CogTrack Privacy Policy

Effective date: 19 October 2026 | Last updated: 19 October 2026

In brief.

CogTrack provides cognitive tests used for screening, monitoring and research support. Test results and related information can be health information, so we handle information that identifies you, or can be linked back to you, with particular care.

We distinguish three kinds of data: Identifiable, Pseudonymised and Anonymised (section 2). Anonymised and aggregated data may be used broadly for research and development. Identifiable and Pseudonymised data are used only as this Policy describes.

We do not sell Identifiable Data for advertising or marketing.

You can ask to access, correct or delete your information (sections 10 and 11).

1. About this Policy and who we are

1.1 This Privacy Policy (the "Policy") explains how information, including Personal Data, is collected, used, shared, kept and protected when you use the CogTrack website at https://cogtrack.in, the CogTrack web application and the CogTrack Android application (together, the "Services").

1.2 The Services are operated by Yajvin Agarwal and Gaurav Arutla (together, "CogTrack", "we" or "us"). CogTrack is not currently incorporated as a company. When that changes, this Policy will be updated (see section 7).

1.3 You may use CogTrack through a hospital, clinic, research team, or community or non-governmental organisation programme (a "Programme"). A Programme may have its own information sheet, consent form or privacy notice, and the organisation running it may decide for itself why and how it uses your information. This Policy adds to, and does not replace, those documents. If a Programme consent form sets stricter limits on the data collected under that Programme than this Policy does, we will follow those limits for that data.

1.4 CogTrack is intended to support cognitive screening, monitoring and research. It is not intended to provide a diagnosis on its own and does not replace the judgment of a qualified clinician. Decisions about your care are made by your treating clinicians. The Services are not for use in an emergency.

1.5 This Policy has been prepared with reference to Indian law as in force from time to time, including the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 and its rules, in each case to the extent in force and applicable to us.

2. Three kinds of data

2.1 "Personal Data" means any data about an individual who is identifiable by or in relation to that data, as determined under applicable law. We sort the data we handle into three kinds:

Identifiable Data — Personal Data that identifies you or can easily be linked to you, such as your name, contact details, or an identifier connected to your name. Highest level of protection. Used to provide the Services to you and, where authorised, to your clinicians. Used or shared beyond that only as sections 4 and 6 allow, with a lawful basis, consent where required, and safeguards.

Pseudonymised Data — Personal Data from which direct identifiers have been replaced by a code or removed, but which can still reasonably be linked back to a person, by us or by someone else. A participant code, programme code or similar identifier is a pseudonym. It is not anonymisation. It remains Personal Data and is protected as such. Used and shared only as sections 4 and 6 allow.

Anonymised Data — Data, including aggregated and statistical data, from which an individual cannot reasonably be identified, as described in clause 2.2. Not Personal Data to the extent permitted by applicable law. May be kept, used and shared as sections 4, 6 and 9 describe.

2.2 Data is "Anonymised Data" when, taking into account the means reasonably likely to be used, the state of technology, the information held by or reasonably available to us and to any recipient, and applicable legal standards, an individual cannot reasonably be identified from it, whether alone or in combination with other information. Removing a name or other direct identifier is not, by itself, anonymisation.

2.3 We assess anonymisation by this risk-based test and may reassess it as technology, circumstances or law change. If data stops meeting the test, we will treat it as Pseudonymised Data or Identifiable Data, as the case may be.

2.4 Creating Pseudonymised Data or Anonymised Data from Personal Data is itself a use of Personal Data. We do it only where we have a lawful basis (section 5) and it is listed as a purpose in section 4.

2.5 We do not intentionally try to re-identify Anonymised Data, except where necessary to test or validate our anonymisation safeguards and permitted by law. When we make Anonymised Data available to others, we will require them not to attempt re-identification.

3. Information we collect

3.1 Pathways. What we collect depends on how you use CogTrack. Broadly:

Clinical use (for example through a hospital or clinic). You may sign in with an account, or with a participant code and PIN provided through the Programme. Assessments may be repeated over time, for example before surgery and again some days afterwards, and are linked to each other through a participant identifier.

