Privacy Policy

Alpha Human Global Private Limited, a company incorporated under the Companies Act, 2013, with CIN U86905MH2026PTC470037 and its registered office at 901, Raheja Eternity, A Wing, Magathane, Thakur Village, Kandivali East, Mumbai – 400101, Maharashtra, India, and its corporate office at A-621, ATS Bouquet, Sector 132, Noida, Uttar Pradesh – 201304, India ("Alpha Human", "Company", "we", "us" or "our"), respects your privacy. This Privacy Policy ("Policy") explains what personal data we collect when you visit www.alphahuman.in, use our mobile application or engage with any of our health, wellness, diagnostic, genetic or coaching offerings (together, the "Services"), why we collect it, who we share it with, how long we keep it and what choices you have.

We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"). We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they continue to apply.

This Policy forms part of, and should be read with, our Terms of Use. Capitalised words not defined here carry the meaning given to them in the Terms of Use.

Please read this Policy carefully. Where we rely on your consent, we will ask for it through a clear, separate consent notice before or at the time of collection. You may withdraw consent at any time as explained in Section 8. If you do not agree with this Policy, please do not use the Services.

Health information disclaimer. Reports, scores and recommendations we generate are meant to help you understand your wellness and lifestyle. They are not a medical diagnosis or a substitute for advice from a registered medical practitioner.

In this Policy:

• "Personal Data" means any data about you that identifies you or can be used, alone or with other data, to identify you.
• "Health Data" means information about your physical, physiological or mental health, medical history, symptoms, prescriptions, lab and blood reports, vitals, body measurements, sleep, nutrition and fitness information, and data from connected wearables.
• "Genetic Data" means information derived from analysis of your DNA, including from saliva, swab or blood samples, and the raw and interpreted results of that analysis.
• "Sensitive Data" collectively means Health Data, Genetic Data, biometric information, financial and payment instrument details, passwords, and any data treated as "sensitive personal data or information" under applicable law.
• "Sample" means any biological specimen you provide to us or our partner laboratories, such as saliva, blood or a swab.
• "Processing" means any operation on Personal Data, including collection, recording, storage, use, analysis, sharing, transfer and erasure.
• "Data Processor" means a person or entity that processes Personal Data on our behalf and on our instructions.
• "Platform" means our website, mobile application, and any other digital interface we operate to offer the Services.
• "User" or "you" means any person who visits, registers on or uses the Platform or Services.

We collect only what we need to deliver and improve the Services. The table below lists each category and where it comes from.

Payment card details. We do not store full card numbers, CVV or net-banking passwords. These are entered directly on the PCI-DSS compliant pages of our payment gateway.

Information about others. If you share data about a family member or another person (for example, to buy a test for them), you confirm that you have their consent, or are their parent or lawful guardian.

If you choose not to share. Some data is essential to deliver a Service (for example, a Sample for a genetic test). If you do not provide it, we may be unable to provide that Service.

We process your Personal Data on one of two grounds under the DPDP Act: your consent, or a legitimate use permitted by law (for example, a purpose for which you voluntarily gave us the data, or compliance with a legal obligation).

What we will not do. We will not sell your Personal Data. We will not use your Health Data or Genetic Data for advertising targeting. We will not share identifiable Genetic Data with insurers or employers. We will not use your Sample or Genetic Data for research in identifiable form without your separate, specific consent.

Automated tools. Some recommendations are generated by algorithms or AI-assisted tools. A qualified team member reviews outputs that form part of a paid report or plan. You may ask for human review of any recommendation.

We share Personal Data only on a need-to-know basis, under written contracts that require confidentiality and security. Recipients may include:

1. Healthcare and wellness professionals engaged by us, such as doctors, nutritionists, genetic counsellors, coaches and psychologists, to deliver your plan or consultation.
2. Partner laboratories (NABL-accredited where applicable) and Sample collection and logistics partners. For DNA tests, the laboratory receives your Sample with only your Kit ID, name, sex and age. We work with more than one laboratory and testing service provider for DNA tests, and your Sample, the DNA extracted from it and related data may be processed in India or at facilities outside India, as explained below. For all other laboratory tests, such as blood and omega tests, the partner laboratory or its collection staff collects your Sample directly from you, including at your home. It receives your name, age, sex, phone number, address and the tests ordered, so that it can schedule the collection, carry out the tests and send you your report, and it may contact you directly for these purposes.
3. Technology providers for cloud hosting, data storage, communications (email, SMS, WhatsApp), customer support tools, and analytics.
4. Payment gateways and banks to process payments and refunds.
5. Professional advisers such as auditors, lawyers and insurers of our business, under confidentiality.
6. Your nominee or authorised representative, where you have appointed one.
7. Corporate or institutional partners, only where you joined through an employer, insurer or other sponsored programme. They receive aggregated or de-identified reports unless you separately consent to sharing your individual results.
8. Government and law enforcement authorities, when required by law, court order, or to protect the safety of any person.
9. A successor entity in a merger, acquisition, restructuring or sale of assets. We will notify you before your data becomes subject to a different privacy policy.

