Archived version. Read the current policy or view policy history.

Privacy Policy

Aroviah — A Curabridge LLP Venture Care Beyond Borders

Last updated: 17 September 2026

Privacy at a glance

  • We collect only the information needed to respond to enquiries and coordinate medical travel.
  • Medical information is used for care coordination and is shared only when necessary.
  • We do not sell or rent personal or medical data.
  • You can ask to access, correct, delete, or restrict your data, or withdraw consent.
  • Submit a request through our privacy request page or email support@aroviah.com.

What this policy covers

  • This policy applies when you visit aroviah.com, create an account, submit an enquiry, upload records, or use Aroviah's medical travel coordination services.
  • It covers patients, prospective patients, attendants, authorised representatives, and website visitors.
  • It should be read with our Terms and Conditions. Your local privacy laws may give you additional rights.

1. Who we are

  • Aroviah is a Medical Value Travel facilitator operated by Curabridge LLP.
  • Aroviah is not a hospital, clinic, or healthcare provider. Independent partner hospitals and licensed professionals provide all clinical care.
  • Aroviah generally acts as the Data Fiduciary (or controller) for information used to coordinate its services.

2. Information we collect

Depending on the service you use, we may collect:

  • Identity and contact details: name, date of birth, gender, nationality, address, photograph, passport details, phone, email, and WhatsApp number.
  • Account details: login information, preferences, and account activity.
  • Medical information: medical history, reports, test results, scans, physician notes, medications, allergies, and other health information you provide.
  • Travel information: passport scans, visa details, itineraries, accommodation preferences, and attendant details.
  • Payment information: billing details, confirmations, and transaction records. We do not directly store full payment-card numbers.
  • Communications: relevant calls, emails, WhatsApp messages, and correspondence with Aroviah, coordinators, or partner hospitals.
  • Technical information: IP address, browser, device, cookie choices, and website usage data.

3. How we collect information

We may receive information:

  • From you through forms, account registration, record uploads, bookings, and conversations with our team.
  • From an authorised representative or attendant acting on your behalf.
  • From referral partners when you have agreed that they may introduce you to Aroviah.
  • From partner hospitals when they provide treatment plans, consultation notes, or updated reports for coordination.
  • Automatically through necessary website technologies and, with your consent, analytics tools.

4. How we use information

We use personal and medical information to:

  • Review enquiries and coordinate consultations, second opinions, and treatment estimates.
  • Connect you with suitable hospitals and specialists.
  • Support medical visa documentation, travel, accommodation, transfers, and interpreters.
  • Coordinate admission, discharge, recovery, and follow-up.
  • Manage accounts, payments, enquiries, and service communications.
  • Maintain records for continuity, quality, security, dispute handling, and legal compliance.
  • Improve the website and our services using consented analytics.

Medical information

  • We process medical information only where reasonably necessary for your enquiry or treatment journey.
  • It is shared only with those directly involved in evaluating, arranging, or delivering the requested services, unless the law requires otherwise or you give specific consent.
  • We do not use medical information for advertising or marketing.

Automated tools and AI

  • Our current calculators and filters are rules-based, and hospital matching is staff-led.
  • Aroviah does not use AI to diagnose, prescribe, make final treatment decisions, or make solely automated decisions with legal or similarly significant effects.
  • If this changes, we will provide appropriate notice, human oversight, and a way to challenge the decision. See our AI Transparency Notice.

5. Our legal basis

We process information when:

  • You consent, including through a separate affirmative checkbox for medical enquiries.
  • It is necessary to provide the coordination service you requested.
  • We must meet a legal obligation, such as tax, visa, or recordkeeping requirements.
  • It is needed to protect someone's vital interests in an emergency.

Important consent safeguards:

  • Where required, a specific notice explains the information collected and its purpose at or before collection.
  • Consent for medical data, optional analytics, and marketing is separate from accepting the Terms.
  • We do not treat silence, inactivity, or pre-ticked boxes as consent.
  • We record the notice version, time, method, and privacy-minimised request evidence.
  • You may withdraw consent through the patient privacy centre or privacy request page. Withdrawal does not affect earlier lawful processing and may prevent us from continuing the requested coordination.

6. Who we share information with

We share only what is needed with:

  • Partner hospitals and specialists evaluating or treating you.
  • Referral partners where needed to manage an agreed referral.
  • Government, visa, diplomatic, and immigration authorities handling your application or travel.
  • Travel, accommodation, transport, interpreter, and on-ground support providers arranging requested services.
  • Payment processors handling transactions.
  • Cloud, messaging, email, and analytics providers operating the website and communications, including Meta/WhatsApp when you contact us through WhatsApp.
  • Professional advisers, auditors, regulators, or authorities where legally required or necessary to protect legal rights.