Community or research use (for example a normative-data programme run with a community or non-governmental organisation). This pathway is intended for a single session that contributes to reference data, rather than ongoing clinical follow-up.

Account-based use where you create or are given an account.

3.2 Categories. Not every category below is collected in every pathway.

Account and sign-in information — Email address; credentials and verification information used to sign in or reset access (such as passwords, PINs and one-time codes); invitations; session information.

Participant and profile information — Internal participant identifier; CogTrack participant code; name, telephone number and email address where collected; age; sex or gender where applicable; education level or years of education; language; test configuration information; cohort; hospital, Programme or organisation linkage; follow-up dates; the version and time of any consent recorded in the Services.

Cognitive assessment information — Type of test or session; your responses; accuracy; reaction and timing information; test metrics; raw scores; domain and composite scores; Z-score and other standardised measures; comparisons with your baseline and deviations from it; session status and timestamps; clinical or test notes where recorded.

Clinical and health-related information — Surgery date, type, history or context; responses and totals for the Quality of Recovery (QoR-15) questionnaire; responses and results for the WHODAS questionnaire on everyday functioning and disability; other assessment information, including cognitive, physical, nutritional and risk-related information, recorded by clinicians or in earlier versions of CogTrack; relationships between you and clinicians or hospitals.

Technical and security information — IP address and network information; browser and device information; timestamps; authentication and session events; security events; operational and error logs.

Communications — Messages you send us, including requests about your data and grievances.

3.3 No contact details does not mean anonymous. Some pathways do not require your name, email address or telephone number. Using CogTrack without them reduces the information we hold about you, but it does not by itself make your data anonymous. A participant code, session identifiers, timestamps, demographic details (such as age, education and language) and the linking of repeated sessions may, alone or together, allow a person to be identified, or may keep the data Pseudonymised. Where, for a particular pathway, we collect data in a way that does not allow an individual to be reasonably identified, or irreversibly anonymise it after collection, we treat the result as Anonymised Data under clause 2.2. Until then, we treat it as Pseudonymised Data or Identifiable Data.

3.4 Technical and security information. We use technical and security information to operate and protect the Services. We do not use passwords, PINs, one-time codes or session credentials for analytics or research, and we do not intentionally retain them in logs or analytics records.

3.5 Information from others. If you take part through a Programme, the organisation running it or your clinician may give us information about you that is relevant to the Programme.

3.6 When we cannot find your records. If you have not given us details that let us find your records, we may be unable to act on a request about them without collecting additional identifying information. We are not obliged to collect more identifying information solely to respond to a request, and we do not identify a person from demographic details alone.

4. How we use information

4.1 Depending on the kind of data and applicable lawful basis, we use information for providing and scoring assessments and baseline comparisons; communicating authorised results; security, debugging and quality assurance; complying with law and legal process; creating Pseudonymised and Anonymised Data; research and validation; normative/reference datasets, statistics and benchmarking; improving tests and scoring methods; developing, training and validating algorithms, models and technology; improving CogTrack and developing future cognitive assessment, monitoring, healthcare or research products and services; academic/scientific research and publication; collaboration with hospitals, universities, researchers and research organisations; and lawful research collaboration with commercial organisations including pharmaceutical, medical technology, healthcare and life sciences organisations. Uses of Identifiable and Pseudonymised Data require an applicable lawful basis, consent where required, and appropriate safeguards. Anonymised Data may be used for these purposes where lawful.

4.2 We do not sell Identifiable Data for advertising or marketing, and we do not use cognitive or health data for behavioural advertising.

4.3 CogTrack results are a screening and monitoring aid. We do not make automated decisions that deny you care or services on the basis of those results.

4.4 This Policy does not, on its own, authorise a use of Identifiable Data or Pseudonymised Data that is not covered by a consent you have given or another lawful basis. If we want to make such a use, we will obtain your fresh consent or rely on another lawful basis, and tell you.

