Data Processing Agreement

This Data Processing Agreement (“DPA”) forms an integral, legally binding part of the Terms of Service between Aromatic Intelligence Pvt Ltd (“Aromatic Intelligence”, “Data Processor”, “we”, or “us”), a company incorporated in India with operations in Bengaluru, Karnataka, and the subscriber, healthcare clinic, business, or enterprise entity (“Customer”, “Data Fiduciary”, or “you”) utilizing the Aromatic Intelligence Voice AI platform.

This Agreement is executed in strict adherence to Section 8 and related provisions of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) (“DPDP Act 2023”) enacted by the Parliament of India, the Information Technology Act, 2000, and the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018) promulgated by TRAI.

This DPA applies to all electronic processing of personal data arising from inbound phone calls, SIP audio streams, live voice transcriptions, uploaded knowledge base vector documents, automated appointment bookings, and WhatsApp post-call follow-ups initiated or received through the Platform.

Capitalized terms used in this DPA shall have the meanings ascribed to them under Section 2 of the DPDP Act 2023:

• “Data Fiduciary”: Any person who alone or in conjunction with other persons determines the purpose and means of processing personal data (Section 2(i)). Herein, the Customer.
• “Data Processor”: Any person who processes personal data on behalf of a Data Fiduciary (Section 2(k)). Herein, Aromatic Intelligence Pvt Ltd.
• “Data Principal”: The individual to whom the personal data relates (Section 2(j)), including patients, clients, callers, and end-users dialing the Customer’s phone lines or receiving WhatsApp messages.
• “Personal Data”: Any data about an individual who is identifiable by or in relation to such data (Section 2(t)), including caller phone numbers, spoken names, transcribed queries, voice audio recordings, and appointment schedules.
• “Personal Data Breach”: Any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data (Section 2(u)).
• “DPBI”: The Data Protection Board of India established under Section 18 of the DPDP Act 2023.

The parties explicitly agree and stipulate to the following allocation of responsibilities under Indian law:

Aromatic Intelligence shall process Customer Personal Data solely to deliver the specific features offered on our platform:

• Real-Time Conversational Turn-Taking: Ingesting inbound audio packets over WebRTC and SIP trunks, converting speech into text (streaming STT), synthesizing contextual voice responses (TTS), and transmitting audio back to the caller.
• Ground-Truth Knowledge Base Retrieval (RAG): Indexing PDFs, clinic treatment menus, operating hours, and doctor bios uploaded by the Customer into vector databases to anchor answers directly to verified clinic documents.
• Guided Multi-Step Intake & Booking: Step-by-step extraction of caller name, contact number, chief complaint/inquiry, preferred doctor/service, and time slot, with automated reservation into calendar platforms.
• Coexistence for WhatsApp Business: Dispatching booking confirmations, directions, or intake summaries via the official WhatsApp Business Platform without disrupting front-desk staff smartphones.
• Dashboard Call History: Presenting call durations, audio playback, full transcripts, and sentiment metrics inside the Customer’s authenticated workspace console.

Under Section 5 and Section 6 of the DPDP Act 2023, the Customer (as Data Fiduciary) bears the legal obligation to ensure that all processing of Data Principal personal data is backed by valid consent or a legitimate use recognized under the Act:

• AI Voice Disclosure (SGI Compliance): In accordance with the Information Technology Rules (Intermediary Guidelines and Digital Media Ethics Code) and Synthetically Generated Information guidelines, the Customer must ensure that the AI agent provides a clear opening announcement informing callers that they are interacting with an AI system (e.g., “Hello, this is an automated AI assistant for [Clinic Name]...”).
• Call Recording Notice: If call recording is enabled in the Customer dashboard, the Customer must include an audio disclosure (e.g., “This call is recorded for quality, appointment confirmation, and record verification...”) prior to gathering personal identifiers.
• Consent for WhatsApp Messaging: The Customer warrants that callers have provided express or implied consent to receive post-call confirmation messages on their WhatsApp number for the purpose of appointment fulfillment.

Aromatic Intelligence implements rigorous technical and organizational measures to prevent personal data breaches, in full compliance with Section 8(5) of the DPDP Act 2023:

The Customer grants general written authorization to Aromatic Intelligence to engage the following categories of specialized sub-processors strictly required for the sub-900ms voice AI pipeline:

Aromatic Intelligence shall impose data protection obligations on any sub-processor that are no less protective than those stipulated in this DPA. Transfers of personal data outside India comply with Section 16 of the DPDP Act 2023.

Under Chapter III of the DPDP Act 2023, Data Principals possess statutory rights. Aromatic Intelligence shall provide technical assistance to enable the Data Fiduciary to respond to requests within statutory timelines:

• Right to Access (Section 11): The Customer console allows administrators to export comprehensive call transcripts, caller profiles, and audio recordings for any caller upon request.
• Right to Correction & Erasure (Section 12): The Customer can delete specific call recordings, wipe customer notes, or completely purge caller phone records via dashboard controls or by contacting support.
• Right of Grievance Redressal (Section 13): Any complaints forwarded to Aromatic Intelligence regarding automated answering shall be acknowledged within 24 hours.
• Right to Nominate (Section 14): The Data Fiduciary may request transfer or handling of account management in accordance with valid legal nomination requests.

In accordance with Section 8(6) of the DPDP Act 2023, in the event of a confirmed Personal Data Breach impacting Customer data under our custody:

1. Immediate Notice: Aromatic Intelligence will notify the affected Customer without unreasonable delay (and within 24 to 48 hours of confirmation) via the registered administrator email.
2. Incident Report: The notice shall specify the nature of the breach, affected data categories, estimated number of affected Data Principals, probable consequences, and remedial measures deployed.
3. DPBI Cooperation: Aromatic Intelligence shall actively cooperate with the Customer to facilitate mandatory notifications required to be made to the Data Protection Board of India (DPBI) and affected Data Principals under Indian law.

Pursuant to Section 8(7) of the DPDP Act 2023 (Storage Limitation), upon expiration or termination of the Customer’s subscription, or upon receipt of a verified deletion request:

Aromatic Intelligence shall securely erase or anonymize all Customer Personal Data, audio recordings, transcripts, and vector embeddings within thirty (30) days, except where retention is strictly mandated by Indian law (such as Call Detail Records required under Department of Telecommunications unified license regulations or GST tax invoices under the Central Goods and Services Tax Act, 2017).

The Customer warrants and covenants that:

• All provisioned carrier lines and forwarded telephone numbers will be utilized exclusively for legitimate business communications, customer care, and requested scheduling inquiries.
• The Customer shall not use the voice AI platform for unsolicited telemarketing calls, automated bulk cold-calling campaigns, or any practice in contravention of the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018) or the National Do Not Call (NDNC) registry.
• The Customer holds Aromatic Intelligence harmless and indemnified against any statutory penalties, TRAI fines, or carrier disconnection orders arising from unlawful telephonic practices initiated by the Customer.

In accordance with Section 8(9) and Section 13 of the DPDP Act 2023, Aromatic Intelligence has appointed a designated Grievance Officer to address questions, security inquiries, and data principal requests:

If a Data Principal or Data Fiduciary is dissatisfied with the resolution provided by our Grievance Officer, they hold the statutory right to appeal to the Data Protection Board of India (DPBI) pursuant to Section 13(3) of the DPDP Act 2023.