(Prepared in alignment with the Digital Personal Data Protection Act, 2023 (India))

Last Updated: July 2026

1. Introduction

Welcome to Kneesy Health.

Kneesy Health ("Kneesy", "we", "our", or "us") is a healthcare technology and rehabilitation platform operated by Integrated Rehabtech Systems Private Limited ("the Company"), a company incorporated under the laws of India.

At Kneesy, protecting the privacy, confidentiality and security of your personal information is fundamental to the trust you place in us. As a healthcare platform, we understand that the information you share with us, including your health records, rehabilitation progress, consultation history and other personal information is sensitive and deserves the highest standards of care and protection.

This Privacy Policy explains how we collect, use, store, process, disclose, transfer and otherwise handle your Personal Data when you access or use our website, digital platforms, rehabilitation services, teleconsultation services, mobile applications (if introduced), customer support channels, or any other products or services offered under the Kneesy Health brand (collectively referred to as the "Services").

This Privacy Policy has been prepared in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), applicable rules issued thereunder, and other applicable laws of India.

By accessing or using our Services, or by voluntarily providing your Personal Data to us, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your consent before collecting or processing your Personal Data.

Nothing in this Privacy Policy shall limit any rights or obligations that may arise under applicable law, contractual arrangements or professional healthcare standards.

2. Who We Are

Kneesy Health is a healthcare technology platform that delivers technology-enabled rehabilitation and musculoskeletal healthcare services.

The Services are owned and operated by:

Integrated Rehabtech Systems Private Limited
Office No. 3, White House
Next to Om Hospital
Above Third Wave Coffee
Dr. Homi Bhabha Road
Amchi Colony, Bavdhan
Pune – 411021
Maharashtra, India

Email:
admin@kneesy.com

Phone:
+91 9719714800

For the purposes of the Digital Personal Data Protection Act, 2023, Integrated Rehabtech Systems Private Limited acts as the "Data Fiduciary" responsible for determining the purpose and means of processing your Personal Data.

Throughout this Privacy Policy:

• "Kneesy", "we", "our", or "us" refers to Kneesy Health and/or Integrated Rehabtech Systems Private Limited, as the context requires.
• "You", "your", or "Data Principal" refers to any individual whose Personal Data is processed by us, including patients, prospective patients, caregivers, guardians, healthcare professionals, website visitors, employees, vendors and business partners.

3. Scope of This Privacy Policy

This Privacy Policy applies whenever you:

• visit our website;
• register for an account;
• schedule or attend consultations;
• participate in rehabilitation programmes;
• communicate with us through email, telephone, WhatsApp or other digital channels;
• upload medical records or other documents;
• submit enquiries or feedback;
• interact with our customer support team;
• participate in surveys or promotional activities;
• apply for employment;
• engage with Kneesy as a vendor, consultant or business partner; or
• otherwise use any of our Services.

This Privacy Policy applies irrespective of whether you access our Services through a desktop computer, laptop, mobile phone, tablet or any other connected device.

This Privacy Policy does not apply to websites, applications, products or services that are owned or operated by third parties, even where links to such services are available through our website. We encourage you to review the privacy policies of those third parties before sharing your information.

4. Definitions

Unless the context otherwise requires:

"Applicable Law" means all laws, rules, regulations, notifications, directions and governmental requirements applicable to the Company, including the Digital Personal Data Protection Act, 2023 and any rules framed thereunder.

"Company" means Integrated Rehabtech Systems Private Limited.

"Consent" means any freely given, specific, informed, unconditional and unambiguous indication of your wishes by which you signify agreement to the processing of your Personal Data for specified purposes.

"Data Fiduciary" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

"Data Principal" means the individual to whom the Personal Data relates.

"Health Information" means any information relating to your physical or mental health, healthcare services received, diagnosis, treatment, rehabilitation, medical history, prescriptions, investigations or clinical assessments.

"Personal Data" means any data about an individual who is identifiable by or in relation to such data.

"Processing" includes collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, sharing, transmission, alignment, restriction, deletion or destruction of Personal Data.

"Services" means all healthcare, rehabilitation, technology, software, consultation, assessment and related services offered by Kneesy Health.

5. Our Privacy Commitment

As a healthcare technology company, we recognize that health information deserves enhanced protection.

