Disclaimer

This program is curated by Lupin Limited(“Lupin”) and Lupin reserves the right to modify/withdraw/cancel the program without any prior notice. The information provided under this program focusses on adherence to therapy and lifestyle modifications and does not intend to substitute medical advice and supervision from a qualified healthcare professional. Patients and users of this program are requested to seek requisite medical advice from a qualified medical healthcare professional whenever required.

Privacy Notice

JaiRespi Application

 

This Privacy Notice explains how Lupin Limited (“Lupin”, “we”, “us” or “our”) collects, uses, shares, stores and protects your personal data when you use the JaiRespi Application (“Application”). It is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

For the DPDP Act, Lupin may act as a Data Fiduciary and you are the Data Principal.

We have the following data touchpoints on our application through which we collect data for providing the application related services:

• Through the Mobile application itself.
• Through the Web Application.
• Through the WhatsApp Chatbot.
• Through the Toll-Free Number.
• Through the Medical prescription and records which are uploaded on the application.

1. Personal Data We Collect

Depending on your use of the Application and the services enabled for you, we may collect the following categories of personal data:

• Identity and contact details: full name, patient ID / registration ID, registration details, mobile number, email address, Government Identifier (Aadhaar Card, PAN, or other as per requirement), physical address, PIN code, date of birth, age, gender, PIN code, city, state, address. 
• Care and Support Information: Information relating to doctors, health coaches, caregivers, caretakers, dieticians, family members, emergency contacts, appointment booking details, consultation records and other individuals involved in your care or patient support journey.
• Personal Health Information: Weight, height, waist size, blood pressure, blood sugar values, HDL, LDL, health metrics such as steps, SpO₂, breathing, BMI, and water intake where captured through the app, Heart Rate, Sleep Cycle Record, Step Count, Calorie Intake and Calories Burned through Smart Device integration, prescription details, prescription documents/uploads, respiratory disease or medical condition details, medical reports, medical history, treatment details, medication details, doctor records / consultation history, medicine purchase invoices, invoice number, billing details, eligibility verification details for medicine adherence / benefits administration and other health-related information provided by you or generated through your use of the Application.
• Communication and Engagement Data: communication records, interaction history, prescription/invoice submissions through WhatsApp, service reminders, appointment confirmations, notification preferences.
• Consent, Usage and Security Information: Consent records, communication preferences, audit logs, access logs, application usage information, device identifiers, security records, and related information required to operate and secure the Application.
• Other Information: Any additional information voluntarily submitted by you through the Application or generated during your use of the Application where necessary for the purposes described in this Notice.

2. Processing of Personal Health Information

The Application may collect and process Personal Health Information (“PHI”) that you provide directly, upload through the Application, generate while using the services, or share through connected devices and health platforms.

PHI may include prescriptions, medication details, consultation records, medical reports, treatment information, appointment details, respiratory care information, therapy and wellness participation records, medical invoices, health measurements, connected-device data, and other healthcare-related information necessary to provide the Application’s services.

We process PHI solely for purposes associated with:

• patient onboarding and health profile management;
• respiratory care support, inhaler training and patient support services;   
• prescription, medication and treatment management;
• appointment scheduling, therapy, physiotherapy/yoga and diet guidance;
• medication adherence, eligibility verification and benefit administration;
• consultation, care communication, reminders and service notifications;
• health tracking, progress monitoring and care-related insights;
• invoice, billing and healthcare transaction management;
• service analytics, quality improvement and operational reporting;
• application security, fraud prevention and risk management; and
• compliance with legal, regulatory and healthcare obligations.

PHI is protected through appropriate technical and organisational safeguards designed to protect against unauthorised access, disclosure, alteration or loss.

We may disclose PHI only to authorised healthcare professionals, affiliates, service providers, technology partners and other parties who require access to support the operation of the Application and who are subject to appropriate confidentiality, security and contractual obligations.

PHI is not sold, rented, brokered, licensed, used for behavioural advertising, used to create marketing profiles, or processed for purposes unrelated to the healthcare, patient support and Application services described in this Notice.

Where the Application requests access to device permissions, wearable devices, connected health devices, health platform integrations, camera access, storage access or other health-related data sources, such access will be requested only where reasonably necessary to provide the relevant functionality and, where required, based on your consent or device-level permissions.

3. Purposes for Which We Process Your Personal Data

We process your personal data only for lawful purposes connected with the JaiRespi Application and related healthcare or patient support services, including:

• To register, verify, authenticate and manage your account and patient profile;
• To enable patient onboarding and access to JaiRespi services through the mobile application, website and WhatsApp;
• To provide respiratory care support, inhaler training, patient support services and disease awareness;
• To manage prescriptions, medical records, treatment details and related document uploads;
• To schedule and manage appointments, consultations, therapy, physiotherapy/yoga sessions and diet guidance;
• To administer medicine adherence programs, eligibility verification and patient benefits;
• To process invoices, billing details and healthcare transaction records;
• To communicate service reminders, appointment confirmations, care updates, notifications and support messages;
• To manage CRM, backend verification, operational workflows and patient support interactions;
• To monitor health progress, service usage and generate care-related insights;
• To communicate service reminders, medication notifications, care plan updates, application alerts, program-related information and support communications; 
• To maintain consent records, access controls, audit logs, security monitoring and regulatory compliance records; 
• To retain, archive, delete or purge personal data and health data in accordance with applicable retention requirements, consent withdrawal, erasure requests and legal obligations;
• To detect, investigate and prevent fraud, misuse, security incidents and other unlawful activities; 
• To improve care delivery, patient support services, operations and user experience; and 
• To comply with applicable legal, regulatory, contractual and healthcare-related obligations.

