Legal / last updated 5 October 2026 / version 1.0

Privacy Policy

This policy covers ommune.com and Omora AI, our AI assistant for clinics. It is written in plain language and follows India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Who we are

Ommune IT Solutions Pvt Ltd ("Ommune", "we", "us") operates this website and builds Omora AI. For this website, we are the data fiduciary — we decide why and how your data is used.

For Omora AI, the clinic that uses Omora with its patients is the data fiduciary. The clinic decides how patient data is used and is responsible for getting patient and parental consent. Ommune acts as a data processor — we process the data on the clinic's behalf, under the clinic's instructions, using the safeguards described below.

What we collect

If you visit this website: basic technical data (pages viewed, browser type) and anything you type into the contact form (name, email, company, message).

If you work at a clinic using Omora: your name, role, and login activity.

If you are a patient or parent at a clinic using Omora: the clinic may, through Omora, collect the child's name and age, the parent's or guardian's contact details, symptoms described over WhatsApp, prescriptions, medical reports, and the WhatsApp messages exchanged with Omora. This data belongs to the clinic. Ommune processes it only to run Omora for that clinic.

Why we use your data, and our legal basis

  • To run and improve this website and reply to enquiries — legitimate use.
  • To let a clinic use Omora with its patients — based on the consent the clinic collects from the patient or parent, and the clinic's contract with us.
  • To keep the service secure and to meet legal obligations — legitimate use and legal duty.

Children's data

Omora is used by clinics that treat children. Before any child's data reaches Omora, the clinic must obtain verifiable parental or guardian consent through the clinic's own registration process. Ommune does not collect children's data directly and does not market to children.

How AI is used

Omora's AI reads the symptoms, history and reports shared with it and suggests a next step. It never makes a final medical decision. A doctor reviews and approves every clinical output before it reaches a patient. We do not use patient conversations or medical data to train our AI models or anyone else's.

WhatsApp messaging

Patients talk to Omora over WhatsApp, using the Meta Cloud API. Meta (WhatsApp's operator) processes the message content to deliver it, as a separate, independent processor under its own privacy terms. We encourage you to also read Meta's WhatsApp privacy policy.

Other companies that help us (processors)

  • Hosting: DigitalOcean, Bangalore data centre, India.
  • Voice: Sarvam AI, for voice features.
  • AI model providers: Anthropic and Cerebras. TODO: final list after model tests.
  • Messaging: Meta (WhatsApp Cloud API), as described above.

Each processor only gets the data it needs to do its job, under a written agreement.

Where your data stays

Data collected through Omora and this website is stored in India.

How we protect your data

  • Encryption of data in transit and at rest.
  • Access control — only authorised clinic staff and Ommune engineers with a work reason can access patient data.
  • Audit logs of who accessed what, and when.

How long we keep data, and deletion

We keep data only as long as the clinic needs it, or as long as Indian law requires (for example, certain health or billing records must be kept for a minimum period even after a deletion request). See our Data Deletion page for how to ask for deletion and what happens next.

Your rights

Under the DPDP Act, you (or a patient's parent/guardian) can ask to:

  • Access the personal data we or the clinic hold about you.
  • Correct or update inaccurate data.
  • Erase data, subject to legal retention requirements.
  • Withdraw consent at any time.
  • Nominate another person to exercise these rights on your behalf (for example, in case of death or incapacity).
  • Raise a grievance with us, as described below.

For Omora, most of these requests should first go to the clinic, since the clinic is the data fiduciary. You can also contact us directly and we will coordinate with the clinic.

If something goes wrong (data breach)

If we become aware of a personal data breach, we will inform the people affected without delay, and the Data Protection Board of India within 72 hours, as required under the Digital Personal Data Protection Rules, 2025.

Grievance officer

If you have a concern about how your data is handled, contact our grievance officer:

Santosh Kumar Singh
Email: santosh.singh@ommune.com
Phone: +91 (84698) 28595

We will reply to your grievance within 7 days.

Changes to this policy

We may update this policy as our products, processors or the law change. The date and version at the top of this page will change when we do.

Last updated: 5 October 2026 · Version 1.0