Accordingly, Kneesy is committed to the following principles:

• collecting only the Personal Data that is reasonably necessary to provide our Services or to comply with applicable legal obligations;
• processing Personal Data fairly, transparently and only for legitimate purposes;
• obtaining consent where required under applicable law;
• implementing reasonable technical, organizational and administrative safeguards to protect Personal Data against unauthorized access, alteration, disclosure, loss or misuse;
• limiting access to Personal Data to personnel, healthcare professionals and service providers who require such access for legitimate business or clinical purposes;
• respecting the rights of Data Principals under applicable law;
• continuously reviewing and improving our privacy and information security practices.

Kneesy does not sell your Personal Data or Health Information to third parties.

Where we use trusted third-party service providers to support our operations, such providers are required to process Personal Data only for authorized purposes and subject to appropriate contractual and security obligations.

6. Categories of Personal Data We Collect

Depending on the nature of your interaction with Kneesy, we may collect the following categories of Personal Data.

6.1 Identity Information

This may include:

• Full name
• Date of birth
• Age
• Gender
• Photograph
• Government-issued identification where required by law
• Patient identification number
• Employee identification number (where applicable)

6.2 Contact Information

This may include:

• Residential address
• Email address
• Mobile number
• Alternate contact number
• City
• State
• Country
• Emergency contact information

6.3 Health and Medical Information

In order to provide rehabilitation and healthcare services, we may collect Health Information including, but not limited to:

• Medical history
• Presenting complaints
• Symptoms
• Diagnosis
• Surgical history
• Injury history
• Pain history
• Family medical history where relevant
• Allergies
• Current medications
• Prescriptions
• Rehabilitation plans
• Physiotherapy assessments
• Orthopaedic assessments
• Functional assessments
• Mobility assessments
• Gait analysis
• Posture assessments
• Range of motion measurements
• Clinical observations
• Progress notes
• Exercise adherence
• Recovery milestones
• Outcome measures

6.4 Medical Records and Investigation Reports

We may collect or receive:

• MRI reports
• CT scan reports
• X-rays
• Ultrasound reports
• Laboratory reports
• Blood investigations
• Diagnostic imaging
• Referral notes
• Medical certificates
• Hospital discharge summaries
• Operation notes
• Specialist opinions
• Insurance-related medical documentation

These records are processed solely for legitimate healthcare, rehabilitation, documentation, compliance and related purposes.

6.5 Images, Videos and Audio Recordings

Subject to obtaining your consent where required by law, we may collect:

• Posture photographs
• Clinical photographs
• Exercise videos
• Rehabilitation videos
• Movement assessment videos
• Gait videos
• Before-and-after progress photographs
• Teleconsultation recordings
• Customer support call recordings
• Consultation audio recordings

Such recordings may be used for clinical documentation, treatment planning, rehabilitation monitoring, quality assurance, training, patient safety, dispute resolution, regulatory compliance and improvement of our Services.

6.6 Communication Information

We may maintain records of communications including:

• Emails
• Telephone conversations
• WhatsApp communications
• SMS messages
• Appointment reminders
• Customer support interactions
• Feedback
• Survey responses

6.7 Financial Information

Where applicable, we may collect:

• Billing information
• Payment confirmations
• Invoice details
• Transaction reference numbers
• Refund information

For security reasons, Kneesy does not intentionally store complete debit card, credit card or internet banking credentials unless expressly required by law or processed through compliant payment service providers.

6.8 Technical Information

When you access our Services, we may automatically collect:

• IP address
• Browser type
• Operating system
• Device identifiers
• Cookies
• Device logs
• Session information
• Crash reports
• Usage analytics
• Website interaction data

This information helps us maintain the security, performance and reliability of our Services.

6.9 Information You Voluntarily Provide

You may voluntarily provide additional information including:

• Medical documents
• Photographs
• Videos
• Insurance documents
• Rehabilitation progress reports
• Feedback
• Testimonials
• Survey responses
• Any other information you choose to share with us.

By submitting such information, you represent that you are legally authorized to provide it and that, where it relates to another individual, you have obtained any necessary authorization or consent to share it with Kneesy.

7. How We Collect Your Personal Data

Kneesy collects Personal Data through lawful and transparent means in connection with the provision of its Services. Depending on your interaction with us, Personal Data may be collected in the following ways:

7.1 Information You Provide Directly

We collect Personal Data that you voluntarily provide when you:

• register as a patient;
• create an account on our platform;
• book or attend a consultation;
• communicate with our healthcare professionals or customer support team;
• complete medical questionnaires or assessment forms;
• upload medical records, prescriptions or investigation reports;
• submit photographs, videos or rehabilitation progress updates;
• participate in surveys, feedback programmes or promotional activities;
• communicate with us through email, telephone, WhatsApp, SMS or other authorised communication channels.