4. Legal Basis for Processing

Where processing is based on consent, we will seek your consent for specified purposes through a clear affirmative action. You may withdraw consent at any time through the Application or by contacting us. Withdrawal will not affect prior lawful processing but may impact services that require such data. We process your personal data on the following legal bases:

• We process your data for legitimate purposes including but not limited to:
  • fulfil any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force; and
  • provide services and benefits requested through the Application and to safeguard the Application, its users, and the organization against fraud, misuse, security incidents, unauthorized disclosures, and other legal or operational risks.

5. Your Rights as a Data Principal

Subject to applicable law, you may exercise the following rights under the DPDP Act:

• to request details and access of the personal data that Lupin processes about you (“right to access”);
• to have your personal data corrected, for example, if it is incomplete or incorrect (“right to correction”);
• to have your personal data erased or deleted (“right to erasure”);
• where you have provided consent to the processing of your personal data, the right to withdraw your consent. (“right to withdraw consent”);
• where you can nominate an individual to exercise the above-mentioned data subject rights in case of death or incapacity (“right to nominate”); and
• under the DPDPA 2023, individuals have the right to grievance redressal, allowing them to file complaints with Data Fiduciaries and receive a response. If unresolved, they can escalate the matter to the Data Protection Board of India. (“right to grievance redressal”).

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice, comply with applicable laws, protect legal rights, and meet regulatory, professional, archival, or record-keeping requirements. Where personal data, including health-related information, is required to be retained for pharmacovigilance, drug safety monitoring, adverse event reporting, medical inquiry handling, or related regulatory purposes, such records may be retained for a period of up to 10 years, or for such longer period as may be required under applicable law. Retention periods are determined in accordance with the Lupin Data Retention Policy, applicable data protection laws, pharmacovigilance requirements, and relevant IT logging requirements, including CERT-In guidelines. Upon expiry of the applicable retention period, personal data will be securely deleted.

Where consent is withdrawn, we will erase your personal data once the purpose for which it was collected is no longer required, unless retention is necessary to comply with legal, regulatory, accounting, reporting, archival, or other obligations under the Digital Personal Data Protection Act, 2023, or any other applicable law.

7. Disclosure of Personal Data

We may share your personal data with the following categories of recipients:

• Internal departments and authorised personnel involved in the administration, operation, support, compliance, security, patient support programs, healthcare services, and management of the Application.
• Healthcare professionals, affiliates, service providers, technology vendors, support partners, and third-party service providers engaged to support the delivery of healthcare and patient support services, application hosting, maintenance, analytics, communications, customer support, security, and other operational functions related to the Application.
• Legal, regulatory, governmental, judicial, or law enforcement authorities, where disclosure is required to comply with applicable laws, regulations, legal processes, healthcare obligations, or to protect the rights, safety, security, or interests of Lupin, its users, or other stakeholders.

We do not sell, rent, broker, license, use for advertising, create marketing profiles from, or process your health data for purposes unrelated to healthcare, patient support services or other lawful purposes described in this Notice.

8. Security Safeguards

We use reasonable technical and organisational safeguards to protect personal data from unauthorised access, disclosure, alteration, loss or misuse.

9. Cross-Border Processing

Your personal data may be stored or processed in India or other jurisdictions where Lupin, its affiliates, service providers or business partners operate. Cross-border processing will be carried out in accordance with the DPDP Act, applicable government notifications and other applicable laws.

10. Children’s Personal Data

The Application is not intended to process children’s personal data. If this changes, Lupin will take steps required under applicable law, including obtaining verifiable parental or guardian consent where required.

11. How to Exercise Your Rights or Raise a Grievance

To exercise your rights, withdraw consent, request correction or erasure, or raise a grievance, contact Lupin at dpo@lupin.com. Please provide sufficient details to help us verify and respond to your request.

If your grievance is not resolved through Lupin’s grievance redressal mechanism, you may have the right to approach the Data Protection Board of India in accordance with the DPDP Act and applicable rules, once the relevant procedures are in force.

12. Availability of this Notice

This Notice may be made available in English and, where required, in any language specified in the Eighth Schedule to the Constitution of India, at the option of the Data Principal.

13. Updates to this Notice

We may update this Notice from time to time. The updated Notice will be made available through the Application or other appropriate channels. For more details, please refer to Lupin’s Cookie Policy page or you may contact Lupin’s Data Protection Office at dpo@lupin.com.

 

This Privacy Notice was last updated on 11th September, 2026