top of page

Atrea

Dr FRIDAY Face Scan: Terms of Service

Last updated on 23-10-2026 15:25:06

SECTION A: WHO WE ARE AND WHAT THIS APP DOES

1. Who We Are

The Dr FRIDAY Face scan App ("the App," "we," "us," "our") is a mobile application provided by your clinic to help patients and caregivers track health and wellness information, and to help your treating doctor manage patient access to the App's features.

The App is a supportive digital tool furnished by your clinic within an existing clinical doctor-patient relationship. It is not an autonomous, stand-alone medical service and does not replace your direct clinical relationship with your doctor.

The specific clinic providing this App to you, along with its contact details for any clinical or data-protection inquiries, is identified to you at the clinic premises and within the App's doctor-contact profile. Please refer to your treating doctor's registered clinic entity for the designated legal entity and corporate address responsible for the clinical deployment of this App.

2. Who Can Use the App

The App is intended exclusively for use by:

  • Registered patients of the participating clinic;

  • Authorized family members or designated caregivers acting on behalf of patients; and

  • Treating medical practitioners and clinical staff associated with the clinic.

To access the service, you must possess and maintain an active, valid mobile telephone number capable of receiving SMS transmissions, as authentication relies strictly on SMS-based One-Time Passcodes (OTP).

2a. Users Under 18 (Minors)

Under India’s Digital Personal Data Protection Act, 2023 (the "DPDP Act"), processing personal data belonging to any individual under the age of 18 requires lawful, verifiable consent from a parent or legal guardian:

  • If a patient using the App is under 18 years of age, a parent or legal guardian must complete the onboarding registration, provide consent on their behalf, and supervise the minor’s ongoing use of the App.

  • We do not knowingly process or profile the personal data of any user—minor or adult—for behavioral tracking, ad-targeting, or commercial profiling.

  • We do not display advertisements of any nature within the App.

3. Core Functionality of the App

  • Patients & Caregivers: Can view structured health and demographic details stored within their profile (name, age, sex, height, weight, and lifestyle context such as smoking status, hypertension medication, and diabetes history).

  • Treating Doctors: Can access their assigned patient lists, allocate scan credits to patient accounts, monitor scan completion histories, and review credit ledger balances.

  • Optical Face Scan: Includes an opt-in, camera-driven vitals screening assessment (~30-second optical scan) described in full detail under Section B.2.

  • Clinic Communications: When activated by your clinic, summary scan confirmations may be communicated via clinic-managed channels in accordance with Section B.4.

SECTION B: HEALTH, MEDICAL, AND FACE-SCAN DISCLOSURES

1. Not a Diagnostic Medical Device

MANDATORY CLINICAL NOTICE:

Dr. Friday Face Scan is a wellness screening indicator and does not constitute a certified medical diagnosis. Always consult a licensed healthcare professional for clinical assessment.

  • No Medical Claims: The App, its visual dashboards, and its camera-based scan estimations are not medical devices and do not diagnose, treat, cure, mitigate, or prevent any illness, disease, or medical condition.

  • Supportive Tool Only: All data points are generated solely for personal wellness tracking and to provide supplementary trend data for your treating physician.

  • Emergency Protocol: Never rely on the App for acute medical decisions or emergency health situations. In any emergency, immediately dial your local emergency services (such as 112 in India) or proceed to the nearest emergency department.

  • Regulatory Compliance: This disclosure strictly aligns with the guidelines set by India’s Central Drugs Standard Control Organisation (CDSCO) and Google Play’s Health Content Policy for applications that are not certified as clinical-grade diagnostic medical devices.

2. Specific Disclosures Regarding Face-Scan Technology

The App’s optical vitals screening feature incorporates proprietary facial blood-flow analysis software licensed from NuraLogix Corporation (commercialized under the "Anura" platform, powered by "DeepAffex® AI", utilizing patented Transdermal Optical Imaging / "TOI" technology).