7.2 Information Collected During Healthcare Services

As part of providing healthcare and rehabilitation services, our clinicians and authorised personnel may create or collect information including:

• clinical assessments;
• rehabilitation plans;
• physiotherapy notes;
• posture and gait assessments;
• range of motion measurements;
• pain assessments;
• exercise compliance records;
• treatment progress notes;
• recommendations and follow-up plans.

7.3 Information Collected Automatically

When you access our website or digital platforms, certain technical information may be collected automatically through cookies, server logs and similar technologies. Such information helps us:

• maintain platform security;
• monitor system performance;
• prevent fraud and abuse;
• improve user experience;
• analyse website traffic and usage trends.

7.4 Information Received from Third Parties

Where authorised by you or otherwise permitted under applicable law, we may receive Personal Data from:

• hospitals;
• treating doctors;
• physiotherapists;
• diagnostic centres;
• laboratories;
• insurance providers;
• employers sponsoring rehabilitation programmes;
• caregivers;
• authorised family members;
• publicly available sources where relevant and lawful.

We take reasonable steps to ensure that such information is processed only for lawful purposes.

8. Purposes for Which We Process Your Personal Data

We process Personal Data only for legitimate, specified and lawful purposes connected with our Services and business operations.

These purposes include, but are not limited to, the following:

8.1 Provision of Healthcare Services

To:

• assess your medical condition;
• develop rehabilitation plans;
• monitor treatment progress;
• provide physiotherapy and rehabilitation services;
• facilitate consultations;
• coordinate care with healthcare professionals;
• maintain continuity of care.

8.2 Clinical Documentation

To:

• create and maintain patient records;
• document assessments and treatment plans;
• record rehabilitation progress;
• maintain clinical history;
• ensure continuity of treatment;
• comply with professional healthcare standards.

8.3 Appointment Management

To:

• schedule appointments;
• send reminders;
• manage cancellations and rescheduling;
• coordinate follow-up consultations.

8.4 Communication

To communicate with you regarding:

• consultations;
• treatment recommendations;
• rehabilitation programmes;
• service updates;
• billing;
• payment confirmations;
• customer support;
• safety notices;
• regulatory communications.

8.5 Improvement of Services

We may analyse information to:

• improve rehabilitation programmes;
• enhance patient outcomes;
• improve our digital platforms;
• identify service quality improvements;
• develop new products and services;
• improve operational efficiency.

Where feasible and appropriate, such analysis may use anonymised or de-identified information that does not reasonably identify any individual.

8.6 Legal and Regulatory Compliance

To comply with:

• applicable laws;
• court orders;
• governmental requests;
• statutory obligations;
• regulatory requirements;
• professional healthcare obligations.

8.7 Fraud Prevention and Security

To:

• detect fraudulent activity;
• investigate suspected misuse;
• prevent unauthorised access;
• protect our systems;
• ensure patient safety;
• resolve disputes.

8.8 Business Operations

To:

• manage our business;
• conduct audits;
• manage finances;
• enforce our contractual rights;
• protect our legal interests;
• maintain insurance records;
• defend or pursue legal claims where necessary.

9. Consent

Respecting patient autonomy and privacy is fundamental to Kneesy's approach to healthcare.

Where required under applicable law, Kneesy will obtain your informed and voluntary consent before processing your Personal Data.

Your consent may be obtained through:

• online consent forms;
• electronic acknowledgements;
• digital signatures;
• written consent forms;
• recorded verbal consent where legally permissible;
• other legally recognised methods.

Where consent is the basis for processing, you are free to decline or withdraw your consent at any time.

However, if you choose not to provide certain Personal Data or withdraw consent for essential processing activities, Kneesy may be unable to provide certain healthcare, rehabilitation or support services.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

10. Processing of Health Information

As a healthcare technology platform, Kneesy processes Health Information only to the extent reasonably necessary for providing rehabilitation and related healthcare services.

Health Information may include:

• diagnoses;
• treatment records;
• rehabilitation plans;
• prescriptions;
• clinical assessments;
• investigation reports;
• imaging reports;
• laboratory reports;
• physiotherapy notes;
• progress records;
• posture assessments;
• exercise adherence records.

Such information is processed only by authorised personnel or trusted service providers who require access for legitimate clinical, operational or legal purposes and who are subject to appropriate confidentiality obligations.

Kneesy shall not use Health Information for unrelated commercial purposes without obtaining any consent required under applicable law.

