Legal

Privacy Policy

Last updated: 23 August 2026

This Privacy Policy explains how Kayalog Innovations Private Limited ("Kayalog", "we", "us") collects, uses, stores and protects personal data. It covers our website at www.kayalog.co.in and our products, currently Tiveqo and PHYSIO.CARDS.

We are an Indian company and our services are offered to businesses and individuals in India. This policy is written in line with the Digital Personal Data Protection Act, 2023 (the "DPDP Act").

1. The two roles we play

Depending on the data in question, we act in one of two capacities under the DPDP Act. This distinction matters, because it determines who you should contact about your data.

• As a Data Fiduciary — for data whose purposes we decide ourselves: our business customers' account and billing details, enquiries sent to us, and the profile information a physiotherapist chooses to publish on PHYSIO.CARDS.
• As a Data Processor — for data our business customers put into our products about their patients and customers. Here the business (for example, a physiotherapy clinic) is the Data Fiduciary. We process that data only on their instructions, in order to provide the product to them.

If you are a patient whose details are held in Tiveqo by a clinic, that clinic is responsible for your data. Please contact the clinic directly. If you contact us instead, we will pass your request on to them.

2. Information we collect

From our business customers

• Name, email address, phone number and role
• Clinic or business name, address and operating details
• Login credentials and authentication data
• Subscription plan, invoices and payment status
• Support messages and correspondence with us

On behalf of our business customers

When a clinic uses Tiveqo, it records information about its patients. We store and process the following on the clinic's behalf:

• Patient name, contact number and basic demographic details
• Appointment dates, times and assigned practitioner
• Physiotherapy assessments, treatment plans and progress notes
• Attendance and visit history

From website visitors

Our website is a static marketing site. We do not use analytics, tracking cookies or advertising cookies of any kind. Our hosting provider keeps standard server logs, which may include your IP address, browser type and the pages you requested. If you email us or use the contact page, we receive whatever you choose to send us.

On PHYSIO.CARDS

A PHYSIO.CARDS card is public by design. The photo, qualifications, specialities, clinic address, hours and contact links you add are visible to anyone who opens your card link or scans your QR code. Please publish only details you are comfortable sharing publicly.

3. WhatsApp messaging

This feature is not currently enabled in our products. This section describes how we will handle data if and when a business chooses to use it.

Where a business connects its own WhatsApp Business number to one of our products, we process the following on that business's instructions, so that it can send messages such as appointment confirmations to its own customers:

• Recipient phone numbers
• The content of messages sent or received through the product
• Delivery, read and failure receipts
• Message template names and metadata
• Records of consent (opt-in) captured by the business

Where the business continues to use the WhatsApp Business app on the same number alongside our product, WhatsApp also shares with us that business's contact list, up to 180 days of prior message history, up to 14 days of prior media, and copies of messages the business's own staff send from their phone. This is required for the feature to work, and the business is asked to approve it during setup.

How we use data from Meta. We use WhatsApp Platform Data only to provide the service to the business that authorised it, in line with Meta's Platform Terms and Developer Policies. We do not combine it across customers, sell it, use it for advertising, or use message content to train artificial intelligence models.

We provide WhatsApp messaging only as a feature of our own products. We do not offer WhatsApp API access as a standalone service to third parties.

4. Artificial intelligence

Tiveqo can generate a written summary of a physiotherapy assessment when a clinician asks it to. To do this, the assessment text is sent to Google Cloud Vertex AI, listed in section 6, which processes it within India (asia-south1, Mumbai).

• Only the assessment text needed for the summary is sent
• Summaries are generated on request, never automatically in the background
• Your data is not used to train AI models
• A generated summary is a clinical aid and does not replace the clinician's own judgement

We do not run AI over patient contact details, billing data or message content.

5. How we use information

• To provide, operate and maintain our products
• To authenticate users and keep accounts secure
• To process subscriptions and issue invoices
• To provide support and respond to enquiries
• To detect, prevent and investigate misuse or security incidents
• To meet our legal and regulatory obligations

We do not sell personal data, and we do not use the data our customers store in our products for our own marketing.

6. Who we share data with

We share personal data only with the service providers we need in order to run our products, and where the law requires it. Our sub-processors are listed below, and kept up to date on our sub-processors page:

We may also disclose data where we are required to by law, by court order or by a lawful request from a government authority.

We never share one customer's data with another customer. Each clinic's patient records are kept separate, and are not combined, pooled or used to build profiles across businesses or products.

7. Where your data is stored

Our application data and files are hosted in India, in Google Cloud's Mumbai region (asia-south1). Some of the providers listed above may process limited data outside India in order to deliver their service — for example, WhatsApp message delivery. Where that happens, we share only what is necessary for that purpose.

8. How long we keep data

We may keep data for longer where the law requires it, or where it is needed to resolve a dispute. A business customer can ask us to delete their data sooner, subject to those obligations.

9. Security

• Data is encrypted in transit and at rest
• Access is role-based, so people see only what their role requires
• Each clinic's data is logically separated from every other clinic's
• Access to production systems is restricted to authorised personnel
• We will notify affected customers and the Data Protection Board without undue delay if a personal data breach occurs

No system is completely secure, but we take these safeguards seriously and review them as our products grow.

10. Your rights

Under the DPDP Act, you have the right to:

• Ask what personal data of yours we hold and how it is used
• Ask us to correct or complete inaccurate data
• Ask us to erase your data, where we are not required to keep it
• Withdraw consent you previously gave
• Nominate someone to exercise your rights if you are unable to
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if you are not satisfied

To exercise any of these, email grievance@kayalog.co.in. Where we hold your data on behalf of a clinic or business, we will forward your request to them, as they are responsible for deciding it.

11. Children

Our products are sold to businesses and are not directed at children. A clinic may record a patient who is a minor; where it does, the clinic is responsible for obtaining verifiable consent from a parent or guardian as the DPDP Act requires. We do not knowingly collect data directly from children.

12. Product-specific notes

Tiveqo

Tiveqo is clinic management software for physiotherapy practices. The clinic is the Data Fiduciary for its patient records; we act as its Processor. Patient data includes health-related information such as assessments and treatment plans, which we treat with corresponding care. Access is controlled per clinic and per role.

PHYSIO.CARDS

PHYSIO.CARDS is a personal digital card for individual physiotherapists. Here we are the Data Fiduciary for the account, and the card's contents are published publicly at the practitioner's own choice. You can edit or delete your card at any time; once deleted, the public link stops working.

13. Changes to this policy

We may update this policy as our products change. We will update the date at the top, and where a change materially affects how we handle your data, we will tell affected customers directly.

Contact

Kayalog Innovations Private Limited
CIN: U58200RJ2026PTC113628
Registered office: E 476, Lalkothi Scheme, Behind Vidhan Sabha, Jaipur 302015, Rajasthan, India
Email: hello@kayalog.co.in
Phone: +91 85609 04656

Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer with any question or complaint about how we handle your personal data. We aim to acknowledge every request within 7 working days.

Kishan Maheshwari
Email: grievance@kayalog.co.in
E 476, Lalkothi Scheme, Behind Vidhan Sabha, Jaipur 302015, Rajasthan, India