Eden App Privacy Policy
This Privacy Policy applies to those who avail the services of Eden Mobile Application (“App”). We may collect and/or fetch certain information including but not limited to your personal information when you register and/or utilise the services. This document provides you with an insight on the information we collect from you or fetch on your behalf and the purpose behind such collection. This Privacy Policy forms part of the Terms of Service and all the definitions and abbreviations used herein are the same as those mentioned in the ToS. You may stop using our services if you do not agree with our privacy policy.
1. WHY WE COLLECT
1.1. The Eden Mobile Application - the “App” is a digital health platform that is integrated, or intended to be integrated, with the Ayushman Bharat Digital Mission (“ABDM”) ecosystem. ABDM is an initiative of the Government of India aimed at creating the digital infrastructure necessary to support an integrated health ecosystem across India, including secure, consent-based exchange of health information among authorised healthcare stakeholders. Through its ABDM integration, the App enables users to access, receive, store, manage, link, and share personal health records and related health information through ABDM’s Personal Health Record framework and other authorised digital health systems, subject to applicable law, ABDM requirements, user consent, system availability, and third-party participation.
1.2. Information uploaded by you through the App is collected and processed solely for the purposes of:
a. Providing secure digital storage facilities;
b. Enabling access, retrieval, and management of stored content;
c. Synchronising data across authorised devices;
d. Complying with applicable legal and regulatory requirements.
1.3. We do not use uploaded information for advertising, marketing, or profiling purposes unless expressly authorised by you.
1.4. We may modify this Privacy Policy subject to prior notice to the users. This Privacy Policy is liable to change without notice at the discretion of the Ayushman Bharat Digital Mission (“ABDM”) and Ministry of Electronics & Information Technology, Government of India. Any change in the Privacy policy will be notified to all the users. Your continued use of the Eden Mobile Application shall be deemed acceptance of the revisions and modifications.
1.5. We may collect your personal information for authentication, fraud prevention, customer support, troubleshooting, security monitoring, platform improvements, audits, and compliance with legal or regulatory obligations.
2. WHAT WE COLLECT
2.1. We collect certain information which is required for providing you with the Services. The information we collect can be classified broadly in 2 ways:
a. By way of your input: this is the information that is collected through your input. You are required to provide, the following information:
i. ABHA Address
ii. 14 digit ABHA Number
iii. Name : First, middle, last name
iv. Date of birth (day / month / year)
v. Postal address
vi. Mobile number
vii. Profile photo
b. If you avail the services of Health Records:
i. Health records in FHIR format (e.g. lab reports, prescriptions, diagnostic reports, discharge summaries)
ii. Care context references or metadata of the record.
iii. Your IP address
iv. Access to your camera only when you use the scan and share functionality at a health facility or any documents for uploading
vi. Access to your gallery, photos and files if you desire to upload any documents, photos or files from the same
This information is collected by us in the background without your intervention except providing app permission when you install our App.
2.2. You may refuse to provide any of the above information however, we shall not be able to provide you with the services in the event you fail to provide the required information.
3. SHARING INFORMATION
3.1. Upon your consent, we may share your information with the requesting individual or institution and with our affiliated third-party service providers, solely to facilitate, provide, and improve the services made available through the App, including the ABDM national gateway and ABDM participants for identity, consent, and health-record exchange; healthcare providers or HIPs such as hospitals, labs, and registered facilities for user-initiated discovery, consent, retrieval, or sharing; Amazon Web Services for cloud hosting, compute, database, cache, and logging; Apple APNs and Google FCM for device-token based push notification delivery; and third-party AI service providers when you use chat or health-insights features.
3.2. When you use AI-assisted chat or health-insights features, your personal information, health records, and derived clinical context may be processed for that purpose through a third-party AI service provider.
3.3. We value your privacy and other than what is stated above, we do not share your information with any third party. However, we may be forced to share your data with law enforcement and other state/national authorities under the following circumstances:
a. When required by a judicial or quasi judicial authorities under a warrant.
b. When required by law enforcement authorities.
c. When required by national agencies under national/state security.
d. When determined by us that it is necessary for the best interest of the country, state and or general public.
4. STORING YOUR INFORMATION
4.1. The security and confidentiality of your personal information are of paramount importance to us. The App and all data collected through it are hosted and stored on reputable third-party cloud service providers that maintain industry-standard security measures and safeguards designed to protect data against unauthorised access, disclosure, alteration, loss, or misuse, including encryption at rest and in transit, access controls, firewalls, regular security assessments, and compliance certifications.
4.2. We implement security measures including AWS RDS database encryption at rest using KMS, TLS encryption in transit for app and database connections, Redis AUTH and TLS in sandbox and production, isolated environments, least-privilege credentials, non-public database access, ABDM-backed authentication, hashed session-token validation, App M-PIN protections, authenticated user-facing APIs, consent–transaction audit linkage, CloudWatch logging with PHI/PII redaction, and ABDM-standard cryptographic protection for health records in transit through ABDM.
5. DATA RETENTION
5.1. Personal information, health records, account data, logs, device tokens, notifications and backups are retained as per the legal requirements, except for short-lived operational Redis data; logout does not fully delete an account or profile data, unless you specifically request for erasure of your data, subject to any additional statutory retention obligations under DPDP, or applicable law.
6. YOUR RIGHTS
As an individual, you have the following rights:
a. To view your personal data which has been collected by us
b. To modify or request us to update your data in case there is a change or the information we collected has an error
c. To appoint a nominee to exercise your rights under the DPDP Act in the event of your incapacitation or death
d. To withdraw your consent and/or request deletion of any or all of your data with us. However, in such cases, we may not be able to provide our services to you.
If you have any queries please contact us through customersupport@orpheum.in or at +91 8138-059918. We may require reasonable information to verify your identity and process your request.