Privacy Policy

Aroviah — A Curabridge LLP Venture Care Beyond Borders

Last Updated: July 2026

Introduction and Scope
Who We Are
Personal Data We Collect
Sensitive and Medical Data
How We Collect Data
How and Why We Use Your Data
Legal Bases and Consent
Who We Share Your Data With
Cross-Border Data Transfers
Data Retention
Data Security
Your Rights
Cookies and Website Analytics
Children's Data
Marketing Communications
Data Breach Notification
Changes to This Policy
Grievance Officer and Contact Us

1. Introduction and Scope

1.1. This Privacy Policy ("Policy") explains how Aroviah, operated under Curabridge LLP ("Aroviah," "we," "us," or "our"), collects, uses, stores, shares, and protects personal data — including medical data — when you visit aroviah.com (the "Website"), create an account, submit a medical inquiry, or otherwise engage Aroviah's Medical Value Travel coordination services (collectively, the "Services").

1.2. This Policy applies to Patients, Attendants, prospective patients making inquiries, and casual visitors to the Website. It should be read together with Aroviah's Terms and Conditions, which it forms part of by reference.

1.3. Aroviah primarily serves international patients traveling to India from the GCC, Africa, and CIS regions, as well as patients from other parts of the world. Depending on your country of residence, additional local data protection rights may apply to you beyond those described here; nothing in this Policy limits any such rights.

2. Who We Are

2.1. Aroviah is a Medical Value Travel (MVT) facilitator operated under Curabridge LLP. Aroviah is not a hospital, clinic, or healthcare provider, and does not itself deliver clinical care. Clinical care is delivered exclusively by independent, third-party hospitals and licensed medical professionals ("Partner Hospitals").

2.2. For the purposes of applicable data protection law, Aroviah generally acts as the Data Fiduciary (or equivalent, e.g. "controller") in respect of the personal data it collects to coordinate your Services, and shares relevant data with Partner Hospitals, Referral Partners, and government authorities strictly as needed to deliver those Services, as described in Section 8.

3. Personal Data We Collect

3.1. Identity and contact data: full name, date of birth, gender, nationality, passport details, photograph, phone number, email address, WhatsApp number, and home address.

3.2. Account data: login credentials, account preferences, and communication history with Aroviah.

3.3. Travel and visa data: passport scans, visa application details, travel itineraries, accommodation preferences, and details of any Attendants accompanying you.

3.4. Financial data: billing details, payment confirmations, and transaction records related to the Service Fee and Treatment Package (Aroviah does not directly store full payment card numbers, which are processed by our payment processors).

3.5. Medical data: described separately in Section 4, given its sensitivity.

3.6. Technical data: IP address, browser type, device identifiers, and usage data collected when you use the Website (see Section 13).

3.7. Communications: records of calls, emails, WhatsApp messages, and other correspondence between you and Aroviah, Partner Hospitals, or coordinators, kept for continuity of care and quality purposes.

4. Sensitive and Medical Data

4.1. To coordinate your treatment, Aroviah collects and processes sensitive medical information, which may include: medical history, diagnostic reports, laboratory results, imaging (e.g., scans, X-rays), physician notes, current medications, allergies, and other health information you or your referring physician provide.

4.2. Medical data is collected only where reasonably necessary to identify suitable Partner Hospitals and specialists, coordinate consultations, and support your treatment journey. It is shared only with the Partner Hospitals and specialists directly involved in evaluating or treating you, and with other parties only as described in Section 8 or with your specific consent.

4.3. By submitting medical records or information to Aroviah, you provide explicit consent for Aroviah to process this sensitive data for the purposes described in this Policy. You may withdraw this consent at any time by contacting support@aroviah.com, subject to Aroviah's ability to continue coordinating any treatment already in progress.

4.4. Aroviah does not sell, rent, or use your medical data for advertising or marketing purposes, and does not share it with Partner Hospitals or third parties beyond what is necessary to coordinate your care.

