Privacy policy.

1. About this policy

Soham Enterprises (“Soham Enterprises”, “we”, “us” or “our”) provides AI automation to clinics, diagnostic centres and hospitals in India, including messaging services built on Meta's WhatsApp Business Platform. This policy explains what personal data we process, how and why we process it, who we share it with, where it is stored, how long we keep it, how we protect it, and how you can exercise your rights — including how to have your data deleted.

This policy is our notice under Section 5 of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and Rule 3 of the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”). It is also written to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”) for as long as they apply, the CERT-In Directions of 28 April 2022, and the Meta Platform Terms, Meta Developer Policies and WhatsApp Business terms that apply to us as a developer on Meta's platforms.

The DPDP Rules were notified in November 2025 and their obligations come into force in phases up to May 2027. We follow them now, ahead of those dates.

Words such as “Data Fiduciary”, “Data Processor”, “Data Principal”, “personal data”, “personal data breach” and “Consent Manager” have the meanings given to them in the DPDP Act. This policy is published in English. You can ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to info@sohamenterprises.co.in.

2. Who we are and our roles

Company

Soham Enterprises

GSTIN

27AAFPG0158A1ZD

Registered office

1, Sita Vihar Cottages, Behind Damani Estate, L.B.S. Road, Thane (West) 400602, Maharashtra, India

Phone

(022) 2545 3122 / (022) 2545 3126

Email

info@sohamenterprises.co.in

WhatsApp

+91 93231 88212

We process personal data in two different roles. Which role applies decides who is responsible for your data and where you should send a request.

• We are the Data Fiduciary for personal data we collect for our own purposes: visitors to this website, people who contact us or ask for a demo, and the staff of our customers who use our dashboard or deal with us about their account.
• We are a Data Processor for personal data we process on behalf of a clinic, diagnostic centre or hospital that uses our Services (a “facility” or “customer”). This includes patient data and the WhatsApp, Instagram and Facebook data the facility connects to our Services. The facility is the Data Fiduciary: it decides why and how that data is processed, gives patients the notices the law requires and is responsible for having a lawful basis, such as consent. We process that data only under a written contract with the facility, as Section 8(2) of the DPDP Act requires, and only on its documented instructions.

Our technology partner

We build and run the Services with technology from our technology partner, One Learning AI Private Limited (“One Learn AI”, onelearnai.com), an Indian healthtech company that provides the AI technology behind our agents and our hospital information system, OneMed HIS. Where One Learn AI processes personal data to provide that technology, it acts as our sub-processor: only on our instructions, under a written contract, and under the same obligations as this policy, the DPDP Act and the Meta Platform Terms. We remain responsible to you and to our customers for that processing.

When patients message a facility on WhatsApp, Meta provides the WhatsApp Business Platform. For the WhatsApp Cloud API, Meta also acts as a data processor on the facility's behalf. See section 6.

If you are a patient of a facility that uses Soham Enterprises, please contact that facility about your data first. If you contact us, we will pass your request to the facility promptly and help it respond.

Our websites and domains

Soham Enterprises provides its websites and Services on the following domains and all of their subdomains:

The domains onelearnai.com, onemedai.org and 1learn.ai are registered to One Learning AI Private Limited, our technology partner, which operates them. Wherever Soham Enterprises provides a website, application or service on any of these domains or their subdomains, including WhatsApp messaging through OneMed HIS, this policy applies to it. Questions, requests and grievances about any of them go to the contacts in section 18.

3. Personal data we process and why

This is an itemised description of the personal data we process, the purpose for each, and the ground under the DPDP Act that we or the facility rely on.

We collect only the personal data we need for these purposes. Please don't send patient details or medical records through our website form or general contact channels; we don't need them to answer an enquiry.

Our website enquiry form

The form on this website does not send your details to our servers. When you submit it, your browser opens WhatsApp with a pre-filled message to our business number. We receive your details only if you choose to send that message.

4. Consent and withdrawing consent

Where we rely on consent, we ask for it in a way that is free, specific, informed, unconditional and unambiguous, through a clear affirmative action, and only for the personal data needed for the stated purpose, as Section 6 of the DPDP Act requires.

• You can withdraw consent at any time, as easily as you gave it: reply “STOP” to our WhatsApp messages, use the unsubscribe link in our emails, or write to info@sohamenterprises.co.in.
• Once the relevant provisions are in force, you may also give, manage, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India.
• Withdrawing consent does not affect processing that took place before you withdrew it. After you withdraw, we (and our processors) stop processing your personal data for that purpose within a reasonable time, unless the law requires or allows us to keep it.
• For patient data, the facility manages consent. If you withdraw consent through us, we pass it on to the facility immediately and act on its instructions.

