Your privacy is
important to us.

Last updated: September 2026 · Rezov Technologies Pvt. Ltd. (“Jadhu”, “we”, “us”) · jadhuhealth.com

This Privacy Policy explains what information Jadhu collects when you use our platform, how we use and share it, and what rights you have. It applies to all Jadhu services — the mobile application, the VR platform, and any related services — whether you subscribe directly at jadhuhealth.com or enroll through a school, clinic, or hospital.

We have written this policy in plain language, for parents, caregivers, learners, therapists, and educators. Legal references are included where needed but do not obscure the plain meaning.

Rezov Technologies Pvt. Ltd. (“Jadhu”) is the company behind the Jadhu platform. We are registered in India and headquartered in Chennai, Tamil Nadu. We operate the Jadhu mobile application, the Jadhu VR platform, and the Jadhu web portal at jadhuhealth.com.

Jadhu is a digital life skills, behavioural support, and therapeutic programme platform for neurodivergent individuals. It is not a medical device and does not replace professional clinical diagnosis or therapy.

This policy applies to:

• Parents and guardians who subscribe to Jadhu or enroll their child through a school, clinic, or hospital
• Learners — children, teenagers, and adults who use the Jadhu platform under the supervision of a parent, therapist, educator, or institution
• Therapists, special educators, psychologists, and other professionals who use Jadhu with their clients
• Schools, clinics, hospitals, therapy centres, and NGOs that have a Jadhu institutional licence
• Visitors to jadhuhealth.com

Learners do not create their own accounts and do not use the platform independently. All Learner access is managed by a parent, guardian, institution, or therapist.

Jadhu’s responsibilities for your data depend on how you access the platform.

4.1 Information you give us

4.2 Session data collected automatically

When a learner uses the Jadhu platform, we automatically collect information about the session. This information is essential to provide the service — without it we cannot personalise the programme, track progress, or generate reports. It cannot be turned off.

• Which scenario or lesson was played and how far the learner progressed
• Task responses, accuracy scores, and performance on each skill domain
• Session start time, duration, and completion status
• Which daily programme the AI prescription engine selected, and the reason it was chosen
• Number of sessions completed in total and over recent periods
• Timestamps for interactions within the session
• Device type, operating system, and app version

4.3 Anxiety sensor data

The Jadhu anxiety wristband is an optical heart rate sensor worn on the wrist during sessions. It measures heart rate (BPM). Jadhu’s software analyses the learner’s heart rate pattern against their personal session baseline to detect signs of rising physiological stress. When the heart rate crosses a threshold above baseline, the platform flags an elevated anxiety state and may adjust the session pace or content.

• Heart rate readings (BPM) taken during the session
• Derived anxiety state indicators based on heart rate pattern analysis
• Session baseline heart rate and trend over time
• Timestamps of anxiety flag events during sessions

4.4 VR session data

When the Jadhu VR platform is used through a Meta Quest headset, additional data is generated:

• Spatial movement and body position data captured by the headset and any attached motion sensors during VR sessions
• Full sensory assessment protocol outputs — visual, auditory, and social environment tolerance — when this assessment is conducted at a clinical facility

4.5 Device and technical data

When you use the Jadhu app or visit jadhuhealth.com, we automatically receive:

• Device type, operating system, and app version
• IP address and approximate location derived from IP
• Browser type and language settings
• App performance data, crash reports, and error logs
• Push notification tokens and device time zone (used only to deliver notifications at appropriate times)

4.6 Cookies and website tracking

When you visit jadhuhealth.com or the Jadhu web portal, we use cookies and similar technologies to operate the platform and understand how it is used.

• Session cookies expire when you close your browser. They are used for login state and security.
• Persistent cookies remain after you close your browser. They are used for your preferences and aggregated analytics.
• Analytics tools such as Google Analytics collect page views, session duration, and device information in aggregated, de-identified form.

You can manage cookies through your browser settings. Blocking certain cookies may affect how the platform functions. When we detect a Do Not Track signal from your browser, we limit data collection to what is strictly necessary to operate the service.

4.7 What we do not collect

• Learner email addresses, phone numbers, or independent login credentials — learners do not have their own accounts
• Payment card numbers — these are handled by our payment provider and never stored by Jadhu
• Audio or video recordings — the microphone and camera on Meta Quest devices are not accessed by the Jadhu application unless you have separately opted in to a generative AI feature
• Cross-website browsing history for advertising purposes
• Any data that would allow us to commercially profile or advertise to learners

5.1 To deliver the service

• Personalise and deliver daily AI-prescribed sessions for each learner
• Generate session reports, domain score summaries, and monthly progress reports
• Send WhatsApp session updates to parents after each session
• Operate the parent dashboard, therapist dashboard, and institutional dashboard
• Use the anxiety sensor data to detect rising stress during sessions and adapt the content in real time

5.2 To improve the platform

• Analyse session data to improve content quality and AI prescription accuracy
• Train AI models — only with your explicit separate opt-in consent (see Section 10)
• Conduct anonymised research for clinical publications and policy submissions

5.3 For safety and compliance

• Detect and prevent fraudulent access, misuse, and security incidents
• Meet our legal and regulatory obligations under Indian and applicable international law
• Investigate and respond to data breach incidents

5.4 For communications

• Send session-related notifications and WhatsApp updates — these are part of the service and cannot be turned off without cancelling the service
• Send promotional communications where you have opted in — you can unsubscribe at any time
• Notify you of material changes to this policy or the platform

5.5 What we never do

• We never sell your personal data or your learner’s data to any third party
• We never use Learner data for advertising, commercial profiling, or targeted marketing
• We never market Jadhu directly to learners
• We never make fully automated decisions about a Learner’s clinical condition or therapeutic care without a parent or therapist involved

We process personal data only where a lawful basis applies.