5. How We Collect Data

5.1. Directly from you: when you fill out an inquiry form, create an account, upload medical records, communicate with a coordinator, or make a booking.

5.2. From Attendants or authorized representatives: where a family member, caregiver, or representative submits information on your behalf, as permitted under Section 1.3 of the Terms and Conditions.

5.3. From Referral Partners: travel agencies, insurance agencies, or community contacts may pass along your contact details and initial inquiry with your consent, so that Aroviah can follow up with you directly.

5.4. From Partner Hospitals: where a hospital shares updated medical reports, consultation notes, or treatment plans with Aroviah for the purpose of coordinating your journey.

5.5. Automatically: through cookies and similar technologies when you browse the Website (see Section 13).

6. How and Why We Use Your Data

We use your personal and medical data to:

Evaluate your medical inquiry and coordinate specialist consultations and second opinions with Partner Hospitals;
Prepare and present Treatment Package cost estimates;
Coordinate Medical Visa and Medical Attendant Visa applications, including preparing Hospital Invitation Letters;
Arrange travel, accommodation, airport transfers, and local transportation;
Provide on-ground patient coordination and interpreter support during your stay in India;
Coordinate discharge planning, recovery, and post-treatment follow-up;
Communicate with you about your engagement, including administrative and payment matters;
Maintain internal records for continuity of care, quality assurance, and legal compliance;
Improve the Website and our Services; and
Comply with applicable law, including visa, tax, and healthcare-related recordkeeping obligations.

7. Legal Bases and Consent

7.1. Aroviah processes your personal data primarily on the basis of your consent, given when you submit an inquiry, create an account, or otherwise engage our Services, and, where applicable, on the basis that processing is necessary to perform our coordination services for you.

7.2. Aroviah may also process limited data where necessary to comply with a legal obligation (for example, retaining records requested by visa or tax authorities) or to protect your vital interests in an emergency.

7.3. Where required by applicable law, Aroviah will provide a specific notice describing the personal data being collected and the purpose of collection, at or before the point of collection.

8. Who We Share Your Data With

We share personal and medical data only as necessary to deliver the Services, including with:

Partner Hospitals and specialists, to evaluate your case and coordinate your treatment;
Referral Partners (such as travel agencies, insurance agencies, or community contacts), limited to information necessary to manage the referral relationship;
Government and visa authorities, including Indian diplomatic missions and immigration authorities, strictly for the purpose of processing Medical Visa and Medical Attendant Visa applications;
Travel and accommodation providers, including airlines, hotels, and ground transportation providers, limited to information necessary to complete bookings;
Payment processors, to process payments of the Service Fee and related costs;
Interpreters and on-ground support staff, where needed to assist during your treatment journey; and
Professional advisors, auditors, or regulators, where required by law or to protect Aroviah's legal rights.

8.2. Aroviah does not sell your personal data to third parties. Where Aroviah receives a referral commission from a Referral Partner or Partner Hospital in connection with your engagement, this is a business arrangement disclosed in our Terms and Conditions and does not involve the sale of your personal data.

8.3. Each third party listed above is responsible for handling your data in accordance with its own privacy practices once it receives that data for its own independent purpose (for example, a hospital's own medical recordkeeping, or an airline's own booking systems), and you are encouraged to review those third parties' privacy policies where relevant.

9. Cross-Border Data Transfers

9.1. Because Aroviah coordinates care between international patients and Partner Hospitals in India, your personal and medical data will necessarily be transferred to and processed in India, and may also be transferred to other countries where a Partner Hospital, travel provider, or government authority relevant to your journey is located.

9.2. Aroviah takes reasonable steps to ensure that any cross-border transfer of your data is made only to parties who need it to deliver the Services, and in a manner consistent with applicable data protection law, including the DPDP Act's requirements for transfers of personal data outside India.