We do not sell personal data. Service providers acting only for Aroviah must follow our instructions and appropriate confidentiality, security, breach-support, deletion, and subprocessor requirements. A recipient using data for its own purpose—such as a hospital maintaining clinical records—also applies its own privacy practices.

Referral commissions from a partner hospital or referral partner are business arrangements disclosed in our Terms and do not involve selling your personal data.

7. International transfers

  • Coordinating international care normally requires information to be processed in India and sometimes in another country involved in your treatment or travel.
  • We limit transfers to recipients who need the information and take reasonable steps to meet applicable privacy law.
  • We check applicable Indian transfer restrictions. Where EU, EEA, UK, or other local law requires added safeguards, we will use them and provide further information on request.

8. Retention and deletion

  • We keep information only as long as needed for the service, legal compliance, disputes, or legitimate recordkeeping.
  • If an initial enquiry does not proceed, we keep it only for a limited re-engagement period unless the law requires longer retention.
  • Retention periods depend on the record type and events such as enquiry closure, treatment completion, payment, consent withdrawal, limitation periods, or the end of a vendor relationship.
  • Security and processing logs are kept for at least one year where the DPDP Rules require it, unless another law requires longer retention.
  • When retention ends, we delete or irreversibly anonymise active copies and instruct processors to do the same, subject to controlled backup expiry and legal holds.
  • We provide advance notice before erasure where applicable law requires it.
  • You may request deletion, but some records may need to be kept by law or while an active treatment journey is being completed.

9. How we protect information

  • We use proportionate safeguards such as access controls, encryption where appropriate, secure processes, and staff confidentiality obligations.
  • No internet transmission or electronic storage method is completely secure, so absolute security cannot be guaranteed.
  • Keep your login details confidential and report suspected unauthorised access to support@aroviah.com.

10. Your privacy rights

Depending on applicable law, you may ask to:

  • Access the personal information we hold about you.
  • Correct inaccurate or incomplete information.
  • Withdraw consent without affecting processing already lawfully completed.
  • Delete information, subject to legal and operational retention requirements.
  • Restrict or object to processing where the relevant law provides this right.
  • Nominate another person to exercise rights after your death or incapacity where recognised by law.
  • Complain to Aroviah or your competent data protection authority.

To make a request:

  • Use the privacy request form, which provides a reference number, or email support@aroviah.com.
  • Do not place medical records or identity documents in the public form.
  • We may verify your identity before disclosing, changing, or deleting information.
  • Our published grievance-response period is no more than 90 days, although we aim to respond sooner.
  • If a grievance remains unresolved, you may use the Data Protection Board of India's complaint mechanism when applicable or contact your local authority.

11. Cookies and marketing

Cookies and analytics

  • Strictly necessary technologies support website operation, security, and sessions.
  • Analytics technologies are used only after you consent through the privacy settings banner.
  • As of 31 July 2026, these may include Google Analytics 4 and Microsoft Clarity for aggregate or pseudonymised usage trends.
  • Use Cookie settings in the website footer to reject analytics or change your choice. Rejecting analytics does not prevent access to the service.

Marketing

  • With your consent, we may send service updates, treatment information, or promotions by email, WhatsApp, or another channel.
  • You can opt out through the unsubscribe option or by contacting us. You will still receive essential messages about an active enquiry or treatment journey.

12. Children's information

  • The website and self-service accounts are not directed to people under 18.
  • A parent or legally authorised guardian must manage the account and communications for a patient who is a minor.
  • We require verifiable parental consent and proportionate steps to confirm the parent is an identifiable adult before processing a child's information.
  • We do not use children's information for behavioural monitoring, targeted advertising, or processing likely to harm a child.
  • If information was submitted without the required verification, we will suspend processing and delete it unless retention is legally required.

13. Data breaches

  • We will contain and investigate a personal data breach and meet applicable notification duties.
  • Where the DPDP Rules apply, we will notify affected Data Principals without delay with the known nature, extent, timing, likely consequences, mitigation, protective steps, and a response contact.
  • We will also notify the Data Protection Board without delay and provide prescribed details within 72 hours, unless the Board allows more time.

14. Changes to this policy

  • We may update this policy when our services, laws, or data practices change.
  • The date at the top shows the latest revision.
  • We will make reasonable efforts to notify registered users of material changes that significantly affect their rights.

15. Contact and grievances

For questions, rights requests, or grievances, contact the person authorised to answer privacy questions for Aroviah:

This contact is not described as a statutory Data Protection Officer unless Curabridge LLP is required to appoint one and has formally done so.

Curabridge LLP | Aroviah — A Curabridge Venture