11. AI-Assisted Rehabilitation and Clinical Decision Support

Kneesy may use artificial intelligence ("AI"), machine learning, computer vision and other advanced technologies to support the delivery of its Services.

These technologies may assist in:

• posture assessment;
• movement analysis;
• gait evaluation;
• exercise monitoring;
• rehabilitation progress tracking;
• identifying trends relevant to patient recovery;
• improving user experience;
• enhancing the quality and efficiency of rehabilitation services.

AI-generated outputs are intended solely as assistive tools to support healthcare professionals and patients.

Unless expressly stated otherwise, AI-generated observations, recommendations or insights:

• do not constitute medical advice;
• do not establish a diagnosis;
• do not replace professional clinical judgment;
• should not be relied upon as the sole basis for making healthcare decisions.

Clinical decisions remain the responsibility of appropriately qualified healthcare professionals.

Kneesy continuously evaluates and improves its AI systems to enhance accuracy, reliability and patient outcomes; however, no AI system is infallible, and users should understand that automated analyses may occasionally produce incomplete or inaccurate results.

12. Photographs, Videos and Audio Recordings

Subject to obtaining any consent required under applicable law, Kneesy may collect photographs, videos and audio recordings as part of delivering rehabilitation services.

These may include:

• posture photographs;
• movement videos;
• exercise recordings;
• gait assessment videos;
• consultation recordings;
• customer support call recordings;
• rehabilitation session recordings.

Such recordings may be used for:

• clinical assessment;
• treatment planning;
• monitoring rehabilitation progress;
• documenting patient outcomes;
• quality assurance;
• staff education and training;
• dispute resolution;
• medico-legal documentation;
• regulatory compliance.

Kneesy will not publicly publish identifiable photographs, videos or recordings for marketing, promotional or educational purposes without obtaining any additional consent required under applicable law.

13. Teleconsultation Services

Where healthcare services are delivered remotely, Kneesy may process Personal Data necessary to facilitate teleconsultations.

Teleconsultation services may involve:

• video conferencing;
• audio consultations;
• secure messaging;
• digital document exchange;
• remote rehabilitation monitoring.

While Kneesy employs reasonable safeguards to protect teleconsultation services, users acknowledge that electronic communications may be subject to limitations beyond the Company's reasonable control, including internet connectivity issues, hardware failures and interruptions affecting third-party communication platforms.

Patients should seek immediate emergency medical care through the appropriate emergency healthcare services and should not rely on teleconsultation services for medical emergencies.

14. Clinical Records

Kneesy maintains clinical records to ensure continuity of care, patient safety, regulatory compliance and appropriate documentation of healthcare services.

Clinical records may include:

• assessments;
• diagnoses;
• treatment plans;
• rehabilitation notes;
• consultation summaries;
• investigation reports;
• communications relevant to treatment;
• exercise records;
• progress reports.

These records form part of the patient's healthcare documentation and may be retained for periods required under applicable law, professional standards, insurance obligations or legitimate business purposes.

Nothing in this Privacy Policy shall require Kneesy to delete information where retention is necessary to comply with legal obligations, establish or defend legal claims, resolve disputes, prevent fraud, maintain patient safety or satisfy regulatory requirements.

15. Sharing and Disclosure of Personal Data

Kneesy respects the confidentiality of your Personal Data and Health Information. We do not sell, rent, trade or otherwise commercially exploit your Personal Data.

We may disclose your Personal Data only where such disclosure is necessary for the purposes described in this Privacy Policy, where you have provided your consent, or where disclosure is required or permitted under applicable law.

Your Personal Data may be shared with the following categories of recipients:

15.1 Healthcare Professionals

Your Personal Data may be shared with doctors, physiotherapists, rehabilitation specialists, consultants and other authorised healthcare professionals involved in your care where such sharing is necessary for the provision of healthcare services.

15.2 Diagnostic Centres and Hospitals

Where required for your treatment, referrals or continuity of care, we may share relevant medical information with hospitals, diagnostic centres, laboratories or other healthcare providers authorised by you or otherwise permitted by applicable law.

15.3 Caregivers and Family Members

Where you have expressly authorised us, or where legally permitted, we may disclose relevant information to your nominated caregiver, legal guardian or authorised family member to facilitate your care and rehabilitation.

15.4 Insurance Providers

Where you request insurance reimbursement or where processing is required for insurance-related purposes, we may share relevant information with insurers, third-party administrators or claims processors.

15.5 Employers and Corporate Clients

Where rehabilitation services are provided under an employer-sponsored wellness programme or corporate arrangement, Kneesy may share limited information necessary for programme administration, billing or reporting. Unless otherwise authorised or required by law, we will not disclose detailed medical information to employers without your consent.