7.1 Parents and guardians

Parents and authorised guardians have full access to their child’s session data, anxiety sensor trends, AI prescription outputs, and progress records through the parent dashboard at all times.

7.2 Therapists and educators

A therapist, special educator, or other professional authorised by the parent may access session reports, domain scores, anxiety sensor data, and prescription engine logic for the learners under their care. The parent grants and may revoke this access at any time through the parent dashboard.

7.3 Schools, clinics, and hospitals

When a learner is enrolled through an institution, authorised staff at that institution may access the learner’s progress data through the institutional dashboard. Access is limited to learners for whom verified parental consent has been obtained. Institutions are contractually prohibited from using Learner data for any purpose other than delivering the Jadhu programme.

7.4 Clinical and healthcare providers

In clinical deployment settings, Jadhu may share session reports and progress records with referring healthcare providers at the direction of the parent or the clinical institution, in accordance with applicable law.

7.5 Service providers and subprocessors

Jadhu engages third-party providers for cloud hosting, analytics, customer support, payment processing, and security monitoring. Every provider:

• Receives only the data necessary for their specific service
• Is contractually prohibited from using Jadhu data for their own purposes
• Is required to meet equivalent data protection and security standards
• Must securely delete or return data when their engagement ends

A list of Jadhu’s current subprocessors is available on request by emailing privacy@jadhuhealth.com.

7.6 Research partners

Only fully anonymised, aggregated data — from which no individual can be identified — is shared with research partners including PSG Hospitals, SRM Medical College, Sri Ramachandra Institute, Swabhimaan Trust, C-DAC, NIEPMD, and MeitY under Mission SIDDHI. No personally identifiable or pseudonymised data is shared with research partners. All research partners are bound by agreements that prohibit any attempt at re-identification.

7.7 Legal requirements

Jadhu may disclose personal data when required by law, court order, or regulatory requirement. Where legally permitted, we will notify you before disclosing your data.

7.8 Business transactions

If Jadhu is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction under appropriate legal protections. If the transaction does not complete, any shared data will be returned or securely deleted. We will notify users of any transaction that materially changes how their data is handled.

The Jadhu platform is designed for neurodivergent children and individuals. Children’s privacy is our highest priority.

8.1 Age requirements

8.2 Our commitments on children’s data

• All heart rate monitoring and AI prescription of children’s sessions is conducted for the learner’s therapeutic benefit, not for commercial profiling.
• No child’s data is shared with any advertising network or commercial data broker.
• Parents may withdraw consent and request full deletion of their child’s data at any time by emailing privacy@jadhuhealth.com.

8.3 Generative AI features

Certain optional Jadhu features use generative AI to deliver interactive conversational practice. These are not required to use the core Jadhu programme.

• Generative AI features are disabled by default for all learners under 13.
• For learners under 13, generative AI features can only be enabled after separate verifiable parental consent.
• Where generative AI features are active, audio or text inputs may be processed to deliver the interactive functionality.
• Parents may withdraw consent for generative AI features at any time from the parent dashboard. This does not affect access to standard Jadhu session content.

8.4 Applicable laws

• India — DPDP Act 2023 Section 9: all processing of children’s data is under verifiable parental consent with a legitimate educational and therapeutic purpose.
• India — RTE Act 2009: student data collected in school contexts is used only for educational purposes.
• United States — COPPA: verifiable parental consent is obtained before any data collection from children under 13.
• European Union and United Kingdom — GDPR Article 8: the age of digital consent (13–16 depending on the member state) applies. Parental consent is required for users below the relevant threshold.

9.1 When Jadhu is used through a school

When a school or educational institution has a Jadhu licence and enrolls learners:

• Jadhu acts as a service provider to the school for educational purposes.
• Student session data is used only for the educational and therapeutic purpose for which it was collected.
• Student data is never used for advertising or any commercial purpose.
• Parents may exercise rights (access, correction, deletion) directly with Jadhu or through the school.
• Schools outside India — such as Indian diaspora schools in the UK, US, or UAE — must also comply with local student data laws including FERPA (US) and UK GDPR (UK).

