How Aaumai Healthcare Solutions PVT LTD collects, uses, and protects your information
Last Updated: 8 November 2026
Aaumai Healthcare Solutions PVT LTD (“Aaumai”, “AUM AI”, “we”, “us”, “our”) makes Aumy, software for healthcare clinics. Aumy covers patient records, appointments, billing, telehealth, an AI receptionist on WhatsApp, Facebook, Instagram and phone calls, patient reminders and follow-ups, and tools that help a clinic run its own Facebook and Instagram posts and Meta ads.
This policy explains what information we collect through our website (aumai.co.in), our apps (such as aumy.aumai.co.in and the Aumy mobile app) and the services we provide to clinics (“clinic customers”). It explains how we use that information, who we share it with, how long we keep it, and your rights.
For visitors to our website, people who fill in our forms, and people who buy from our website, Aaumai is the data controller (a “Data Fiduciary” under India’s Digital Personal Data Protection Act 2023).
For data inside Aumy that belongs to a clinic, the clinic is the data controller and Aaumai is its data processor. This includes patient records, appointments, clinical notes, messages, call recordings, leads, and the data that comes from the clinic’s own connected Facebook Page, Instagram account, WhatsApp number and Meta ad account. We process it only to provide the service to that clinic, under our agreement with the clinic. That is a data-processing agreement under India’s DPDP Act 2023 (and, where they apply, the UAE PDPL, Dubai Health Authority rules, or a Business Associate Agreement under HIPAA).
If you are a patient, or you messaged a clinic or filled in a clinic’s form, please send requests about your data to that clinic. If you write to us, we will pass your request to the clinic.
From website visitors: the name, email, phone number, clinic or company name and message you send through our forms; details of a purchase you make on our website (the payment itself is handled by Razorpay); and the visit data described in Section 12 (Cookies and analytics).
From clinic staff who log in to Aumy: name, work email, phone number, role, the clinic you belong to, login details (hashed password, two-factor secrets), and session and audit logs. If a staff member connects the clinic’s Facebook Page, Instagram account or Meta ad account, we also keep that person’s Facebook user ID (the ID Meta gives our app for that person) and Facebook name with the connection, so we can act on a Meta deletion request (Section 6).
Patient data we process for clinics: identifiers (name, date of birth, gender, contact details, record numbers, and government IDs such as Aadhaar or PAN when the clinic enters them), clinical data (diagnoses, treatments, medicines, allergies, lab orders, notes, images, care plans), appointments, billing and insurance details, and AI drafts that refer to these.
WhatsApp messages: messages and templates the clinic sends to patients, replies and voice notes patients send to the clinic’s WhatsApp number, delivery and read status, and opt-out records, so we never message a patient who has opted out. If a person reaches the clinic by tapping a click-to-WhatsApp ad, Meta also tells us which ad it was (the ad ID and a click ID).
Facebook and Instagram messages: when a person sends a direct message to a clinic’s connected Facebook Page or Instagram account, Meta sends that message to us. We keep the message, the sender’s Meta-scoped ID (Page-Scoped ID or Instagram-Scoped ID), and, where the person’s privacy settings allow, their public name, Instagram username and profile picture link. We do not get a phone number this way. If the person wants to book, we ask them for a phone or WhatsApp number.
Lead Ads (instant forms): when a person fills in a lead form on one of the clinic’s own Facebook or Instagram ads, Meta tells us, and we fetch the answers they gave (usually name, phone number and email, plus any questions the clinic added). The lead goes into that clinic’s Aumy account only.
The clinic’s own Facebook and Instagram posts: once a day we read the clinic’s recent posts (caption, link, picture link and date). We store them in the clinic’s account and use AI to sort each post by topic.
The clinic’s Meta ad account: the clinic’s campaigns, ad sets, ads, budgets and status, and daily ad results (such as reach, clicks, cost, conversations and leads). This includes Meta’s summary breakdowns by age group, gender, region and placement. These are totals from Meta, not data about individual people.
Phone calls: when a clinic uses the Aumy voice receptionist, we process the caller’s phone number, the live call audio, a written transcript and a recording of the call.
Telehealth: video and audio of telehealth visits, live transcripts, and a recording when recording is switched on and the patient has agreed.
Where India’s DPDP Act, the UAE PDPL, the EU GDPR or similar laws apply, the basis for using data depends on the kind of data:
We share data only with the providers below, and only what each needs to do its job for us. We do not sell personal data to anyone.
AI and your data: messages, call audio and transcripts, and the patient and clinic details needed to answer (for example, a patient’s name and upcoming appointments) are sent to the AI provider as they are. We do not remove names or numbers first. Under the terms of AWS Bedrock and Anthropic’s API, they do not use this data to train their models. The Aumy mobile app tells clinic staff about this and asks for their agreement before its AI features are used. Patients who chat with or call a clinic’s AI receptionist are told it is an AI when they ask.
Each provider works under its own published data-protection terms. A current list is available on request from the contact email at the bottom of this page.
Our Meta app is “AUM AI Platform” (App ID 2067787743777563). A clinic chooses which of its Meta accounts to connect. Each connection is used only to provide Aumy to the clinic that connected it.
(a) Facebook Page and Instagram account. A clinic staff member connects the clinic’s Page and linked Instagram professional account with Facebook Login for Business. We request these permissions:
(b) Meta ad account. A clinic connects its ad account with Facebook Login for Business (permissions ads_management, ads_read and business_management), or adds AUM AI’s business as a partner on its ad account. We use this to list the clinic’s ad accounts and pixels, create and change the clinic’s campaigns, ads and lead forms, pause or start them, and read daily ad results, including Meta’s summary breakdowns by age group, gender, region and placement. We act only on the ad account the clinic chose.
