Privacy Policy

This Privacy Policy describes how Suja Associates Private Limited, operating under the brand name Suja HealthTech (“Suja HealthTech,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with our website at sujainfo.com (the “Website”).

This Policy applies to visitors, prospective customers, and other individuals who interact with our Website. It does not apply to personal information processed through our clinical and operational software products, including CareAxes, CureAxes, GynEye, and Suja RCM, which are governed by separate agreements with our healthcare provider clients and, where applicable, healthcare privacy requirements.

Suja HealthTech develops healthcare technology solutions for healthcare providers. Our solutions include AI-powered clinical systems, hospital management software, electronic medical record systems, revenue cycle management solutions, remote patient monitoring platforms, and related healthcare technology services, including CareAxes, CureAxes, GynEye, Suja RCM, and the Suja AI technology suite.

We collect the following categories of personal information:

• Contact information, such as your name, business email address, phone number, and mailing address.
• Professional information, such as your job title and organization name.
• Inquiry information, such as the content of any message, question, or demonstration request you submit to us.
• Technical and usage information, such as your IP address, browser type and version, device type, operating system, pages visited, referring URL, and approximate location derived from your IP address.

We do not require account registration on sujainfo.com and do not collect usernames or passwords through our Website.

We encourage you to ensure that the personal information you provide to us is accurate, complete, up to date, and to notify us of any changes. We request that you do not submit unnecessary sensitive personal information through our Website unless we specifically request it.

We collect personal information through the following methods:

• Directly from you when you submit a contact form, request a product demonstration, or otherwise communicate with us.
• Automatically through cookies, analytics tools, and similar technologies as you browse our Website.
• From third-party service providers, including analytics, advertising, and marketing services that help us understand Website usage and improve our services.

We use the personal information we collect for the following purposes:

• To respond to your inquiries and product demonstration requests.
• To provide information about our products, services, and relevant updates.
• To operate, secure, maintain, and improve our Website.
• To measure and improve the effectiveness of our marketing activities.
• To detect, investigate, and prevent fraud, security incidents, and unauthorised access.
• To comply with applicable legal and regulatory obligations.

We do not use your personal information to make decisions that produce legal or similarly significant effects through automated means alone.

We process personal data only for the purposes disclosed at the time of collection or for other compatible lawful purposes permitted under applicable law, and we endeavour to collect only such personal information as is reasonably necessary for those purposes.

We may share your personal information in the following circumstances:

• Service providers that support the operation, security, maintenance, analytics, and improvement of our Website and services.
• Advertising and marketing partners where you have provided consent for such activities.
• In connection with a merger, acquisition, financing, or sale of company assets.
• Where disclosure is required by law, regulation, court order, or other valid legal process.
• With affiliated entities for internal administrative and business purposes.

We do not sell your personal information for monetary consideration.

Where we engage third-party processors to process personal information on our behalf, they are contractually required to implement appropriate security measures and to process personal data only in accordance with our instructions and applicable law.

In the event of any merger, acquisition, financing, restructuring or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Once retention is no longer necessary, we will delete or anonymise the information in accordance with applicable law.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of electronic transmission or storage can be guaranteed to be completely secure.

We use cookies and similar technologies to operate our Website, enhance security, understand how visitors use our Website, and improve user experience.

When you visit our Website, you may be presented with a cookie consent banner that allows you to manage your cookie preferences. You can change your preferences at any time through the Cookie Settings option available on the Website.

For detailed information about the cookies we use, the purposes for which they are used, and the choices available to you, please refer to our Cookie Policy.

Our Website may contain links to third-party websites, services, or platforms. If you choose to interact with these third parties, any information you provide will be governed by their own privacy policies and practices.

We do not control and are not responsible for the privacy practices, content, or security of third-party websites and services. We encourage you to review their privacy policies before providing any personal information.

If you are located in the EEA or UK

Under the General Data Protection Regulation (GDPR) and UK GDPR, we process your personal data on the following legal bases: Consent (where you have given us clear permission, such as for marketing cookies); Legitimate interests (for Website analytics and security, where not overridden by your rights); and Legal obligation (where required by law).

You have the right to access, correct, or erase your personal data; restrict or object to its processing; request data portability; and withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority, or with the UK Information Commissioner’s Office (ICO) if you are located in the UK.

If you are located in Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Québec’s Law 25, we process your information based on your express or implied consent, which you may withdraw at any time. You have the right to access your personal information, request corrections, and file a complaint with the Office of the Privacy Commissioner of Canada.

If you are located in India

As a company incorporated in India, we process your personal data in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and applicable rules issued under these laws.

Where required under applicable law, we process the personal data of Indian users on the basis of your consent and other lawful grounds permitted under the DPDP Act, including compliance with legal obligations and certain legitimate uses. By providing your personal information through the Website, you consent to its collection, use, storage and processing for the purposes described in this Policy, unless another lawful basis applies. You may withdraw your consent at any time by contacting us at contact@sujahealthtech.com; withdrawal will not affect any processing carried out before the withdrawal.

You have the right to access information about how your personal data is processed, request correction or erasure, withdraw your consent at any time, nominate another individual to exercise your rights on your behalf, and raise a grievance with our Grievance Officer, whose contact details are provided in Section 15.

To exercise any right described in this section, please contact us using the details in Section 15.

If your grievance is not satisfactorily resolved by our Grievance Officer, you may escalate the matter to the Data Protection Board of India in accordance with the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025 (as and when their provisions come into force).

California Privacy Rights (CCPA/CPRA)

California residents have the right to know, access, correct, and delete personal information collected about them. They also have the right to opt out of the sale or sharing of personal information, limit the use of sensitive personal information where applicable, and receive equal treatment for exercising their privacy rights.

To exercise your rights, please contact us at contact@sujahealthtech.com.

Other US State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), and New Jersey (New Jersey Data Privacy Act) have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising.

To exercise rights under any of these state laws, please contact us at contact@sujahealthtech.com. If we decline to act on your request, you may appeal our decision by contacting us using the same email address.

Do Not Track Signals

Because no uniform legal or industry standard exists for recognizing browser Do Not Track (DNT) signals, our Website does not currently respond to DNT signals.

Our Website and Services are intended exclusively for healthcare professionals, hospital administrators, and business decision-makers. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected such information, we will take steps to promptly delete it. If you believe we have collected information from a minor, please contact us at contact@sujahealthtech.com.

Where we are required to process the personal data of a child or of a person with a disability who has a lawful guardian, we do so only after obtaining verifiable consent from the parent or lawful guardian and where permitted under applicable law. We do not undertake tracking, behavioural monitoring or advertising directed at children, in accordance with Section 9 of the DPDP Act, 2023.

Suja HealthTech operates in India and the United States. Personal information collected through our Website may be processed and stored in these jurisdictions and in other locations where our service providers operate. Any transfer of personal data outside India is undertaken in accordance with applicable law, including the DPDP Act, 2023 and any restrictions notified by the Government of India.

Where required by applicable law, we implement appropriate safeguards to protect personal information transferred across national borders.

We may update this Privacy Policy from time to time to reflect changes in our practices, the technologies we use, applicable laws, or our business operations.

When we update this Privacy Policy, we will revise the “Last Updated” date at the top of this document. Where required by applicable law, we will notify users of material changes and obtain consent before applying those changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect and use personal information.

If you have questions about this Privacy Policy or wish to exercise any of the rights described in this Policy, please contact us using the details below.