy logs, questionnaire responses, and App sessions.

2.3 Sensitive Health Data

The information described above includes "sensitive personal data" (under DPDP Act 2023), "special categories of personal data" (under GDPR), and "protected health information" (PHI, under HIPAA). This includes disease diagnosis, symptom records, and medication data. We collect this data solely to provide and improve the App's medical functionality and only with your explicit, informed consent.

3. How We Use Your Information

We use your information for the following purposes:

4. Legal Basis for Processing

We process your personal data on the following legal bases, by jurisdiction:

4.1 India -- DPDP Act 2023

• Consent: Explicit, informed, specific, and revocable consent obtained at onboarding and for each sensitive data category.
• Legitimate Use: Processing necessary for medical purposes and healthcare service delivery.
• Legal Obligation: Compliance with CDSCO MDR 2017, IEC 62304, and other applicable Indian statutes.

4.2 European Union / United Kingdom -- GDPR / UK GDPR

• Article 6(1)(a): Consent -- freely given, specific, informed, and revocable.
• Article 9(2)(a): Explicit consent for processing special categories of data (health data).
• Article 6(1)(c): Legal obligation -- regulatory and safety reporting.
• Article 6(1)(f): Legitimate interests -- App security, fraud prevention, and product safety.

4.3 United States -- HIPAA

AeroDiary collects health-related information that may constitute Protected Health Information (PHI) under HIPAA when used in connection with healthcare providers. We act as a Business Associate to covered entities (healthcare providers) where applicable, and process PHI under a Business Associate Agreement (BAA). Where HIPAA applies, processing is limited to treatment, payment, and healthcare operations as permitted under 45 CFR Part 164.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal or health information. We may share your information only in the following limited circumstances:

Healthcare Professionals (HCPs): With your explicit, in-app authorisation only. You may revoke HCP access at any time from your Profile settings.

Cloud Infrastructure Provider: AeroDiary's data is hosted on DigitalOcean infrastructure. DigitalOcean acts as a data processor under a Data Processing Agreement (DPA). Data is stored in regions selected to meet applicable data residency requirements.

Regulatory Authorities: Where required by law (CDSCO, FDA, EU MDR), including post-market surveillance reporting. Such disclosures will be of aggregated or de-identified data wherever possible.

Law Enforcement / Courts: Where legally compelled by court order, subpoena, or applicable law.

Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. You will be notified, and your rights will be preserved.

Affiliates and Group Companies: Within AeroDel group entities, bound by the same data protection obligations.

AeroDiary does not integrate with external third-party devices, wearables, or platforms in the current version. All data is processed entirely within AeroDel's own proprietary infrastructure, with no third-party analytics, advertising, or crash-reporting SDKs.

6. Children's Privacy

AeroDiary is intended for use by patients of all ages, including children with respiratory conditions such as paediatric asthma. Given the nature of our user base, we apply strict protections for minors:

• Users under 18 years of age (or the minimum age threshold in their jurisdiction) must have a parent or legal guardian provide consent on their behalf.
• Our in-app Consent screen is designed to capture verifiable parental/guardian consent for minors.
• We do not knowingly collect data from children without parental consent.
• Under DPDP Act 2023 (India): Data of children is defined as data of individuals below 18 years. Consent must be provided by the parent or legal guardian.
• Under GDPR (EU/UK): Article 8 requires parental consent for children under 16 years (or lower age set by Member State law, minimum 13).
• Under COPPA (USA): We do not knowingly collect personal data from children under 13 without verifiable parental consent.
• Parents or guardians may review, request correction of, or delete their child's data by contacting our Privacy Officer.

7. Data Storage and Security

7.1 Storage Location

User data is stored on DigitalOcean servers. AeroDel selects data centre regions to meet applicable data residency requirements:

• India users: Data stored in DigitalOcean's Bangalore (BLR1) or Singapore (SGP1) region, subject to India's data localisation requirements.
• EU/UK users: Data stored in DigitalOcean's Amsterdam or Frankfurt region to comply with GDPR data residency requirements.
• US users: Data stored in DigitalOcean's New York or San Francisco region.

7.2 Security Measures

AeroDel implements the following security controls consistent with IEC 62304, ISO 27001, HIPAA Security Rule, and GDPR Article 32:

• Encryption in transit: All data transmitted between the App and our servers is protected using TLS 1.2 or higher.
• Encryption at rest: Sensitive health data is encrypted at rest using AES-256 or equivalent.
• Authentication: Multi-factor authentication (MFA) available; session tokens with expiry controls.
• Role-based access control (RBAC): Only authorised AeroDel personnel with a business need can access user data.
• Audit logging: All access to and modifications of health data are logged and monitored.
• Vulnerability management: Regular security assessments, penetration testing, and patch management.
• Incident response: AeroDel maintains a documented incident response plan. Data breaches are reported within the timeframes required by law (72 hours under GDPR; promptly under HIPAA).
• Secure development: AeroDiary software follows IEC 62304 Class B/C software lifecycle requirements including security testing.

