⚠ DRAFT — PENDING COUNSEL REVIEW

This Privacy Policy has been drafted by Aarya Innovations LLC based

on standard healthcare-SaaS practices. It has not yet been reviewed

by an attorney. By accepting this draft, you acknowledge it is an

interim version that will be replaced with a counsel-reviewed final

version when one is available. You will be asked to re-accept the

final version at that time.

Privacy Policy

Effective date: the date you accept this Policy through the Vaidya portal.

Provider: Aarya Innovations LLC, a Nevada limited liability company doing business as Vaidya ("Vaidya", "we", "us"). Contact: contact@aaryainnovations.com.

1. Scope

This Privacy Policy describes how Vaidya collects, uses, stores, and protects information about you when you use the Vaidya portal at https://www.vaidyalegal.com (the "Service"). It applies to all customers of the Service in the United States.

If you upload Protected Health Information ("PHI") as defined under HIPAA, our handling of that PHI is additionally governed by our Business Associate Agreement, which controls in the event of any conflict.

2. Information We Collect

2.1 Account information

When you create an account, we collect:

• Your full name
• Email address
• Role (attorney, doctor, or staff)
• Firm or practice name (optional)
• Password (stored as a salted hash by Amazon Cognito; we never see your plaintext password)

2.2 Customer Data

When you submit a case, we receive and process:

• Medical records, billing records, imaging reports, and other documents you upload
• Case metadata you provide (client name, date of injury, case type, notes)
• Earnings questionnaire data (only if you request a Loss of Earnings section)
• IME-specific metadata (only if you request an IME Records Review)

Where Customer Data contains Protected Health Information, our Business Associate Agreement governs its handling in addition to this Privacy Policy.

2.3 Usage and audit data

We automatically record:

• Sign-in events and IP addresses (for security)
• Page views and actions taken within the portal
• Case status changes and report deliveries
• Acceptance of legal agreements (timestamp, IP address, typed name)
• Error reports and system performance metrics

This data is used for security, audit compliance, and improving the Service.

2.4 Payment information

When you submit a case for payment, Stripe collects your payment card information directly. We do not receive your full card details. We receive from Stripe only:

• A Stripe customer or payment intent identifier
• The amount charged
• The result of the charge (success, decline, refund)

Stripe's handling of payment information is governed by Stripe's own privacy policy.

2.5 Cookies

We use cookies and similar technologies to:

• Keep you signed in (session cookies)
• Remember your preferences
• Capture referral codes when you arrive via a referral link
• Measure aggregate usage patterns

We do not use cookies for advertising. We do not allow third-party advertising cookies on the Service.

3. How We Use Your Information

We use the information we collect to:

• Deliver the Service you request — process records, generate analyses, deliver reports
• Bill you for the work performed
• Secure the Service — detect and prevent unauthorized access, fraud, and abuse
• Maintain audit trails required by HIPAA and other applicable laws
• Communicate with you — send transactional emails (report ready, payment receipts, account notices) and operational updates
• Improve the Service — analyze aggregate, de-identified patterns to improve accuracy and add features
• Comply with our legal obligations — respond to lawful requests from regulators, courts, and law enforcement

We do not use your Customer Data to:

• Train AI models that benefit other customers
• Sell or rent to third parties
• Send marketing communications without your consent

4. How We Share Your Information

We share information only with the parties below, and only as necessary to provide or support the Service.

4.1 Service providers (subprocessors)

We use the following providers, each subject to written confidentiality and HIPAA-equivalent terms where applicable:

• Amazon Web Services, Inc. — hosting, storage, database, and infrastructure. AWS has a Business Associate Agreement with us.
• Anthropic, PBC — AI model inference for medical records analysis. Subject to HIPAA-equivalent terms.
• OpenAI, L.L.C. — AI model inference for certain analysis tasks. Subject to HIPAA-equivalent terms where applicable.
• Stripe, Inc. — payment processing. Stripe does not receive PHI. Stripe receives only opaque case identifiers and amounts.
• Google LLC (Maps and related APIs) — limited use for facility location lookups during records normalization. PHI is not transmitted.

We update this list when we add or change subprocessors. Material changes are notified through the portal or by email.

