Privacy Policy & Data Governance Framework

Effective Date: November 28, 2025

Version: 2.0

Entity: Biolynk Technologies Pvt. Ltd.

1. PREAMBLE & COMMITMENT

At Biolynk Technologies (“Biolynk,” “we,” “us,” or “our”), we operate at the intersection of human physiology and digital intelligence. We recognize that health data is the most sensitive asset a person possesses.

This Privacy Policy outlines our proprietary framework for the collection, processing, storage, and protection of data across our digital ecosystem, including the MedixCamp platform, WoundAI diagnostic stack, Project Aura/GlycoSense AI architecture, and ProFlex mobility systems.

We are committed to a “Privacy by Design” philosophy, ensuring compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and aligning with global standards such as HIPAA (Health Insurance Portability and Accountability Act) for clinical data integrity.

2. DEFINITIONS

To ensure scientific clarity, we define key terms as follows:

  • “Biological Data”: Raw physiological signals (e.g., PPG waveforms, bio-impedance values) and clinical imagery (e.g., wound photographs).
  • “Data Principal”: The individual to whom the personal data relates (i.e., the patient, user, or clinician).
  • “Data Fiduciary”: Biolynk Technologies, which determines the purpose and means of processing personal data.
  • “De-Identification”: The technical process of removing direct identifiers (Names, ABHA IDs) from data sets to prevent re-identification.
  • “Edge Processing”: The processing of data locally on the user’s device (smartphone or sensor) before transmission to the cloud.

3. DATA ACQUISITION PROTOCOLS

We collect specific categories of data strictly for defined medical and operational purposes.

A. For Project Aura & GlycoSense AI (Metabolic Health)

  • Physiological Telemetry: Continuous time-series data including Interstitial Fluid Glucose estimations, skin temperature gradients, and bio-impedance spectroscopy readings.
  • Contextual Metadata: Activity levels (accelerometry), sleep duration, and user-logged nutritional intake to train the Personalized Metabolic Profile.
  • Device Diagnostics: Sensor calibration status, battery voltage, and Bluetooth signal strength.

B. For WoundAI (Computer Vision Diagnostics)

  • Clinical Imagery: RGB images of wounds captured via the mobile application.
  • Morphometric Data: Computed dimensions (Surface Area, Perimeter, Depth Proxy) and tissue classification scores (Granulation/Slough/Necrosis %).
  • Safety Redaction: Our algorithms are designed to automatically detect and blur faces or tattoos inadvertently captured in wound images to preserve anonymity.

C. For MedixCamp (Public Health Logistics)

  • Identity Data: Name, Age, Gender, and National IDs (Aadhaar/ABHA) for patient registration.
  • Clinical Vitals: Blood Pressure, BMI, SpO2, and Random Blood Sugar (RBS) recorded during screening.
  • Geo-Tagging: Aggregate location data for disease prevalence mapping (Heatmaps). Note: Precise location is used only for logistics and is not permanently linked to patient health records.

4. PURPOSE OF PROCESSING

We process data solely for the following scientific and operational objectives:

  1. Clinical Decision Support: To provide real-time diagnostic insights (e.g., predicting a hypoglycemic event or flagging a stalled wound).
  2. Algorithmic Training (R&D): We use De-Identified and Aggregated data to refine our Deep Learning models (e.g., improving the segmentation accuracy of WoundAI). No raw personal data is fed into global models.
  3. Public Health Governance: To generate anonymized epidemiological reports for Government Health Missions and CSR partners (e.g., “Diabetes prevalence in District X”).
  4. Operational Continuity: To facilitate inventory management, patient referrals, and longitudinal follow-up within the MedixCamp ecosystem.

5. DATA SECURITY ARCHITECTURE

We employ a defense-in-depth security strategy:

  • The Vortex Protocol: For Project Aura, physiological data is encrypted at the sensor level using a proprietary encapsulation method before transmission, preventing “Man-in-the-Middle” attacks.
  • Encryption Standards: All data at rest (stored in databases) is encrypted using AES-256 (Advanced Encryption Standard). Data in transit is secured via TLS 1.3 (Transport Layer Security).
  • Role-Based Access Control (RBAC): Access to data is strictly siloed. A database administrator cannot view clinical images; a clinician cannot view backend system logs. Access is granted on a “Need-to-Know” basis.
  • Data Sovereignty: All health data for Indian citizens is hosted on MeitY-empanelled cloud servers physically located within India, complying with data localization mandates.

6. DATA SHARING & DISCLOSURE

We do NOT sell, trade, or rent personal health data to advertisers or third parties. Disclosure occurs only in the following controlled scenarios:

  • Clinical Referrals: With explicit user consent, diagnostic reports are shared with referral hospitals or specialists via secure digital channels.
  • Government Integration: MedixCamp data may be synced with the Ayushman Bharat Digital Mission (ABDM) stack (e.g., linking records to a user’s ABHA ID) strictly in accordance with government protocols.
  • Legal Mandates: We may disclose data if required by law, court order, or government regulation, ensuring that such disclosure is limited to what is legally necessary.

7. USER RIGHTS (Data Principal Rights)

In accordance with the DPDP Act, 2023, you hold the following rights:

  1. Right to Access: You may request a summary of all personal data we hold about you.
  2. Right to Correction: You may request the correction of inaccurate or misleading health data.
  3. Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data, provided it is not required for ongoing medical treatment or legal compliance.
  4. Right to Grievance Redressal: You have the right to register a complaint regarding our data processing activities.

8. CONSENT ARCHITECTURE

  • Explicit Consent: We utilize a “Consent Artifact” mechanism. Before collecting sensitive health data (e.g., taking a wound photo), the app requires explicit, verifiable consent from the user.
  • Withdrawal of Consent: Users may withdraw consent at any time via the app settings. Upon withdrawal, we will cease processing the user’s data and anonymize existing records, unless retention is required by law.

9. CONTACT & GRIEVANCE OFFICER

For any privacy-related concerns, data access requests, or security reports, please contact our designated Data Protection Officer (DPO): Priyanka

Grievance Officer: [Dr. Mohit Naren K, Head of Operations]

Email: founder@biolynktech.com

Address: Biolynk Technologies Pvt Ltd., Station Road, Chirala, Andhra Pradesh – 523157.

This policy is subject to periodic review to align with evolving medical regulations and technological advancements. Last updated: November 2025.

Scroll to Top