Our Data Processors may only use your data to perform services for us. They may not use it for their own purposes, except that a partner laboratory may keep test records for as long as the law that applies to it requires.

De-identified and aggregated data. We may share statistical or aggregated information that cannot reasonably identify you, for research, publications or business purposes.

Storage and cross-border transfer. Your account data, reports and Health Data are primarily stored on servers located in India. Some of our service providers may process data outside India. In particular, your Sample, the DNA extracted from it, and the resulting Genetic Data may be processed by our laboratories and testing service providers at facilities outside India, with your explicit consent given at the time of ordering. When this happens: (a) any facility outside India receives only your Kit ID, name, sex and age (the minimum details needed for analysis), never your contact details, address or payment information; (b) transfers are made only to countries not restricted by the Government of India under the DPDP Act, and in compliance with Indian law on the export of human biological material; (c) every laboratory involved is bound by written contracts requiring confidentiality, security, use only for your test, no onward transfer, and destruction of your Sample and data on our instructions; and (d) Alpha Human remains responsible to you for how your Sample and data are handled. Data protection laws in other countries may differ from those in India. We will tell you, on request, which countries your Sample may be sent to.

We carry out scientific research to improve health and wellness insights, alone or with academic institutions, hospitals, and research or life-science companies ("Research Partners"). Research uses de-identified data, as described below.

1. Consent. When you consent to a DNA test, you also agree that we may use your Genetic Data and Health Data, in de-identified form, for research and development, including scientific research and publication of aggregate findings. We will ask for your separate consent before using your leftover Sample or DNA, or your identifiable data, for research.
2. What is used. De-identified genotype or sequence data, and questionnaire and Health Data you have shared with us. Leftover Sample material and DNA extracted from it are used only with your separate consent.
3. De-identification. Before research use, we remove direct identifiers such as name, phone, email and address, and replace them with a code. The key linking the code to you is kept separately, under restricted access, within Alpha Human.
4. Ethics and oversight. Research involving human samples or data is carried out only after approval from a registered Institutional Ethics Committee. It follows the ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants and other applicable law.
5. Sharing with Research Partners. We share only de-identified or aggregated data, under written agreements that prohibit re-identification, onward sale and use beyond the approved study. Identifiable data or Samples are shared only if you give separate consent for that specific study.
6. Biobanking. With your consent, residual Samples and DNA may be stored in coded form for the period stated in Section 7, for future research approved by an Ethics Committee.
7. Re-contact. If you agree, we may contact you about new studies or follow-up questions. You can decline each time.
8. Findings. Research results are generally reported in aggregate and are not returned to individuals. Research findings are not clinically validated diagnoses.
9. Commercial use. Research may lead to new products, publications or intellectual property. You will not receive payment or a share of any commercial benefit from them.
10. Withdrawal. You can withdraw consent to research use at any time by writing to privacy@alphahuman.in or through your account settings. We will stop using your Sample and data in new research, and destroy your stored Sample and coded data within 60 days. Data already de-identified and included in completed analyses or publications cannot be withdrawn.

How long we keep data. We keep Personal Data only for as long as the purpose for which it was collected is being served, or as long as law requires.

The retention periods for Biological Samples above apply to DNA tests. Samples for other laboratory tests are kept and discarded by the partner laboratory as required by the law that applies to it. When the retention period ends, we erase or irreversibly anonymise the data. Where we intend to erase data because you have been inactive, we will give you advance notice where the law requires it, so you can log in or ask us to keep it.

How we protect data. We use reasonable security practices consistent with ISO/IEC 27001 principles. These include encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, coding of Samples, audit logging, vulnerability testing, and confidentiality agreements with staff and vendors.

No system is completely secure. You are responsible for keeping your password confidential and logging out of shared devices.

