Privacy Policy

Last updated 14 October 2026

This policy explains what personal data Udyamik collects when you use our platform, why we collect it, how long we keep it, who we share it with, and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

In this policy, “Udyamik”, “we”, “us”, or “our” refers to Udyamik Technologies Private Limited, the data fiduciary under the DPDP Act. “You” refers to the data principal: the person whose personal data is being processed (a school administrator, teacher, parent, or student). It also means a person whose data is on the platform without them having used it: a family member whose health record someone keeps on their behalf is a data principal in their own right, with the rights set out in §9.

1. Who we are

Udyamik is a multi-tenant software platform for Indian SMB education, finance and allied verticals. Our first product is EduSuite, a school-management application. Our registered details are:

Legal name: Udyamik Technologies Private Limited
Trading as: Udyamik
Registered address: Munshi Ray Lane, Moti Chauk, Nagar Panchayat Saraiya, Muzaffarpur, Bihar, India
Primary contact: privacy@udyamik.com

2. What personal data we collect

We collect the following categories of personal data:

Identity data: first name, last name, 10-digit Indian mobile number, email address, role inside your organisation.
Academic data: APAAR ID (if you provide it), admission number, class / section / academic session, attendance, exam marks, term results, report cards.
Payment data: fee invoices, payment method (cash, cheque, UPI, card, NetBanking, Razorpay), receipt numbers, transaction reference numbers. Card / UPI credentials themselves are captured and stored directly by Razorpay: we never see or store them.
Communication data: WhatsApp / SMS / email send events (timestamps, template key, delivery status). We store a SHA-256 hash of the recipient phone / email plus a masked tail showing only the last four digits (••••••3210) or, for email, the domain and first characters. The full number or address is never stored. The masked tail exists so we can investigate a specific delivery complaint: “my OTP never arrived” is unanswerable from a hash alone, which can only confirm a number we already have.
Device & technical data: client-generated device id (per “trusted device” registration), platform (Android / iOS / Web), IP address at last login, one-way-hashed PIN (Argon2id), JWT-session metadata.
Sign-in history: for each sign-in, the time, how you signed in (a code to your mobile or email, a PIN, or Google) and the kind of device: the Android app, or a browser on a phone, tablet or computer, with the browser's name, the operating system family and the app version where there is one. The browser's full identification string and your IP address are not kept with it. You can see your own last ten sign-ins under My account.
Document vault: documents you upload to your personal vault (e.g. Aadhaar, PAN, address proof, scholarship certificates) are stored encrypted at rest.
Health & family data (only if you use the personal health record): the family members you add and how they are related to you, their date of birth, sex, blood group, allergies, ongoing conditions and ABHA number where you enter one; the medical reports you upload; the lab values taken from those reports, together with the reference range the lab printed beside them; and the medicines you record, in the wording of the prescription. This is the most sensitive category we hold, and §8 sets out separately how it is handled.
Audit data: immutable log of sensitive mutations (fee waivers, role changes, report publishes), along with the user id, IP and device id of the actor.

We deliberately do not collect: passwords (our platform has none, see §11), full card numbers, precise GPS location, biometric data, or browsing behaviour outside Udyamik.

3. Why we collect it

Personal data is collected for the following specific, limited purposes:

To register and operate your tenant (school / lender / clinic).
To process admissions, fees, attendance, exams and reports.
To send transactional notifications to parents and staff (fee reminders, attendance alerts, report publications) on channels you have opted into at the tenant level.
To keep a personal and family health record for you: storing the reports you upload, reading the values off them for your own review, and producing a printable summary you can hand to a clinician.
To provide audit trails for financial and academic compliance.
To fulfill our obligations under the Companies Act, 2013 and the Indian Income Tax Act, 1961 (retention of financial records).
To detect and prevent fraud, abuse and security incidents.

4. Legal basis for processing

Under the DPDP Act and applicable law, we rely on the following grounds:

Contract: for data processing necessary to deliver the Udyamik service you have subscribed to (e.g. raising invoices, sending receipts).
Consent: for optional processing such as parent-communication campaigns outside the transactional flow, marketing opt-ins, and uploads to your personal document vault.
Legal obligation, where Indian law requires retention (tax records, DPDP audit trails).
Legitimate use (DPDP Act §7): for security, fraud prevention, and the narrow categories the Act expressly permits.

For the personal health record we rely on your own explicit choice to enter the data: nothing is collected unless you upload it or type it. Where the record is about another adult in your family rather than about you, the basis on which we process it is being confirmed with our legal counsel, and will be published here before the health record is offered to anyone outside our pilot. We have not stated one here rather than state one we are not certain of.