15.6 Regulatory and Government Authorities

We may disclose Personal Data where required to comply with applicable law, judicial proceedings, court orders, governmental requests, investigations, regulatory requirements or lawful directions issued by competent authorities.

15.7 Professional Advisers

We may disclose Personal Data to our auditors, accountants, legal advisers, insurers and other professional advisers where such disclosure is reasonably necessary for legal, financial, compliance or risk management purposes.

15.8 Service Providers

We may share Personal Data with trusted third-party service providers engaged to support our operations, subject to appropriate contractual confidentiality and security obligations.

15.9 Protection of Rights

We may disclose Personal Data where we reasonably believe such disclosure is necessary to:

• protect the rights, property or safety of Kneesy, our employees, healthcare professionals or patients;
• prevent fraud or unlawful activity;
• investigate security incidents;
• enforce our contractual rights;
• establish, exercise or defend legal claims.

16. Third-Party Service Providers

Kneesy engages carefully selected third-party service providers to support the delivery, administration and improvement of our Services.

These providers may include:

• cloud hosting providers;
• electronic medical record (EMR) platforms;
• data storage providers;
• payment gateway providers;
• appointment scheduling platforms;
• telecommunication providers;
• email service providers;
• SMS and messaging providers;
• video conferencing platforms;
• customer relationship management systems;
• cybersecurity providers;
• website analytics providers;
• software maintenance vendors;
• customer support platforms.

Such providers process Personal Data only on our instructions and only to the extent necessary to provide their services.

Where appropriate, Kneesy enters into contractual arrangements requiring such providers to:

• maintain confidentiality;
• implement appropriate security measures;
• process Personal Data only for authorised purposes;
• comply with applicable legal obligations.

Kneesy remains responsible for exercising reasonable diligence in selecting service providers but cannot guarantee the independent security practices of third parties beyond the contractual and legal obligations imposed upon them.

17. International Transfers of Personal Data

Kneesy primarily stores and processes Personal Data within India.

However, in the course of providing our Services, certain information may be processed or stored using cloud infrastructure, software platforms or service providers located outside India, subject to applicable law.

Where Personal Data is transferred outside India, Kneesy shall take reasonable steps to ensure that such transfers are carried out in accordance with the Digital Personal Data Protection Act, 2023 and any applicable governmental restrictions relating to cross-border data transfers.

By using our Services and providing your Personal Data, you acknowledge that your information may be transferred, processed or stored in jurisdictions outside India where permitted under applicable law.

18. Information Security

Protecting the confidentiality, integrity and availability of Personal Data is a core commitment of Kneesy.

We maintain administrative, technical and organisational safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Such safeguards may include:

• encrypted data transmission where appropriate;
• encryption of data at rest where feasible;
• secure cloud infrastructure;
• role-based access controls;
• authentication mechanisms;
• password protection;
• firewalls;
• intrusion detection and prevention measures;
• endpoint protection;
• audit logging;
• periodic security assessments;
• secure backup procedures;
• employee confidentiality obligations;
• information security policies and training.

Access to Personal Data is limited to authorised personnel who require such access to perform their professional responsibilities.

While Kneesy implements reasonable safeguards consistent with industry practices, no method of electronic storage or internet transmission can be guaranteed to be completely secure. Accordingly, Kneesy cannot warrant or guarantee absolute security and disclaims liability for security incidents arising from circumstances beyond its reasonable control, including sophisticated cyberattacks, failures of third-party infrastructure or force majeure events, except to the extent liability cannot be excluded under applicable law.

19. Data Retention

Kneesy retains Personal Data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted under applicable law.

The retention period may depend upon:

• the nature of the information;
• the healthcare services provided;
• applicable legal or regulatory requirements;
• professional healthcare standards;
• contractual obligations;
• insurance requirements;
• accounting and taxation obligations;
• dispute resolution;
• fraud prevention;
• enforcement of legal rights.

Medical records and clinical documentation may be retained for periods prescribed by applicable law, professional standards or legitimate operational requirements.

Where Personal Data is no longer required, Kneesy will take reasonable steps to securely delete, anonymise or otherwise dispose of such information, unless continued retention is required by law or is reasonably necessary to protect legitimate legal or business interests.

20. Cookies and Similar Technologies

Our website may use cookies, web beacons, pixels and similar technologies to improve functionality, security and user experience.