According to NuraLogix Corporation's published technical documentation:

"This solution provides FDA-cleared measurements of Pulse Rate (Heart Rate) and Breathing Rate, together with a broad range of health and wellness insights designed to support personal health awareness and healthy lifestyle choices.

Health insights, wellness metrics, and condition likelihood assessments beyond the FDA-cleared Pulse Rate (Heart Rate) and Breathing Rate measurements are intended for informational and wellness purposes only. These features are not intended to diagnose, treat, cure, mitigate, monitor, or prevent any disease or medical condition.

The information provided by this solution is not a substitute for professional medical advice, diagnosis, or treatment. Users should consult a qualified healthcare professional regarding any medical concerns or healthcare decisions."

Clear Boundaries of U.S. FDA 510(k) Clearance:

  1. Scope of Clearance: Only Pulse Rate (Heart Rate) and Breathing Rate have obtained Class II 510(k) clearance from the United States Food and Drug Administration (U.S. FDA 510(k) K253650, for NuraLogix's "Anura Mobile Core SDK (M1)").

  2. General Wellness Indicators: All other metrics surfaced by the platform—including algorithmic estimates of blood pressure, blood oxygen saturation (SpO2), mental stress indicators, and metabolic risk flags—do not carry FDA clearance. They are delivered solely as informational wellness indicators. We will never represent uncertified indicators as "clinical-grade," "clinically validated," or diagnostic.

  3. Jurisdictional Limit: The 510(k) clearance originates strictly from the United States FDA. It does not constitute a clearance, license, or medical device registration by India's CDSCO, nor does it qualify the Dr FRIDAY Face scan application itself as a medical device under Indian law.

  4. Hardware Dependencies: Optical screening requires a compatible, functioning front-facing camera in adequate lighting. If your smartphone camera cannot establish an adequate optical signal, the session will abort with an explanatory error notice, and no scan credit will be deducted.

  5. Session Execution: A standard scan session lasts approximately 30 seconds. Video frames captured by your camera are processed in real-time in memory to extract raw transdermal optical blood-flow signals; raw facial video footage and photographs are never saved to disk or permanently recorded.

  6. Third-Party Processing Standards: NuraLogix operates the DeepAffex cloud under its certified international quality management frameworks (including ISO 13485 and MDSAP medical-device quality certifications). While we rely on NuraLogix's contractual guarantees, this does not waive our direct obligations to you as a statutory Data Fiduciary under Indian law.

3. Access by Treating Medical Practitioners

Authorized healthcare professionals registered with your clinic and assigned to your care (as well as approved caregivers linked to your profile) are granted direct system access to view your health indicators and scan chronologies. This multi-user access is fundamental to the clinical purpose of the App and is governed strictly by professional confidentiality and clinical protocol.

4. WhatsApp and Third-Party Messaging Disclosures

The App does not transmit health records or face-scan metrics to WhatsApp or other third-party instant-messaging providers. All scan logs are retained and reviewed strictly within the secure application environment. Should clinic-to-patient messaging integrations be implemented in the future, we will update these Terms, update the Privacy Policy, and collect your advance, affirmative consent before transmitting any data over external channels.

5. Inapplicability of U.S. HIPAA and Foreign Statues

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") is a United States federal statute that regulates specific U.S. "Covered Entities" (e.g., U.S. hospitals, insurance carriers, and healthcare clearinghouses).

The Dr FRIDAY Face scan application is deployed within the Republic of India to serve Indian clinical institutions and patients. HIPAA is inapplicable to this service. Your data is governed strictly by Indian data protection statutes, primarily the Digital Personal Data Protection Act, 2023, and applicable Indian healthcare data standards. We make no representations of HIPAA adherence.

SECTION C: YOUR DATA AND YOUR RIGHTS (DPDP ACT, 2023 NOTICE)

This section provides statutory notice under Section 5 of India's Digital Personal Data Protection Act, 2023. A consumer-friendly, itemized summary is available on our website at https://www.atrea.in/privacy-policy

1. Categories of Personal Data Processed

Data Category

Specific Elements

Operational Purpose

Identity & Authentication

Mobile phone number

User identification and secure OTP session management.