We rely on the legitimate uses in Section 7 of the DPDP Act only where they genuinely apply — for example, where you voluntarily give us your details for a specific purpose, where the law requires us to process data, or to respond to a medical emergency involving a threat to someone's life or health.

5. Patient data we process for facilities

Depending on the modules a facility uses, we may process the following on its behalf:

• Identity and contact details: name, age, gender, phone or WhatsApp number, preferred language and patient identifiers such as a UHID.
• Appointment and visit details: doctor and department, date, time, token number, reason for visit and visit history.
• Health information the facility adds or connects: EMR records, lab test alerts and reports, clinical notes used to prepare discharge summaries, and medication guides.
• Payment history the facility records in the hospital CRM.
• Communications: WhatsApp messages and media, Voice AI call audio and transcripts, reminders sent, and feedback or survey responses.
• Social media enquiries from Instagram and Facebook that the facility routes into its booking pipeline.

Health information and medical records are sensitive personal data. We process patient data only to provide the Services the facility has chosen, on its documented instructions. We do not use it for our own purposes, we do not use it for marketing, and we do not sell it. Our staff access patient data only when needed to provide, support or secure the Services, or where the law requires it, and that access is logged.

Facilities remain responsible for giving patients notice, obtaining consent (including WhatsApp opt-in), meeting medical-record retention duties and responding to patients' requests. We help them do this.

6. WhatsApp Business Platform and Meta data

Facilities can connect their WhatsApp Business Account — and, if they use our social media automation, their Instagram professional account or Facebook Page — to Soham Enterprises. We then access Meta's platforms on the facility's behalf. Data we receive through Meta's platforms is “Platform Data” under the Meta Platform Terms. This section explains how we handle it.

6.1 What Platform Data we receive

• Business account information: WhatsApp Business Account ID, business phone number and phone number ID, display name, business profile (description, address, email, website, category and profile photo), message templates and their review status, quality rating, messaging limits and verification status.
• Messages: the content of messages and media sent to and from the facility's number — text, images, documents, audio, locations and interactive replies — with timestamps and delivery, read and failure statuses.
• Contact details: the WhatsApp phone numbers and profile names of people who message the facility or whom it messages.
• Account analytics: conversation, pricing and delivery analytics for the facility's account.
• Instagram and Facebook (only if enabled): the facility's Page or professional account ID, the scoped user IDs, usernames or profile names of people who message it, and the content of those messages.

When a facility's administrator connects these accounts using Meta's Embedded Signup or Facebook Login for Business, we receive an access token for the permissions they approve. We never receive or store their Facebook password.

6.2 Permissions we request and why

6.3 How Meta handles WhatsApp messages

Messages travel through Meta's WhatsApp Business Platform. For the Cloud API, Meta has told businesses that messages are encrypted in transit between WhatsApp users and the Cloud API, are encrypted at rest, and are kept by Meta for a maximum of 30 days to support features such as retransmission, and that Meta acts as a data processor on behalf of the business. Meta's own handling of this data is governed by the WhatsApp Business Terms of Service, the Meta Terms for WhatsApp Business and the WhatsApp Privacy Policy. Instagram and Facebook messages are processed by Meta under the Meta Privacy Policy.

6.4 How we use Platform Data

We use Platform Data only:

• to provide the Services to the facility that connected the account, and only for the features it has turned on;
• to keep the Services secure and reliable, and to prevent spam, fraud and abuse;
• to provide support that the facility asks for;
• to comply with the law, the Meta Platform Terms and the WhatsApp Business terms.

6.5 Opt-in and opt-out

Facilities must obtain a person's opt-in before sending them WhatsApp messages, as the WhatsApp Business Messaging Policy requires, and must respect opt-outs. You can stop messages from a facility at any time by replying “STOP” or telling the facility. We record and honour opt-out requests in the Services, and we pass them to the facility.

6.6 Deleting Platform Data

We delete Platform Data, and require our service providers to delete it, as soon as reasonably possible and in any case within 30 days when:

• it is no longer needed to provide the Services to the facility;
• the facility disconnects its WhatsApp, Instagram or Facebook account from Soham Enterprises, or its contract with us ends;
• a person or the facility asks us to delete it (see our data deletion instructions);
• Meta asks us to delete it, or the law requires it.