9.3. If you are located in a jurisdiction with its own cross-border transfer requirements (for example, the EU/UK), additional safeguards may be required before your data can be transferred to India; this section should be reviewed and expanded by legal counsel to address such requirements where relevant to Aroviah's patient base.

10. Data Retention

10.1. Aroviah retains personal and medical data for as long as necessary to provide the Services, to comply with legal, tax, visa, or healthcare-related recordkeeping obligations, and to resolve any disputes.

10.2. Where you do not proceed with treatment after an initial inquiry, Aroviah retains your data for a limited period in case you choose to re-engage, after which it is deleted or anonymized unless a longer retention period is required by law.

10.3. You may request deletion of your data at any time, as described in Section 12, subject to Aroviah's right to retain certain records where required by law or necessary to complete an in-progress treatment coordination.

11. Data Security

11.1. Aroviah takes reasonable technical and organizational measures — including access controls, encryption where appropriate, and staff confidentiality obligations — to protect your personal and medical data against unauthorized access, loss, misuse, or disclosure.

11.2. No method of transmission over the internet or electronic storage is completely secure, and Aroviah cannot guarantee absolute security of information transmitted to us, stored by us, or shared with third parties necessary to deliver the Services.

11.3. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying Aroviah at support@aroviah.com of any suspected unauthorized access to your account.

12. Your Rights

Subject to applicable law (including the DPDP Act, where applicable to you), you may have the right to:

Access a copy of the personal data Aroviah holds about you;
Correct inaccurate or incomplete data;
Withdraw consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal;
Request erasure of your data, subject to Aroviah's legal and operational retention needs described in Section 10;
Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, where recognized under applicable law; and
Lodge a complaint with Aroviah's Grievance Officer (Section 18) or, where applicable, with your local data protection authority.

To exercise any of these rights, contact support@aroviah.com. Aroviah will respond within a reasonable period, and in any event within the timeframe required by applicable law.

13. Cookies and Website Analytics

13.1. The Website uses cookies and similar technologies to remember your preferences, understand how visitors use the Website, and improve its functionality.

13.2. Categories of cookies used may include strictly necessary cookies (required for the Website to function), performance and analytics cookies, and, where used, marketing cookies. You can control or disable cookies through your browser settings, though this may affect certain Website features.

13.3. [This section should be expanded to list specific third-party analytics or advertising tools used on aroviah.com once finalized, along with a cookie consent banner compliant with applicable law.]

14. Children's Data

14.1. The Website and Services are not directed at individuals under 18. Where a Patient is a minor, all communications and data collection are directed to, and consented to by, that minor's parent or legal guardian, in accordance with Section 4.3 of Aroviah's Terms and Conditions.

14.2. Aroviah does not knowingly collect personal data directly from minors without verified parental or guardian consent.

15. Marketing Communications

15.1. With your consent, Aroviah may send you updates about our Services, relevant treatment information, or promotional communications by email, WhatsApp, or other channels.

15.2. You may opt out of marketing communications at any time by using the unsubscribe link provided or by contacting support@aroviah.com. Opting out of marketing does not affect operational communications necessary to coordinate your treatment journey.

16. Data Breach Notification

In the event of a personal data breach that is likely to result in harm to you, Aroviah will notify affected individuals and, where required by applicable law, the relevant data protection authority, without undue delay and in accordance with the timeframes prescribed by law.

17. Changes to This Policy

Aroviah may update this Policy from time to time to reflect changes in our Services, legal or regulatory requirements, or data practices. The "Last Updated" date at the top of this page reflects the most recent revision. For material changes that significantly affect your rights, Aroviah will make reasonable efforts to notify registered users directly, including by email.

18. Grievance Officer and Contact Us

If you have questions about this Policy, wish to exercise any of the rights described above, or have a grievance regarding the handling of your personal data, please contact:

Aroviah — A Curabridge LLP Venture Website: aroviah.com Email: support@aroviah.com Phone: +91 74458873330

"Care Beyond Borders" Curabridge LLP | Aroviah — A Curabridge Venture