Data breaches. If a personal data breach occurs, we will act promptly to contain it. We will notify the Data Protection Board of India, CERT-In and other authorities as required by law, and inform affected Users without undue delay. We will tell you what happened, the likely impact, and the steps you can take to protect yourself.

Subject to applicable law, you have the right to:

1. Access a summary of the Personal Data we hold about you, how we process it, and the categories of persons we have shared it with.
2. Correct, complete or update inaccurate or incomplete data.
3. Erase your data when it is no longer needed for the purpose for which it was collected, unless we must keep it by law.
4. Withdraw consent at any time. Withdrawal is as easy as giving consent: use the in-app settings or write to us. It does not affect processing already done. If you withdraw consent for an essential purpose, we may be unable to continue that Service.
5. Opt out of marketing by clicking "unsubscribe" in any email, replying STOP to SMS/WhatsApp, or writing to us.
6. Nominate a person who can exercise your rights if you die or become incapable of doing so.
7. Raise a grievance with us, and if you are not satisfied with our response, approach the Data Protection Board of India.

How to exercise your rights. Write to our Data Protection Officer at privacy@alphahuman.in. We may ask you to verify your identity. We aim to respond within 30 days.

Your duties. Under the DPDP Act, you must give accurate information, not impersonate anyone, and not file false or frivolous complaints.

Children. We provide Services, including DNA tests, to children under 18 only with the verifiable consent of a parent or lawful guardian, who consents and exercises the child's rights on the child's behalf. Before processing a child's personal data, we verify the identity and adult age of the parent or guardian through a government identity document or another reliable method permitted by law. For an adult under lawful guardianship, we also verify the guardian's appointment. We do not track or behaviourally monitor children, and we do not direct targeted advertising at them. If you believe we hold a child's data without such consent, please contact us and we will delete it.

We serve all users from India, including those who live in other countries. If you are outside India, we courier a collection kit to you and you return your Sample to India as instructed. Your Sample is tested by our laboratories and testing service providers, some of which may carry out part of the processing outside India (see Section 5). Your account data and reports are stored mainly in India, and counselling is provided online from India. By ordering, you understand that your Sample and data will travel to India, and may travel from India to another country, protected as described in this Policy.

Rights under your local law. If the law where you live gives you rights beyond those in Section 8, we will honour them. These may include the right to receive a portable copy of your data, to opt out of targeted advertising or profiling, to limit the use of sensitive data, or to appeal a refusal of your request. We will not treat you less favourably for exercising any of these rights. Please make requests as described in Section 8.

Our commitments wherever you live. We do not sell Personal Data, and we do not sell or share Health Data or Genetic Data for advertising. We ask for your express consent (separately, where local law requires it) before using Genetic Data for research, transferring it to anyone other than our service providers, or storing your Sample beyond what your test requires. If you revoke that consent, we destroy your Sample within 30 days where local law requires it, and otherwise within the period stated in Section 6. Where local law requires, we also honour browser-based opt-out signals such as Global Privacy Control, and provide any additional privacy notice that applies in your jurisdiction.

We use cookies, pixels and software development kits (SDKs) to run and improve the Platform.

• Essential cookies keep you logged in, secure your session and remember your cart. They cannot be switched off.
• Analytics cookies help us understand how visitors use the Platform (for example, Google Analytics).
• Preference cookies remember settings such as language.
• Advertising cookies measure campaigns and show relevant ads on other sites (for example, Meta Pixel, Google Ads).

Non-essential cookies are set only after you accept them in our cookie banner. You can change your choice at any time through the cookie settings link in the footer, or through your browser settings.

The Platform may link to third-party websites, apps or devices, such as wearables or social media. Their privacy practices are governed by their own policies, not this Policy. Please review them before sharing data.

We may update this Policy to reflect changes in law or our practices. The "Last updated" date at the top shows when it was last revised. If changes are material, we will notify you by email or in-app notice, and seek fresh consent where the law requires.

We will acknowledge your grievance within 48 hours and resolve it within 30 days of receipt.

Contact the Data Protection Officer for requests to access, correct or erase your data, to withdraw consent, or for any questions about how we process your Personal Data.

Escalation. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India in the manner prescribed under the DPDP Act.

This Policy is governed by the laws of India. Subject to the dispute resolution provisions of our Terms of Use, the courts at New Delhi shall have exclusive jurisdiction.