These technologies may be used to:

• remember user preferences;
• maintain secure sessions;
• analyse website performance;
• measure visitor engagement;
• improve website functionality;
• detect fraudulent activity;
• understand usage patterns.

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality and performance of our Services.

Additional information regarding our use of cookies may be provided through a separate Cookie Policy where appropriate.

21. Use of De-Identified and Anonymised Information

Kneesy may aggregate, anonymise or de-identify Personal Data so that it can no longer reasonably identify an individual.

Subject to applicable law, such anonymised or de-identified information may be used for purposes including:

• clinical research;
• quality improvement;
• product development;
• service enhancement;
• artificial intelligence model improvement;
• statistical analysis;
• academic collaborations;
• publication of research findings;
• internal reporting.

Where data has been irreversibly anonymised such that individuals are no longer identifiable, such information may no longer constitute Personal Data under applicable law.

Kneesy will not knowingly attempt to re-identify anonymised datasets except where required for lawful validation, security testing or regulatory purposes.

22. Corporate Restructuring and Business Transfers

In the event of a merger, acquisition, investment, corporate restructuring, reorganisation, sale of assets, financing transaction or other business transfer involving Kneesy or Integrated Rehabtech Systems Private Limited, Personal Data may be transferred to the relevant successor entity or prospective transaction parties, subject to appropriate confidentiality obligations and applicable law.

Any successor entity receiving such Personal Data shall continue to process the information in accordance with this Privacy Policy or a substantially similar privacy framework, unless otherwise required by applicable law.

Where legally required, Kneesy will provide appropriate notice regarding such transfers.

23. Your Rights as a Data Principal

Kneesy is committed to respecting the rights available to individuals under the Digital Personal Data Protection Act, 2023 and other applicable laws.

Subject to applicable law and any lawful limitations, you may exercise the following rights in relation to your Personal Data.

23.1 Right to Access Information

You may request information regarding:

• the categories of Personal Data processed by Kneesy;
• the purposes for which your Personal Data is processed;
• the categories of recipients with whom your Personal Data has been shared;
• the manner in which you may exercise your rights under applicable law.

Nothing in this clause shall require Kneesy to disclose information protected by legal privilege, commercially confidential information, information relating to another individual or information that cannot lawfully be disclosed.

23.2 Right to Correction and Updating

If you believe that any Personal Data maintained by Kneesy is inaccurate, incomplete or outdated, you may request that it be corrected or updated.

Kneesy may require reasonable verification before making any corrections.

Where correction is not legally or clinically appropriate, including where historical medical records must accurately reflect contemporaneous clinical observations, Kneesy may retain the original record while recording the requested correction or clarification in accordance with applicable healthcare practices.

23.3 Right to Erasure

You may request the deletion of your Personal Data where:

• the Personal Data is no longer necessary for the purpose for which it was collected;
• you withdraw your consent and no other lawful basis for continued processing exists;
• applicable law requires deletion.

Kneesy may decline or defer deletion where retention is necessary:

• to comply with applicable law;
• to maintain clinical records;
• to comply with professional healthcare obligations;
• for accounting or taxation purposes;
• for insurance requirements;
• to establish, exercise or defend legal claims;
• for fraud prevention;
• to resolve disputes;
• to protect patient safety;
• for any other lawful purpose permitted under applicable law.

Where complete deletion is not possible, Kneesy may securely archive, restrict access to or anonymise the relevant information where appropriate.

23.4 Right to Nominate

Where permitted under applicable law, you may nominate another individual to exercise your rights under the Digital Personal Data Protection Act, 2023 in the event of your death or incapacity.

Kneesy may require appropriate documentation before recognising such nomination.

23.5 Right to Grievance Redressal

If you have concerns regarding the manner in which Kneesy processes your Personal Data, you may contact our Grievance Officer using the contact details provided in this Privacy Policy.

Kneesy will endeavour to acknowledge and address grievances within a reasonable period in accordance with applicable law.

24. Withdrawal of Consent

Where processing of Personal Data is based upon your consent, you may withdraw such consent at any time by contacting Kneesy using the contact details provided in this Privacy Policy or through any other mechanism that may be made available by us.

Withdrawal of consent shall not affect the lawfulness of any processing undertaken prior to such withdrawal.

Please note that withdrawal of consent may affect Kneesy's ability to:

• continue providing rehabilitation services;
• maintain ongoing treatment plans;
• conduct follow-up assessments;
• communicate regarding appointments;
• monitor rehabilitation progress;
• provide certain digital healthcare services.