4.2 Legal disclosures

We may disclose information if required to do so by law, subpoena, court order, or other valid legal process; or to protect our rights, property, or safety, or those of others. Where permitted, we will notify you of any compelled disclosure before complying.

4.3 Business transfers

If Vaidya is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any successor will be bound by this Privacy Policy with respect to your information, or you will be notified of and able to object to any material change.

4.4 With your consent

We may share information for other purposes with your express consent.

5. How We Protect Your Information

We implement administrative, physical, and technical safeguards consistent with the HIPAA Security Rule (45 CFR Part 164, Subpart C), including:

• Encryption in transit (TLS 1.2 or higher) for all data moving between your device and our servers
• Encryption at rest (AES-256) for stored data
• Access controls limiting access to authorized personnel under written confidentiality obligations
• Audit logging of all sensitive data access
• Workforce training on HIPAA Privacy and Security Rule requirements
• Vulnerability management including regular security patches and dependency monitoring

No system is perfectly secure. We do not guarantee absolute security, but we work to maintain protections appropriate to the sensitivity of the data we handle.

6. How Long We Keep Your Information

6.1 Customer Data

We retain Customer Data only as long as necessary to provide the Service and to allow you reasonable time to download your Report Output. Specifically, where Customer Data is PHI, input materials are securely deleted within thirty (30) days of report delivery. Report Output remains available to you through the portal for the duration of your account.

6.2 Account information

We retain your account information for as long as your account is active. When you close your account, we delete your account information within thirty (30) days, except where retention is required by law or for legitimate business purposes (such as fraud prevention).

6.3 Operational and audit data

We retain operational and audit records for six (6) years from the date of creation, as required by 45 CFR § 164.530(j). These records do not include the contents of your Customer Data after deletion.

6.4 Payment records

Payment transaction records are retained for the period required by applicable tax and financial regulations (typically seven years).

7. Your Rights and Choices

7.1 Access and correction

You may access your account information at any time through the portal. To request correction of inaccurate information you cannot edit yourself, contact us at contact@aaryainnovations.com.

7.2 Deletion

You may request deletion of your account and associated personal information by contacting us. We will honor deletion requests within thirty (30) days, except where retention is required by law. Some operational records (audit logs required by HIPAA) cannot be deleted on request.

7.3 Export

You may export your Report Output by downloading it from the portal. To request an export of additional information we hold about you, contact us.

7.4 Marketing opt-out

We do not send marketing emails by default. If we ever do, every such email will include an unsubscribe link, and unsubscribing will not affect transactional emails (report-ready, payment receipts).

7.5 California, Virginia, Colorado, Connecticut, and Utah residents

If you are a resident of a state with a comprehensive privacy law, you may have additional rights, including the right to know what personal information we collect about you, the right to delete that information, the right to correct inaccuracies, and the right to non-discrimination for exercising these rights. To exercise these rights, contact us at contact@aaryainnovations.com. We will verify your identity before responding to your request.

7.6 No "sale" of personal information

We do not sell personal information as defined under applicable state privacy laws.

8. Children's Privacy

The Service is intended for use by licensed professionals over the age of 18. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly. Note: medical records you upload may contain information about pediatric patients of the practices you represent; that information is treated as Customer Data and protected accordingly.

9. AI and Automated Processing

The Service uses artificial intelligence and large language models to analyze your Customer Data and generate Report Output.

9.1 What this means

• AI processes the documents you upload to extract, normalize, and summarize medical information
• AI-generated output may contain errors and should be independently reviewed before relying on it
• We do not use your Customer Data to train AI models that benefit other customers
• We may use de-identified data to evaluate and improve the AI components of the Service

9.2 Human review

Vaidya analysts review Report Output before delivery. Your Customer Data is therefore visible to a small number of authorized Vaidya personnel under written confidentiality obligations.

10. International Transfers

The Service is intended for customers in the United States. Our infrastructure is located in U.S. AWS regions. If you access the Service from outside the United States, you acknowledge that your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the portal or by email and, where required, will request your renewed acceptance before continuing to process your data. Continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy.

12. Contact

Questions about this Privacy Policy or our handling of your information? Contact us:

Aarya Innovations LLC

Privacy Officer

contact@aaryainnovations.com