(c) Conversions API. When a clinic switches this on, we send one kind of event to the clinic’s own Meta pixel (dataset): a “Lead” event. We send it only for a new enquiry that came from one of the clinic’s own Meta ads (a click-to-WhatsApp ad or a lead form), that is not an existing patient, and that looks ready to book. The event carries the person’s phone number, email and first name, each scrambled with SHA-256 hashing before it leaves our servers, and a hashed reference number. Where we have them, it also carries the Meta click ID or Meta lead ID, and the IP address and browser details captured with the enquiry. It never carries treatments, appointments, payments, amounts or any health information.
(d) WhatsApp Business Platform. Some clinics connect their WhatsApp number to us through Meta’s Embedded Signup (permissions whatsapp_business_management and whatsapp_business_messaging). Other clinics’ WhatsApp accounts sit in AUM AI’s Meta Business Manager and are run through MSG91. Through the Cloud API and these providers we send and receive the clinic’s WhatsApp messages, receive delivery and read status, and create and update message templates and check whether Meta approved them.
How we use and protect Meta data: only to provide Aumy to the clinic that connected the account. We never sell it, never use it for our own advertising, and never share it with or use it for another clinic. Access tokens are encrypted (AES-256-GCM) before they are stored. We check the signature on every webhook Meta sends us.
How to remove our access: in Aumy, use Disconnect for the Facebook Page / Instagram account or the Meta ad account. We stop using the connection and delete its stored access tokens. You can also remove “AUM AI Platform” in Facebook: Settings & privacy → Settings → Business integrations. Meta then tells us, and we disconnect the connections made with your login and delete their access tokens.
How to ask for deletion: in Facebook, go to Settings & privacy → Settings → Business integrations (or Apps and websites), find “AUM AI Platform”, remove it, and choose to send a data-deletion request. Meta sends us a signed request. We then, in one step, disconnect the Facebook Page, Instagram and ad-account connections made with your Facebook login, delete every access token stored for them, and remove your Facebook user ID and name from our connection records. We record the request under a random confirmation code and give Meta a link to a status page: https://aumy.aumai.co.in/api/v1/whatsapp-automation/meta/data-deletion/status/<confirmation code>. That page shows when the request was received and completed. See our data-deletion page for details.
A request made through Facebook is about the person who logged in to our app with Facebook, usually a member of the clinic’s staff. Messages, leads and posts a clinic received through its connected accounts are that clinic’s data. They stay in the clinic’s Aumy account until the clinic deletes them, and people who messaged a clinic or filled in a clinic’s form should ask the clinic (Section 1).
Clinics can connect their own Google Business Profile to Aumy with Google sign-in (OAuth). Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
Our database and app servers are in AWS Mumbai (ap-south-1). Some providers process data outside India: AI requests through AWS Bedrock may be handled in other AWS regions, Anthropic’s API, Google’s Gemini models and Deepgram are hosted outside India, and Meta’s platforms are global. These transfers happen only as needed to deliver the service, under each provider’s data-protection terms, and only to countries not restricted under the DPDP Act.
Deleting a record inside Aumy marks it deleted first (a “soft delete”) so the audit history stays intact. Full removal happens when the clinic asks or when its data is deleted at the end of the service.
Data is encrypted in transit (TLS 1.2 or higher) and at rest (database and file storage). Provider keys and access tokens (including Meta and Google tokens) are also encrypted with AES-256-GCM using a separate key before they are stored. Passwords are hashed with bcrypt, and staff can turn on two-factor login. Each user sees only what their role allows, and changes to clinical data are logged. Each clinic’s data is kept apart at the database level, so a user of one clinic cannot read or change another clinic’s data, even through direct API calls.
Depending on where you are (India DPDP Act, UAE PDPL, EU GDPR, US state laws), you may have the right to access, correct or erase your personal data, to restrict or object to its use, to take a copy, to withdraw consent, to nominate someone to act for you, and to complain to the data-protection authority (in India, the Data Protection Board of India). For patient data we process for a clinic, please contact the clinic first. It is the data controller and can act on your request, and we help it do so. For anything else, contact us at the address below.
Our website is not directed at children. Clinics may hold records of child patients in Aumy. In that case the clinic is the data controller and is responsible for the consent of a parent or guardian.
Our own analytics: our website stores an anonymous visitor ID in a cookie so we can recognise a returning visit, and records the pages you view, the time spent on each and an approximate city and state worked out from your IP address. This does not identify you by name, and our team may be told about visits as they happen.
Meta Pixel and Conversions API (our own ads): our website loads our own tracking tag, which also loads the Meta Pixel. It tells Meta about page views and actions such as sending a form, starting a checkout or making a purchase, from your browser and from our server through Meta’s Conversions API, so we can measure and improve our own ads on Facebook and Instagram. When you type a phone number, email or name into a form on our website, it may be sent to Meta to match the visit to a Meta account. Meta’s Pixel and our server scramble (hash) these details before they are sent. You can control ads based on this in your Facebook settings (Ad preferences). This applies to our own website only. Nothing inside Aumy, and no clinic or patient data, is sent to our own Meta Pixel.
Embedded videos: some pages show videos from YouTube, which may set its own cookies when you play them.
Inside Aumy: the clinic app uses only the cookies and storage needed for logging in. No advertising trackers are loaded inside Aumy.
We may update this policy. The “Last Updated” date at the top shows the latest change. If a change affects how patient data is processed, we will tell clinic customers in writing.
For questions about this Privacy Policy, to use your rights under data-protection law, or to raise a grievance, please contact our Grievance Officer, Jayesh Chaudhari (Founder, AUM AI), who will respond within the time the law requires:
Aaumai Healthcare Solutions PVT LTD
Email: jayesh.chaudhari@aumai.co.in
Website: https://aumai.co.in