When a connection is removed, we stop accessing Meta's platforms for that facility immediately and revoke the related access tokens. We keep only the minimum records the law requires, such as security logs for one year under the DPDP Rules and invoices under tax law. Deleted data is removed from our backups within 90 days.

6.7 Service providers and incidents

Before any service provider processes Platform Data for us, it must agree in writing to process it only for us and on our instructions, to comply with the Meta Platform Terms and this policy, not to use it for its own purposes, to impose the same terms on its sub-contractors, and to delete it when our engagement ends. This includes our technology partner, One Learn AI. We are responsible for our service providers' compliance.

If there is any unauthorised access to or processing of Platform Data, we will notify Meta as quickly as possible and no later than the law requires, start remediation immediately, notify the affected facility, and cooperate with Meta's review.

7. AI features and human oversight

• Our AI agents handle scheduling, reminders, confirmations and triage. They do not diagnose conditions, prescribe treatment or give medical advice.
• They are guardrailed to escalate emergencies and questions outside their scope to the facility's duty doctor or desk staff. In an emergency, people should call 112 or go to the nearest emergency department.
• AI-generated clinical content, such as discharge summaries and medication guides, is prepared from the facility's own notes and is reviewed and approved by the facility's clinicians before it is sent.
• We do not use AI to make decisions that have legal or similarly significant effects on people.
• Our AI and speech technology providers process data only to provide the Services, and they are contractually prohibited from using customer data, patient data or Platform Data to train their models.

8. Who we share personal data with

We share personal data only as this policy describes. We do not sell personal data.

Service providers (sub-processors)

We use carefully selected service providers, bound by written contracts that require confidentiality, the security safeguards in Rule 6 of the DPDP Rules, processing only on our instructions and deletion when the work ends:

Customers can ask us at info@sohamenterprises.co.in for the name of each provider. We will tell our customers before we add or replace a sub-processor that processes patient data or Platform Data, so they can object.

Other disclosures

• The facility that patient data belongs to, and anyone it instructs us to share data with, such as its HIS or EMR system.
• Professional advisers — lawyers, auditors and insurers — under a duty of confidentiality.
• A buyer or successor if our business is merged, sold or restructured, who must protect personal data as this policy describes.

Requests from public authorities

We disclose personal data to courts, regulators, government bodies or law enforcement agencies only when Indian law compels us. We check that each request is lawful and valid, challenge requests that are not, and disclose only the minimum data required. Unless the law prohibits it, we tell the affected facility before disclosing its data. We never give any authority direct, bulk or unrestricted access to our systems, and we keep a record of every request we receive.

9. Transfers outside India

We store Soham Enterprises data in India. Meta, which provides the WhatsApp Cloud API and Instagram and Messenger messaging, may process messages in other countries. We transfer personal data outside India only as Section 16 of the DPDP Act and Rule 15 of the DPDP Rules permit, never to a country or territory the Government of India has restricted, and only under contracts that require the protections described in this policy. Enterprise hospitals can choose an on-premise or hybrid deployment to keep patient data on their own infrastructure.

10. How we protect personal data

We take reasonable security safeguards to prevent personal data breaches, as Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules require, and maintain reasonable security practices and procedures under the IT Act and the SPDI Rules. Our safeguards include:

• Encryption: patient conversations and records are encrypted with 256-bit AES at rest and with TLS in transit. Where appropriate, we also use masking and pseudonymisation.
• Access control: access on a need-to-know basis, unique user accounts, role-based permissions and multi-factor authentication for administrative access.
• Logging and monitoring: access to personal data is logged, monitored and reviewed. We keep these logs, and the associated personal data, for at least one year, as Rule 6(1)(e) and Rule 8(3) of the DPDP Rules require.
• Continuity: regular encrypted backups and recovery procedures, so processing can continue if confidentiality, integrity or availability is compromised.
• Contracts: every Data Processor we use must take reasonable security safeguards under written contract.
• People and processes: confidentiality agreements and regular privacy and security training for staff, secure development practices, and periodic review of our safeguards.

11. Personal data breaches

If a personal data breach affects personal data for which we are the Data Fiduciary, we will, as Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules require:

• inform each affected person without delay, through their account or registered contact details, about the nature, extent and timing of the breach, its likely consequences for them, what we are doing to reduce the risk, what they can do to protect themselves, and who they can contact;
• inform the Data Protection Board of India without delay, and send it a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows).