Health Profile

Name, age, sex, height, weight

Clinical profile building; calibration data supplied to NuraLogix to compute biometric outputs.

Clinical Context

Smoking history, blood pressure medication, diabetes status

Context for your physician; parameter inputs required by NuraLogix to run physiological models.

Safety Contacts

Emergency contact name & phone number

Optional safety reference recorded solely if entered by you.

Optical Signal Feed

Real-time optical video stream

Extraction of facial blood-flow signals during active scans. Video streams are processed transiently in memory; no video is recorded or stored.

Audio Dictation

Transient voice input

Enabled only if you press the microphone button for speech-to-text input. Audio is handled by your phone's native OS speech engine (e.g., Google); we do not record, intercept, or store voice files.

Telemetry & System Logs

Device model, OS build, crash telemetry

Service stability, bug resolution, and crash monitoring via Google Firebase.

2. Geographic Infrastructure and Cross-Border Transfers

  • Core Encrypted Database (India): Patient profile details, credit logs, and historical wellness results are stored and encrypted at rest on Amazon Web Services (AWS) data centers located in Mumbai, India (ap-south-1).

  • Authentication & Analytics Infrastructure: Firebase Authentication and Firebase Crashlytics operate across Google's distributed global cloud facilities under Google's data processing terms.

  • Scan Computation Pipeline (NuraLogix Cloud): During an active scan, the extracted blood-flow signal and your profile answers (age, sex, height, weight, smoking, hypertension meds, diabetes) are transmitted via encrypted TLS to NuraLogix's DeepAffex processing servers located in Tokyo, Japan (Asia-East Region).

    • Strict Data Minimization: Your name, mobile number, raw photos, and raw video files are never transmitted to NuraLogix.

    • Mandatory Calibrations: Lifestyle and demographic inputs are computationally necessary to determine blood pressure and metabolic risk estimates; without them, the engine cannot return complete wellness readings.

    • Statutory Compliance: Cross-border transfer of personal data for cloud processing is fully compliant with Section 16 of the DPDP Act, 2023, as Japan is not on any government-restricted blacklisted territory.

3. Statutory Rights of Data Principals

As a Data Principal under the DPDP Act, 2023, you hold enforceable rights:

  1. Right to Access & Information: Obtain a summary of the personal data held about you and a list of entities with whom it has been shared.

  2. Right to Correction & Erasure: Request the correction of inaccurate data, the completion of missing fields, or the deletion of obsolete data.

  3. Right of Grievance Redressal: Access readily available grievance resolution mechanisms provided by the Data Fiduciary.

  4. Right to Nominate: Nominate any legal individual to exercise your statutory rights in the event of your death or physical/mental incapacity.

Exercising Rights: You may delete your account directly inside the App via About > Delete account. For all other statutory inquiries, reach out directly to your clinic or our Grievance Officer at atreahealthcare@gmail.com. We address grievances promptly and strictly within the statutory timeframe mandated by the DPDP Rules. If unresolved, you may lodge a complaint with the Data Protection Board of India.

4. Retention Schedule and Account Deletion

  • Active Retention: Clinical records, scan records, and profile details remain accessible as long as your account is maintained.

  • Immediate Deletion: Initiating self-service deletion in the App (About > Delete account authenticated via OTP) triggers immediate erasure of your profile records, scan results, scan credit balances, and clinic-practitioner links.

  • Statutory Preservation Exceptions: Following account termination, we retain solely:

    1. System access audit trails and records of consent for two (2) years, in compliance with mandatory statutory retention rules under the DPDP Rules. These records are read-only and restricted from all active operational access.

    2. Invoicing, purchase, and taxation ledger records for periods mandated by Indian corporate and accounting laws.

  • Caregiver Disconnection Notice: Deleting a caregiver's master account does not destroy or purge the health records of patients registered by that caregiver. Those clinical records remain vested in the individual patient and their primary clinic.

