Draft for lawyer review. This policy is a plain-English working draft and is not yet final. Items in [square brackets] must be confirmed before it is relied on.
1. Who we are
This policy is from Vitals Technologies ("Vitals", "we", "us"), [legal entity name and type], registered at [registered address], India. We make Pulse, an operating system for businesses, and run the website vitalsos.ai.
2. What this policy covers
- The website vitalsos.ai, including the consultation form.
- Pulse, on the web, on phones and in the Android app.
- Pulse connectors that let AI assistants, such as Claude and ChatGPT, work with your Pulse account when you choose to connect them.
- Our setup and support services.
3. Our two roles
When you visit our website or contact us, we decide why and how your personal data is used. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for that data.
When a business uses Pulse, it puts in data about its own team, clients and contacts. For that data the business is the Data Fiduciary, and we process it on the business's behalf as its Data Processor, under our agreement with it. If you are an employee or client of a business that uses Pulse, that business is the right first contact for questions about your data. We will help it answer you.
4. What we collect
From the consultation form
Your name, business name, team size, WhatsApp number, e-mail address, your message, the page you sent it from and any campaign tags in the link you followed.
When you use the website
Technical data that every web request carries: IP address, browser and device type, the pages requested, and the approximate country our hosting provider derives from the IP address. We use it to run the site, keep it secure and stop abuse.
When your business uses Pulse
- Account data: name, e-mail, phone number, role, and sign-in records.
- Business content: what your team puts into Pulse, such as messages, call notes, files, projects, quotations, invoices, payments, attendance and leave.
- Usage data: which features are used and when, and error reports, so we can keep Pulse working.
When you connect an AI assistant
The requests the assistant makes to Pulse and the data it reads or changes on your behalf. A connector only has the permissions of the person who connected it.
5. How we use it
- To reply to your enquiry and arrange your consultation.
- To provide, secure and support Pulse, including setup, data migration and training.
- To bill our customers and keep the records the law requires.
- To understand, in aggregate, how Pulse is used so we can improve it.
- To meet legal obligations and protect our rights and our customers.
We do not sell personal data. We do not use our customers' business content for advertising.
We rely on your consent for the consultation form, which you can withdraw at any time, and on the legitimate uses the DPDP Act allows where they apply. For business content in Pulse, we act on our customer's instructions. [Lawyer to confirm the grounds for each purpose.]
6. AI employees, AI features and connectors
AI employees and other AI features in Pulse process business content only to do the work your business has set them up to do, following its SOPs and within the permissions of the role. Their actions are logged and can be undone by your team.
To run these features we use AI model providers [names to be confirmed]. They process the content needed for each request under contracts with us. We do not use our customers' business content to train general-purpose AI models. [Confirm against each provider's terms.]
When you connect a third-party AI assistant to Pulse, that assistant's own privacy terms also apply to what you share with it. You can disconnect it at any time from your Pulse settings.
7. Who we share it with
- Service providers who help us run Vitals and Pulse, such as hosting and content delivery [Cloudflare], e-mail delivery [Resend], our own sales system for enquiries, and AI model providers. Each is bound by contract to use the data only for the service it provides to us.
- Authorities, when the law requires it.
- A buyer or successor, if Vitals is merged or sold, under the same protections.
Some providers may process data outside India. We transfer data abroad only as the DPDP Act and any Government notifications under it allow.
8. How long we keep it
- Enquiries: up to [24 months] after our last contact, unless you become a customer.
- Business content in Pulse: for as long as the business uses Pulse, then deleted [within 90 days] after the business leaves and has had the chance to export it, except where the law requires us to keep it longer.
- Billing and tax records: as long as Indian law requires.
9. How we protect it
We use encryption in transit, access controls based on each person's role, separation of each business's data from every other business, and activity logs. No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and the people affected as the DPDP Act requires, and help our customers do the same.
10. Your rights
Under the DPDP Act you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, where we no longer need it or you withdraw consent;
- handle a grievance about how we have used it;
- let a person you nominate exercise these rights if you die or become unable to.
You can withdraw consent as easily as you gave it. Write to us at the address below and we will reply within [the period set by the DPDP Rules]. If your data sits in a business's Pulse workspace, please contact that business first.
11. Children
Our website and Pulse are for businesses and are not meant for anyone under 18. We do not knowingly collect children's personal data.
12. Cookies and similar technology
The vitalsos.ai website does not use advertising or tracking cookies. It may store small settings in your browser that the site needs to work. Pulse uses cookies to keep you signed in and secure. [Update this section if analytics are added.]
13. Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will tell our customers before it takes effect.
14. Contact and grievances
Privacy questions and requests: [email protected] [confirm address].
Grievance Officer: [name], [e-mail], [address]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.