If a breach affects data we process for a facility, we will notify the facility without undue delay and in any case within 24 hours of becoming aware of it, with the information it needs to meet its own obligations, and we will help it notify the Board and the people affected. We also report cyber security incidents to CERT-In within six hours of noticing them, as the CERT-In Directions require, and notify Meta of any incident involving Platform Data, as section 6.7 describes.

12. How long we keep personal data

We keep personal data only for as long as the purpose requires, and erase it once the purpose is no longer served or consent is withdrawn, unless the law requires us to keep it (Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules).

Facilities may have their own legal duties to keep medical records for set periods. They decide how long patient records are kept in their account.

13. Your rights and how to use them

As a Data Principal, you have the right to:

• Access information (Section 11): a summary of your personal data we process and our processing activities, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared.
• Correction and erasure (Section 12): to have inaccurate or misleading data corrected, incomplete data completed, data updated, and data we no longer need erased, unless the law requires us to keep it.
• Withdraw consent (Section 6(4)) at any time, as section 4 explains.
• Grievance redressal (Section 13): to have your complaints about our handling of your personal data resolved by us.
• Nominate (Section 14) another person to exercise your rights if you die or become unable to exercise them.

How to make a request

Write to our Grievance Officer at info@sohamenterprises.co.in or message us on WhatsApp at +91 93231 88212. Please tell us your name, the phone number or email address you used with us or with the facility, the facility's name if you are a patient, and what you would like us to do. To request deletion, you can also follow our data deletion instructions.

• We may ask you to verify your identity, for example by writing from the same WhatsApp number, before we act on a request.
• We acknowledge requests within 2 working days and respond within 30 days. Grievances are resolved within 30 days, and never later than the maximum period of 90 days allowed under Rule 14 of the DPDP Rules.
• There is no charge for making a request.
• If you are a patient, the facility is the Data Fiduciary for your records. We will forward your request to it within 2 working days and help it respond.

If you are not satisfied with how your grievance was resolved, you can complain to the Data Protection Board of India under the DPDP Act after using our grievance process.

14. Your duties as a Data Principal

Section 15 of the DPDP Act asks Data Principals to comply with the law when exercising their rights, not to impersonate anyone, not to suppress material information when providing personal data for an official document, not to register false or frivolous complaints or grievances, and to provide only verifiably authentic information when asking for data to be corrected or erased.

15. Children and persons with disabilities

This website is meant for healthcare facilities and their staff, not for children, and we do not knowingly collect children's personal data through it.

Facilities may use the Services for patients under 18, or for persons with disabilities who have a lawful guardian. In those cases the facility, as Data Fiduciary, must obtain verifiable consent from the parent or lawful guardian as Section 9 of the DPDP Act and Rules 10 and 11 of the DPDP Rules require, subject to any exemption available under the DPDP Rules. We process that data only on the facility's instructions. We never track or behaviourally monitor children, or direct targeted advertising at them.

16. Cookies and similar technologies

This website does not set advertising or tracking cookies, does not use cross-site analytics, and does not store personal data in your browser. Our pages load web fonts from Google Fonts, which receives your IP address and basic browser information when the fonts load, under Google's own privacy policy. The Soham Enterprises dashboard uses only essential cookies to keep users signed in and secure. If this changes, we will update this policy first and ask for consent where the law requires it.

17. Reporting a security vulnerability

If you believe you have found a security vulnerability in our website or Services, please email info@sohamenterprises.co.in with the subject “Security vulnerability”. Our contact details are also published at /.well-known/security.txt. Please give us reasonable time to fix the issue before disclosing it, and do not access, change or delete other people's data or disrupt the Services while testing. We will acknowledge valid reports promptly and fix confirmed issues as a priority.

18. Grievance Officer and contact

You can contact our Grievance Officer with any question, request or complaint about personal data, as Section 8(9) and 8(10) of the DPDP Act, Rule 9 of the DPDP Rules and the SPDI Rules require:

Name

Jayant Ganatra

Designation

Founder & Director

Email

info@sohamenterprises.co.in (subject: “Grievance”)

WhatsApp

+91 93231 88212

Phone

(022) 2545 3122 / (022) 2545 3126

Address

Soham Enterprises, 1, Sita Vihar Cottages, Behind Damani Estate, L.B.S. Road, Thane (West) 400602, Maharashtra, India

Response time

Acknowledged within 2 working days; resolved within 30 days

19. Changes to this policy

We may update this policy to reflect changes in the law, Meta's terms or our Services. We will post the new version on this page with a new date and, for material changes, tell our customers by email at least 30 days before the changes take effect. Where a change requires fresh consent, we will ask for it.

You can also read our terms of service and our data deletion instructions.