5. Data Fiduciary Contact

Your treating clinic acts as the primary Data Fiduciary for clinical information. For general inquiries, or to contact the designated grievance officer:

6. Incident and Breach Notification Protocol

If an unforeseen cybersecurity event compromises personal data and creates an identifiable risk of harm, we will notify affected Data Principals and submit an official notice to the Data Protection Board of India without delay, adhering strictly to the notification protocols and 72-hour reporting requirements established under the DPDP Rules.

7. Commitments of the Data Fiduciary (Section 8, DPDP Act)

As the Data Fiduciary under the DPDP Act, 2023, we undertake the following legal commitments:

  1. Processor Governance: We assume direct responsibility for processing conducted on our behalf by Data Processors (including AWS and NuraLogix), executing valid, binding contracts with each processor.

  2. Data Integrity: We take reasonable steps to maintain data accuracy and consistency where data is utilized to make clinical determinations or shared with authorized clinical personnel.

  3. Technical Controls: We maintain organizational and software controls designed to realize statutory privacy protections in actual practice.

  4. Data Minimization & Erasure: We delete personal data upon purpose completion or upon receipt of a valid consent withdrawal, save where retention is required by Indian law.

8. Duties of the Data Principal (Section 15, DPDP Act)

The DPDP Act establishes reciprocal legal duties upon you as a Data Principal:

  • Authenticity of Information: You must furnish only verifiably authentic, accurate personal data when setting up your profile. Fabricating health parameters compromises your clinical care.

  • Prohibition of Impersonation: You may not register a mobile number that does not belong to you, nor assume a false identity. Caregivers must register only under bona fide authority.

  • No Material Suppression: You agree not to conceal or suppress material identity details when undergoing verification.

  • Bona Fide Inquiries: You agree not to file false, malicious, or frivolous complaints with the Grievance Redressal mechanism or the Data Protection Board.

SECTION D: GENERAL TERMS

1. Amendments to these Terms

We may update these Terms periodically to accommodate application updates, regulatory updates, or changes in clinical operations. When revisions take place, the "Last Updated" timestamp will reflect the new date. Your continued utilization of the App following posted updates constitutes acceptance of the modified Terms.

2. Information Security Standards

We enforce technical and administrative safeguards as required under the DPDP Act to guard against data loss, unauthorized access, or unauthorized alteration:

  • Transport Encryption: All traffic between the App and backend servers is encrypted using modern TLS / HTTPS.

  • Storage Encryption: Databases and scan archives are encrypted at rest on AWS infrastructure using AES-256 standards.

  • Access Governance: Partitioned role-based access limits data visibility solely to the authentic user, their assigned doctor, and validated caregivers.

  • Passwordless Security: Eliminating static passwords in favor of OTP session verification prevents credential stuffing and brute-force access attempts.

3. Limitation of Liability

To the maximum extent permissible under Indian law:

  • The App and all associated services are delivered on an "AS IS" and "AS AVAILABLE" basis as an adjunct wellness tool.

  • We, our developers, licensed technology providers (including NuraLogix Corporation), and associated clinics disclaim liability for any medical complications, clinical oversights, or physical injury resulting from your failure to seek independent medical evaluation from a licensed healthcare provider.

  • Our total cumulative liability arising out of or related to the App, whether in contract, tort, or otherwise, shall not exceed the total fees paid by you (if any) directly for App scan credits in the twelve (12) months immediately preceding the occurrence of the claim.

4. Governing Law and Dispute Jurisdiction

These Terms of Service are governed by and construed in accordance with the substantive laws of the Republic of India.

Any dispute, legal claim, controversy, or proceeding arising out of or related to these Terms or the App shall be subject to the exclusive jurisdiction of the competent civil courts located in the territory of the registered operating office of the Data Fiduciary.

5. Final Acceptance

By tapping "I Agree" (or by logging in via OTP and using the App), you confirm that:

  1. You have read, understood, and agreed to be bound by these Terms of Service;

  2. You have reviewed the Health and Medical Disclaimers in Section B; and

  3. You provide informed, clear consent to the data processing practices and cross-border transfers described in Section C.

bottom of page