5. How long we retain it

Identity & academic data: for the lifetime of your Udyamik account, plus 90 days after account closure (grace period for restoration).
APAAR ID: for the lifetime of the account; deletion on request sets it to NULL and removes it from logs.
Payment records & platform invoices: 8 years from the end of the financial year (Income Tax Act §44AA + §44AB retention norms).
Communication events (WhatsApp / SMS / email logs): 12 months. We keep the current calendar month plus the previous eleven, and drop whole months beyond that on the 1st. Raw recipient phone / email is never stored. Each record keeps a SHA-256 hash and a masked tail (last four digits only), which is enough for us to investigate a delivery complaint and not enough to reconstruct the number, though in a small organisation four digits together with a timestamp may be enough to tell who a message was for.
Audit log: 24 months.
Device-bound PIN hashes: deleted when the device is revoked or after 30 days of inactivity.
Sign-in history: kept for the lifetime of your account. No automatic expiry is built for it yet.
Health & family records: kept until you ask us to delete them. You should know exactly what removal does today: taking a family member off your tree is a soft archive: the entry stops being visible to you, and their reports and values are retained in our database rather than erased. Automated hard deletion is not built yet (§8). Until it is, a deletion request is carried out by hand on request to privacy@udyamik.com. The retention period we will commit to is being confirmed with our legal counsel, and will be published here before the health record is offered to anyone outside our pilot.

We do not sell your personal data. We share it only with the following categories of processors, each bound by contract or by the DPDP Act's data-processor obligations:

Razorpay Software Private Limited: payment processing. Razorpay privacy policy.
Meta Platforms Ireland Limited. WhatsApp Business Platform message delivery. WhatsApp Business policy.
Your school / tenant administrators: the school that invited you into a tenant has access to the data you produce inside that tenant (grades, attendance, fee status). This is a feature of the platform, not a sharing decision by Udyamik.
Lawful authorities: only when compelled by a valid legal process under Indian law.

No AI provider is on that list, and that is deliberate. Every AI feature in Udyamik — answering a question, reading a photographed invoice — runs on models we host ourselves. There is no third-party model provider, no API key to one, and no request that carries your data to one. Until September 2026 the Sahayak App could be configured to use OpenAI; that option has been removed from the software, and the application now refuses to start if it is pointed at a hosted model provider at all.

None of the processors above receives your health record. Not Razorpay and not Meta — reports are read on our own server, and the Sahayak AI App cannot read the health record at all. See §8.

7. Where it is stored

All primary data is stored on servers physically located in India (currently Hostinger VPS, Mumbai region). Backups are encrypted at rest and retained in the same jurisdiction. We use AES-GCM with a 128-bit authentication tag to encrypt sensitive tenant configuration at rest (see our security overview for details).

Where a sub-processor's infrastructure is cross-border (e.g. Meta), data transfers are governed by that processor's own data-transfer controls; we share only the minimum necessary to complete the request. AI processing is not in this category: it happens on our own infrastructure and crosses no border.

8. The personal health record

Udyamik can keep a health record for you and for the family members you look after: the reports a hospital or lab hands you, the values printed on them, and the medicines someone is taking. It is the most sensitive data on the platform, so it is described separately here rather than folded into the sections above.

What the software cannot do

These are properties of how the product is built, not undertakings about how we intend to behave. Each one is a constraint in the code rather than a policy someone could quietly relax:

No third party receives your reports or your values. A digital PDF report is read on our own server by an open-source library (Apache PDFBox) that makes no network call of any kind. No page image, no value, no file name and no patient name leaves our infrastructure, not to a model provider, not to an OCR service, not to any processor listed in §6. Since September 2026 this is enforced rather than promised: the software refuses to start if it is configured to send anything to a hosted model provider.
Nothing is used to train a model. This follows from the line above: data that is never sent anywhere cannot train anything. Your reports are not training data, and there is no setting under which they become training data.
Nothing is read into your record automatically. A value appears in the record only after you have seen the proposed reading side by side with the page it came from and accepted it. The software will not add a value on its own, and will not calculate a value the lab did not print.
We never interpret a result. Udyamik produces no diagnosis, no opinion and no “normal / abnormal” judgement of its own. Where a value is shown as out of range, the range it was compared against is the laboratory's own, taken from your report: we never substitute a reference range of ours, and where a report printed none, none is shown. This software is not a medical device.
No public links. There is no shareable URL for a report, a value, or a printed health card. Every read of a stored file is authenticated as you; a leaked link cannot exist because none is ever issued.
No organisation on the platform can see it. A school, lender or clinic you belong to cannot read your health record. It is held against you rather than against any organisation, in the platform's own schema outside every App's data, and every read of it is authorised against your ownership of the record. There is no organisation-scoped query that returns it, and reads across that boundary are prohibited outright rather than merely unused.
No clinician can see it today. The mechanism that will let you grant a named doctor time-limited access has not been built. Until it ships there is no route by which any clinic can reach your record. When it does ship, access will require an explicit grant that you can withdraw, and this policy will be updated before the feature is switched on for anyone.
Every export is recorded. When you download a printable summary we log that it happened, which member, when, and at whose request, so the record itself shows where copies have been made. What you then do with a printed or forwarded copy is outside our systems and outside our control; a summary handed to a hospital is a paper document like any other.

