Legal

Privacy Policy

Last updated: 19 September 2026

This policy is published by Yello, operated by NDIAN Healthcare Private Limited (CIN U86905TS2026PTC223050), with its registered office at 3rd Floor, 8-2-231/18, Nagarjuna Hills Road, Mothi Nagar, Nagarjuna Hills, Punjagutta, Hyderabad, Telangana 500082 ("Yello", "we", "us"). It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the SPDI Rules, 2011. Draft, subject to review by legal counsel.

On this page 1. Scope & who we are 2. Data we collect 3. Health data 4. Why we use it 5. Consent & choices 6. How we share it 7. Retention 8. Security 9. Your rights 10. Grievance Officer 11. Cookies 12. Children 12A. Investor room 13. Changes & contact

1. Scope & who we are

Yello operates a managed diagnostic & imaging centre network: we route patients to partner diagnostic centres, run a patient app, and provide brand, technology and operations to those centres. This policy covers personal data we handle as a Data Fiduciary across our website, app, and partner platform. Where a partner centre independently determines how it uses data, that centre is the Data Fiduciary for those activities and we act as a Data Processor.

2. Data we collect

Identity & contact: name, phone, email, address, age/gender, government ID where legally required.
Health data: tests/scans booked, diagnostic and imaging results, reports, prescriptions, and the health record we build over time (incl. Smart Reports and Health Score).
Booking & payment: appointments, slots, order history, transaction references (card/UPI details are handled by our payment processor, not stored by us).
Partner/centre data: for centre owners and staff — business details, licences/accreditations, bank/settlement details, operational metrics.
Device & usage: IP, device/browser, app interactions, cookies (see §11).

3. Health data — handled with extra care

Diagnostic, imaging, genetic and other health data are sensitive personal data. We process them only to deliver the service you asked for, build your health record, and meet legal obligations — never sold, and never used for marketing without your separate, explicit consent. Treatment/diagnostic use, research use, and marketing use are kept separate and consented to separately.

4. Why we use your data

To fulfil bookings and deliver diagnostics, imaging and reports through partner centres and pooled radiologists.
To operate the patient app — Smart Reports, Health Score, family profiles, savings tracking.
To run partner centres (operations, billing, settlement, quality, procurement) under the applicable partnership model.
To send service communications; and, only with consent, marketing and health-checkup reminders.
To comply with law (NABL/NABH, PC-PNDT, AERB, Clinical Establishments, tax) and to detect fraud and secure the platform.

Where we rely on consent, you give it through a clear notice at the point of collection, and you can withdraw it at any time (this does not affect processing already done, or processing required by law). Marketing consent is optional and separate from service consent; you can opt out of marketing without losing the service.

The partner centre fulfilling your test/scan, and pooled radiologists who report it.
Service providers (processors) — cloud hosting, communications, and payment gateways — under contract and only for the purposes above.
Legal/regulatory — where required by law, court order, or a regulator.
Business transfer — in a merger/acquisition, with continued protection of your data.

We do not sell your personal or health data.

7. Retention

We keep health and diagnostic records for the period required under applicable medical-record and statutory norms, and other data only as long as needed for the purposes above or to meet legal obligations, after which it is deleted or anonymised.

8. Security

We use reasonable technical and organisational safeguards — encryption in transit, access controls, audit logging, and vendor due diligence. No system is perfectly secure; we will notify you and the Data Protection Board of India of a reportable personal-data breach as required.

9. Your rights

Under the DPDP Act you may: access a summary of your data and how it is processed; correct, complete or update it; request erasure where no longer needed; nominate another person to exercise your rights; and raise a grievance. Submit requests via the Grievance Officer below; we respond within statutory timelines (and in any case within 90 days for grievances).

10. Grievance Officer

Grievance Officer, NDIAN Healthcare — partners@yello.health, 3rd Floor, 8-2-231/18, Nagarjuna Hills Road, Mothi Nagar, Nagarjuna Hills, Punjagutta, Hyderabad, Telangana 500082. If your grievance is not resolved, you may escalate to the Data Protection Board of India.

11. Cookies

We use essential cookies to run the site and, with consent, analytics cookies to improve it. You can control cookies in your browser; disabling essential cookies may break core features.

12. Children

For users under 18, we process data only with verifiable consent of a parent or lawful guardian, and we do not undertake tracking or targeted advertising directed at children, as required by the DPDP Act.

12A. Investor room

If you request access to the Yello investor room or use a room link, we collect your name, email, firm, how you invest and any note you send, your confidentiality acknowledgement (name, time and version), and a record of which documents and pages you view and for how long. We use this only to manage access, protect confidential materials and follow up with you about a possible investment. It is stored in Google Workspace under our control, is never sold, and is deleted on request unless we must keep it by law. You can ask us to withdraw your access and erase these records at any time via the Grievance Officer below.

13. Changes & contact

We may update this policy; material changes will be notified on this page with a new "last updated" date. Questions: partners@yello.health.