Where continued retention of Personal Data is required by law, professional standards, contractual obligations or legitimate legal interests, Kneesy may retain such information notwithstanding the withdrawal of consent.

25. Marketing Communications

With your consent where required by applicable law, Kneesy may send you information regarding:

• new services;
• healthcare programmes;
• rehabilitation initiatives;
• educational content;
• newsletters;
• health awareness campaigns;
• promotional offers;
• events and webinars.

You may opt out of receiving marketing communications at any time by:

• clicking the unsubscribe link in our emails;
• contacting us directly;
• updating your communication preferences where available.

Please note that even if you opt out of marketing communications, Kneesy may continue to send service-related communications including appointment reminders, treatment updates, invoices, security notifications and other communications necessary for providing our Services.

26. Children's Privacy

Kneesy provides rehabilitation services to individuals of various age groups, including minors where appropriate.

Where Personal Data relates to a child or a person with a legal disability, Kneesy will process such information in accordance with applicable law and, where required, obtain consent from the child's parent, lawful guardian or other authorised representative.

Parents and guardians are encouraged to supervise children's use of digital platforms and ensure that only accurate and necessary information is shared.

27. Third-Party Websites and Services

Our website and digital platforms may contain links to websites, applications or services operated by third parties.

Kneesy does not control and is not responsible for the privacy practices, content, availability or security of such third-party services.

Your use of third-party websites is governed by the privacy policies and terms of those respective providers.

We encourage you to review their privacy policies before sharing your Personal Data.

28. Changes to This Privacy Policy

Kneesy may amend or update this Privacy Policy from time to time to reflect:

• changes in applicable law;
• regulatory guidance;
• technological developments;
• changes to our Services;
• changes to our business operations;
• security enhancements;
• improvements in our privacy practices.

The updated Privacy Policy shall become effective upon publication on our website unless otherwise stated.

Where required by applicable law, we will provide additional notice or obtain fresh consent before implementing material changes affecting the processing of your Personal Data.

Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised Privacy Policy to the extent permitted by applicable law.

29. Grievance Officer

If you have any questions, concerns or complaints regarding this Privacy Policy or the processing of your Personal Data, or if you wish to exercise any rights available to you under applicable law, you may contact our Grievance Officer.

Grievance Officer

Integrated Rehabtech Systems Private Limited
Office No. 3, White House,
Next to Om Hospital,
Above Third Wave Coffee,
Dr. Homi Bhabha Road,
Amchi Colony,
Bavdhan,
Pune – 411021,
Maharashtra, India

Email:
admin@kneesy.com

Telephone:
+91 9719714800

Kneesy will make reasonable efforts to respond to privacy-related requests and grievances within the timelines prescribed under applicable law.

30. Contact Us

If you have any questions regarding this Privacy Policy or our privacy practices, please contact us using the details below:

Kneesy Health

Operated by Integrated Rehabtech Systems Private Limited

Email:
admin@kneesy.com

Telephone:
+91 9719714800

Registered Office:

Office No. 3, White House,
Next to Om Hospital,
Above Third Wave Coffee,
Dr. Homi Bhabha Road,
Amchi Colony,
Bavdhan,
Pune – 411021,
Maharashtra, India

31. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India.

Any dispute arising out of or relating to this Privacy Policy, the processing of Personal Data or the use of the Services shall be subject to the exclusive jurisdiction of the competent courts located in Pune, Maharashtra, unless otherwise required by applicable law.

Nothing contained in this Privacy Policy shall restrict any statutory rights available to Data Principals under applicable law.

32. Responsible Use of Artificial Intelligence

Kneesy may utilise artificial intelligence ("AI"), machine learning, computer vision and other automated technologies to enhance the quality, accessibility and efficiency of its healthcare and rehabilitation services.

These technologies are designed to support healthcare professionals by assisting with functions such as movement analysis, posture assessment, rehabilitation monitoring, exercise tracking, progress evaluation and service improvement.

Kneesy is committed to the responsible and ethical use of AI. Accordingly:

• AI-generated outputs are intended solely as clinical support tools and shall not replace the independent professional judgment of a qualified healthcare professional.
• Significant clinical decisions relating to diagnosis, treatment planning or patient management shall remain the responsibility of appropriately qualified healthcare professionals.
• Kneesy continually evaluates and improves its AI systems; however, AI outputs may occasionally be incomplete, inaccurate or inappropriate for a particular patient.
• Patients should not make healthcare decisions solely on the basis of AI-generated observations or recommendations.
• Where reasonably practicable, Kneesy will maintain appropriate human oversight over AI-assisted clinical workflows.