A record you keep for someone else

Most people who use this will hold a record for a parent, a spouse, or a child as well as for themselves. Two things follow from that, and both work in favour of the person the record is about:

They are a data principal in their own right, whether or not they have ever opened Udyamik. The rights in §9 are theirs, not yours. They can exercise them by writing to privacy@udyamik.com directly, and where their instruction about their own data conflicts with yours, we act on theirs.
If they later register with their own mobile number, the record becomes theirs to control, and the access you had to it becomes something they can withdraw.

Who is responsible for it

Which party is the data fiduciary for a health record: us, or the person whose record it is, and the same question for a patient record inside a clinic that uses Udyamik, is being confirmed with our legal counsel, and will be published here before the health record is offered to anyone outside our pilot. The practical position meanwhile is the one described above: we hold the data, we disclose it to nobody, and you can have it deleted by asking us.

Deleting it

As §5 says, removal is a soft archive today and an automated hard-deletion path does not exist yet. We would rather say that plainly than imply an erasure the software does not yet perform. A request to privacy@udyamik.com is carried out by hand, and the automated path is on our roadmap ahead of any wider release of this feature.

9. Your rights

Under the DPDP Act, you have the right to:

Access the personal data we hold about you.
Correct inaccurate or out-of-date data.
Erase your personal data (subject to retention obligations: see §5 and our data-deletion page).
Port your data (receive a machine-readable export).
Withdraw consent where processing was consent-based.
Nominate a representative to exercise these rights on your behalf in the event of incapacity or death (DPDP §14).

To exercise any of these rights, email privacy@udyamik.com. We respond within 30 days.

10. Children's data

Udyamik processes data about children (students under 18) only through their school (the tenant), which acts as verifiable parent-consent gatekeeper under DPDP §9. We do not create direct-to-student accounts for minors; a minor appears in our database only as a record attached to a tenant that has received parent consent through its own offline admission process.

One exception has to be named, because the sentence above was written before the health record existed: an adult using the personal health record (§8) can add their own child as a family member and keep that child's reports there. Such a record is not attached to any school and reaches us only because a parent or guardian put it there, which is the same parental consent DPDP §9 requires, but it does not pass through a tenant, so the “only through their school” description does not cover it. A minor cannot hold their own Udyamik account either way.

We never use children's data for advertising, profiling, or tracking.

11. Security measures

Our security posture is documented in full at /legal/security. The headline controls:

No passwords: authentication is OTP + device-bound Argon2id PIN.
TLS 1.3 in transit for every connection.
AES-GCM encryption at rest for tenant secrets (Razorpay keys, Meta access tokens and app secrets).
Row-Level Security (RLS) on every tenant-scoped database table.
Immutable audit log on sensitive mutations.
Rate limiting on all public endpoints.

12. Cookies

The marketing site at udyamik.com sets no cookies at all. The application at app.udyamik.com uses strictly-necessary cookies for authentication and CSRF protection. We do not use analytics or advertising cookies. Full details: /legal/cookies.

13. Changes to this policy

We may update this policy to reflect changes in law, our services, or our practices. Material changes will be notified via email to account holders and by a prominent banner on app.udyamik.com at least 15 days before they take effect. The “Last updated” date at the top of this page always reflects the most recent revision.

14. Grievance Officer

Per DPDP §10 and the IT Intermediary Rules 2021 §3(2), our designated Grievance Officer is:

Name: Will be published before public launch.
Designation: Grievance Officer
Email: grievance@udyamik.com
Phone: +91 99017 26296
Response SLA: 15 working days (per DPDP Act §10)

The dedicated grievance procedure: escalation, acknowledgement template, and redress path: is documented at /legal/grievance.

15. Last updated

This Privacy Policy was last updated on 5 September 2026. Prior versions are available on request.