9.2 When Jadhu is used at a clinic or hospital

When Jadhu is deployed in a hospital, therapy centre, or clinical environment:

• The hospital or clinic may be the primary controller of patient records, with Jadhu acting as a service provider processing data only under the institution’s instructions.
• Clinical VR sessions at hospitals generate more detailed data (full sensory assessment protocol, therapist clinical notes) and require an extended clinical consent form signed by the parent.
• For institutions in the United States where HIPAA applies, Jadhu may act as a Business Associate and will process Protected Health Information only as permitted by law and under a Business Associate Agreement.
• Regulatory medical device data: if Jadhu’s VR clinical deployment is subject to CDSCO medical device classification in India or equivalent regulation internationally, certain safety and quality records may be required by law to be retained for defined periods, which may override a deletion request for that specific data. Jadhu will inform affected users if this applies.

9.3 Institutional devices and mobile device management

Institutions that deploy Jadhu on institution-owned devices may use Mobile Device Management (MDM) software to manage those devices, enforce security policies, and update the Jadhu application. Institutions must inform End-users and parents if their device is managed under MDM. Session data on institution-managed devices is subject to the same privacy protections as all Jadhu data.

10.1 Why we train AI models

Jadhu’s AI prescription engine, anxiety detection algorithm, and content recommendation system improve over time by learning from how learners engage with the platform. This training is what allows the AI to become more accurate at selecting the right session for each learner and at detecting when a learner’s heart rate indicates stress.

10.2 What data is used

10.3 What is never used for training

• Data from any learner whose parent has not given explicit AI training consent
• Therapist clinical notes or any free text entered by parents or therapists
• Raw heart rate data linked to an identifiable learner
• Full names, email addresses, or any directly identifying information
• Meta Quest device-level data, which Jadhu does not have access to

10.4 Three separate consents

The AI training consent screen shown at registration and at annual renewal presents three independently selectable opt-ins. You may accept any combination:

• Standard training: session scores, heart rate trends, prescription decisions — applies to all delivery modes
• Offline model training: session data from devices that operate without internet before syncing — used to improve the AI’s accuracy in low-connectivity environments
• VR clinical data training: spatial movement and sensory assessment data from clinical VR sessions at hospitals — this consent is only shown to users enrolled through a clinical facility

The consent screen is displayed in Tamil, Hindi, and English.

10.5 Withdrawing consent

You can withdraw AI training consent at any time: parent dashboard → Account → Data Preferences → AI Training Consent. Your withdrawal takes effect within 72 hours across all sessions. We must be honest about one technical reality: data that has already been incorporated into trained model weights cannot be extracted or deleted because of how machine learning works. However, from the moment you withdraw consent, no further data from your learner will be used in any training pipeline.

10.6 Federated learning

Where the Jadhu platform runs on a device without constant internet access, we use federated learning where technically possible. This means AI model training computations happen locally on the device and only mathematical updates — not raw session data — are transmitted to our servers. This approach provides the strongest available privacy protection for learners in low-connectivity settings.

10.7 Research

A separate research opt-in at registration allows anonymised, aggregated Jadhu data to be used in peer-reviewed clinical publications and policy submissions. All research data is fully anonymised to the standard that no individual can be identified. Research partners are contractually prohibited from attempting re-identification.

We take the security of learner data seriously. The following safeguards are in place:

• All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
• Data stored on institution or family devices before syncing to the cloud is encrypted using AES-256 on-device encryption.
• Access to personal data within Jadhu is restricted to authorised personnel on a need-to-know basis, with role-based access controls.
• Institutional and therapist dashboard access requires multi-factor authentication.
• Annual third-party security audits and penetration tests are conducted.
• We maintain incident response and data breach procedures.

If we become aware of a personal data breach, we will notify the Data Protection Board of India within 72 hours as required by the DPDP Act 2023 Section 8(6), and we will notify affected users promptly in plain language.

All personal data of users in India is stored on servers located within India, in compliance with the DPDP Act 2023. When data is replicated to off-site locations for backup and disaster recovery, it is stored under equivalent security standards.

• For users in the European Union or United Kingdom: data transfers from the EU/UK to India are conducted under Standard Contractual Clauses approved by relevant authorities, or other lawful transfer mechanisms under GDPR or UK GDPR.
• For users in the United States and other countries: data may be stored and processed in India. By using the Jadhu platform from outside India, you acknowledge that your data will be stored and processed in India under Indian data protection law.

Under the DPDP Act 2023 and applicable law, you — and if you are a parent, your child — have the following rights. All requests should be sent to privacy@jadhuhealth.com. We will respond within 30 days.

The Jadhu platform and website may link to or integrate with third-party services. This Privacy Policy applies only to data collected by Jadhu. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of:

• Meta Quest — the headset and operating system collect data under Meta’s own Privacy Policy
• Razorpay or other payment processors — process payment data under their own policies
• WhatsApp — session update notifications are sent via WhatsApp under Meta’s WhatsApp Privacy Policy
• Google Analytics — website analytics under Google’s Privacy Policy

In accordance with the DPDP Act 2023 and the Information Technology Act 2000, Jadhu has appointed a Grievance Officer:

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make material changes we will:

• Update the ‘Last Updated’ date at the top of this document
• Post the revised policy at jadhuhealth.com/privacy
• Show an in-app notification for material changes affecting how Learner data is handled
• Send an email notification to End-users for any material change to how heart rate data or AI training data is used

Your continued use of the platform after a revised policy becomes effective means you accept the updated policy.