Nothing in this Privacy Policy shall be construed as a representation or warranty regarding the accuracy, completeness or reliability of AI-generated outputs.

33. No Sale of Personal Data

Kneesy does not sell, rent, lease, license or otherwise commercially trade Personal Data or Health Information to third parties.

Kneesy also does not knowingly permit third parties to use Personal Data for behavioural advertising or unrelated commercial profiling.

Any disclosure of Personal Data is made only for the purposes described in this Privacy Policy, with your consent where required, or where otherwise permitted or required by applicable law.

34. Healthcare Disclaimer

Kneesy provides technology-enabled healthcare and rehabilitation services.

Information available through our website, digital platforms, educational materials, blogs, newsletters, webinars or other content is provided solely for general educational and informational purposes.

Such information:

• is not intended to constitute medical advice;
• should not be interpreted as a substitute for consultation with a qualified healthcare professional;
• should not be relied upon as the sole basis for making healthcare decisions;
• does not establish a doctor-patient relationship merely by accessing the website or viewing educational content.

Nothing contained on the website should be interpreted as guaranteeing any particular treatment outcome or recovery.

35. Emergency Medical Services

Kneesy's digital platforms, teleconsultation services and rehabilitation programmes are not intended to replace emergency medical care.

If you believe you are experiencing a medical emergency, including severe pain, chest pain, stroke symptoms, difficulty breathing, significant trauma or any other life-threatening condition, you should immediately contact your local emergency medical services or visit the nearest hospital.

Kneesy shall not be responsible for delays or adverse outcomes arising from reliance upon its digital services during a medical emergency.

36. User Responsibilities

By using the Services, you acknowledge and agree that you are responsible for:

• providing accurate, complete and up-to-date information;
• informing Kneesy of any material changes to your medical condition where relevant to the Services;
• ensuring that any documents, photographs, videos or records uploaded by you are authentic and lawfully provided;
• obtaining any permissions or authorisations necessary before submitting information relating to another individual;
• protecting the confidentiality of your account credentials where applicable;
• using the Services in accordance with applicable law.

Kneesy shall not be responsible for inaccuracies or adverse consequences arising from incomplete, inaccurate or misleading information provided by users.

37. Limitation of Liability

To the maximum extent permitted by applicable law, Kneesy shall not be liable for any indirect, incidental, special, exemplary, punitive or consequential loss or damage arising from or relating to:

• interruption of the Services;
• internet failures;
• telecommunications failures;
• hardware or software malfunctions;
• third-party platform outages;
• unauthorised access despite reasonable security measures;
• cyberattacks beyond Kneesy's reasonable control;
• delays in transmission;
• corruption of data caused by third-party infrastructure;
• force majeure events.

Nothing contained in this Privacy Policy excludes or limits liability where such exclusion is prohibited under applicable law.

38. Force Majeure

Kneesy shall not be responsible for any failure or delay in performing its obligations under this Privacy Policy where such failure results from events beyond its reasonable control, including but not limited to:

• natural disasters;
• floods;
• earthquakes;
• pandemics;
• epidemics;
• governmental actions;
• civil unrest;
• strikes;
• war;
• acts of terrorism;
• power failures;
• failures of communication networks;
• failures of cloud service providers;
• cyber incidents beyond reasonable preventive measures.

39. Severability

If any provision of this Privacy Policy is held to be unlawful, invalid or unenforceable by a court or competent authority, such provision shall be deemed severed to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

40. No Waiver

Failure by Kneesy to enforce any provision of this Privacy Policy shall not constitute a waiver of any rights or remedies available to it under applicable law.

Any waiver shall be effective only if made expressly in writing by an authorised representative of the Company.

41. Interpretation

Headings contained in this Privacy Policy are included solely for convenience and shall not affect the interpretation of any provision.

References to statutes include amendments, re-enactments and subordinate legislation issued thereunder.

Words importing the singular shall include the plural and vice versa where the context so requires.

42. Entire Privacy Policy

This Privacy Policy constitutes the entire privacy policy governing the collection, processing, storage, disclosure and protection of Personal Data by Kneesy in connection with the Services.

Nothing contained in this Privacy Policy limits any statutory rights available to Data Principals under applicable law.

Where separate consent forms, teleconsultation consents, treatment consents, website terms of use or contractual agreements apply, such documents shall be read together with this Privacy Policy. In the event of any inconsistency, the document that provides the greater protection to the Data Principal or is required by applicable law shall prevail to the extent of such inconsistency.

Last Updated: July 2026

Version: 2.0