8. International Data Transfers

Where your data is transferred across international borders, AeroDel ensures appropriate safeguards:

• EU/UK transfers: Standard Contractual Clauses (SCCs) approved by the European Commission are used for transfers to non-adequate countries.
• India: Transfers comply with the cross-border transfer provisions under the DPDP Act 2023.
• USA: Transfers for US users are governed by HIPAA-compliant Data Processing Agreements with DigitalOcean.

9. Your Rights

You have the following rights over your personal and health data:

9.1 Rights Under DPDP Act 2023 (India)

• Right to access: Request a summary of your personal data and the purposes for which it is being processed.
• Right to correction: Request correction of inaccurate or outdated personal data.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to grievance redressal: Lodge a complaint with our Privacy Officer.
• Right to nominate: Nominate an individual to exercise rights on your behalf in the event of death or incapacity.

9.2 Rights Under GDPR / UK GDPR (EU / UK)

• Right of access (Article 15): Obtain a copy of your personal data.
• Right to rectification (Article 16): Correct inaccurate data.
• Right to erasure / right to be forgotten (Article 17): Request deletion, subject to legal obligations.
• Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to restriction (Article 18): Request restriction of processing in specific circumstances.
• Right to object (Article 21): Object to processing based on legitimate interests.
• Right to withdraw consent: At any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: With your local data protection supervisory authority (e.g., ICO in the UK).

9.3 Rights Under HIPAA (USA)

• Right to access PHI: Request a copy of your protected health information.
• Right to amendment: Request correction of PHI you believe is inaccurate.
• Right to an accounting of disclosures: Request a list of entities to whom your PHI was disclosed.
• Right to request restrictions: Request limitations on how your PHI is used or disclosed.
• Right to receive notices in plain language.

To exercise any of these rights, contact our Privacy Officer at privacy@aerodeltech.com. We will respond within 30 days (or sooner where required by law). Identity verification may be required.

10. Data Retention

We retain your personal and health data only as long as necessary for the purposes described in this Policy, including to meet legal, regulatory, safety, and post-market surveillance obligations.

Upon expiry of retention periods, data is securely deleted or anonymised. Anonymised aggregate data may be retained indefinitely for regulatory and safety reporting purposes.

11. Consent and Withdrawal

At first launch, AeroDiary presents a Consent screen that obtains your informed, explicit, and freely given consent to collect and process sensitive health data. You may withdraw consent at any time by:

• Navigating to Profile > Privacy Settings > Withdraw Consent within the App.
• Contacting our Privacy Officer at privacy@aerodeltech.com.
• Deleting your account from Profile > Account Settings > Delete Account.

Withdrawal of consent will result in the deletion of your health data and will prevent you from using the App's therapy monitoring features. It will not affect the lawfulness of processing that occurred before withdrawal.

12. Push Notifications

With your permission, AeroDiary sends push notifications for therapy reminders, health alerts, questionnaire prompts, and App updates. You can manage notification preferences at any time in your device's notification settings or within the App's Profile > Notifications settings. Your push notification token is stored on our servers solely to deliver these notifications and is not shared with any third party.

13. Sharing Data with Healthcare Professionals

AeroDiary enables you to share your therapy data with authorised healthcare professionals (doctors, nurses, physiotherapists, or other clinicians). The following conditions apply:

• Sharing is always opt-in and requires your explicit, in-app authorisation for each healthcare professional.
• You may revoke access at any time from Profile > Shared Access.
• HCPs access data through a secure, authenticated portal with role-based permissions.
• AeroDel does not independently disclose your data to any HCP without your explicit instruction.
• HCPs are bound by their own professional obligations and applicable data protection laws.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Notify you via push notification and in-app alert.
• Post the updated policy at the Privacy Policy screen within the App (/privacy-policy).
• Update the Effective Date at the top of this document.
• Request fresh consent where required by law.

Continued use of the App after notification of changes constitutes acceptance of the updated Policy.

15. Contact and Grievance Redressal

For any questions, concerns, access requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact our Privacy Officer:

If you are located in the European Union or United Kingdom and are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in your country (e.g., the ICO in the UK, or your local EU DPA).

If you are located in India and are not satisfied with our response, you may escalate to the Data Protection Board of India once established under the DPDP Act 2023.

Document Approval