5. Consent and other legal bases

5.1 Where consent is the applicable legal basis, we ask for it through a clear affirmative action, for specified purposes. Using the Services is not, by itself, consent.

5.2 Consent is not the basis for every use of information. Where applicable law permits, we may use information on another basis, for example to comply with a court order or a legal requirement to disclose information, to respond to a medical emergency, to establish or enforce legal rights or claims, or for research or statistical purposes that meet the standards set by law and are not used to take decisions about you. We rely on these bases only where they genuinely apply.

5.3 Research and clinical consent are separate matters. This Policy is not a substitute for any informed consent that is required for clinical care or for research. If you take part in research through a Programme, the Programme's consent form and any ethics-approved protocol also apply, and they will tell you which parts of participation, if any, are optional.

5.4 Withdrawing consent. Where you have given consent, you can withdraw it at any time by contacting us (section 15) or, where the Services provide one, through the in-app option. We will then stop the processing that depended on that consent. Withdrawal does not affect processing that was lawful before you withdrew, does not affect Anonymised Data created before you withdrew, and may mean we cannot continue to provide some features. Results already included in completed analyses or publications cannot be removed from them.

6. Who we share information with

6.1 We share information, as applicable and authorised, with authorised clinicians, hospitals and Programme organisations; service providers including Supabase, Render, Vercel and Resend; Google LLC and its affiliates in connection with Google Play; hospitals, universities, researchers and research organisations; commercial research collaborators; professional advisers, auditors and insurers; courts, regulators and other authorities; and parties to a transaction involving CogTrack. Service providers may process information outside India.

6.2 Clinician access. Signing in as a clinician does not, by itself, entitle a clinician to see every patient's information. Clinicians can access patient information only through an authorised relationship with that patient, or another specifically authorised clinical workflow, and we apply those limits on the server side of the Services. Where the Services let you or your Programme approve, deny or revoke a clinician's access, we respect that decision. Participants in community or normative-data programmes are not made available to clinicians through clinical patient-data interfaces. We make clinical information available to clinicians and hospitals on the basis of your consent or another lawful basis permitted by law.

6.3 Reports and exports. Where authorised, clinicians and hospitals may be able to generate, download or export information, for example as reports or data files. Once an authorised recipient holds its own lawful copy, its own retention and legal responsibilities apply to that copy under applicable law and its agreements. This does not reduce our responsibilities for the copies we hold.

6.4 Where information is processed outside India, we do so in accordance with applicable Indian law on cross-border transfers.

7. Incorporation and changes of ownership

7.1 CogTrack may be incorporated, and may enter into or consider a financing, merger, acquisition, restructuring, or sale or transfer of all or part of its business or assets, or a similar transaction. In connection with a transaction, Personal Data may be transferred to a successor or assignee, and may be disclosed to a prospective counterparty and its advisers to the extent reasonably necessary and under confidentiality obligations, in each case as applicable law permits.

7.2 A successor may adopt its own privacy policy, but it must continue to respect the consents, restrictions, rights and choices that applied to the information when it was collected, and it must give any notice or obtain any fresh consent that applicable law requires for a change of purpose.

7.3 We will give you notice of a transaction affecting your Personal Data where the law requires. When CogTrack is incorporated, this Policy will be updated to name the company.

8. Security

8.1 We use technical and organisational safeguards intended to protect the information we hold, including access controls and authentication and authorisation measures, appropriate to the nature and sensitivity of the information. No system is completely secure, and we cannot promise absolute security.

8.2 If a personal data breach affects you, we will notify you and the relevant authorities to the extent and within the time that applicable law requires.

8.3 If you have sign-in credentials, please keep them confidential.

9. How long we keep information

9.1 Identifiable Data and Pseudonymised Data. We keep these only for as long as we reasonably need them for the purposes in section 4 for which a lawful basis exists. That can include the time your account or Programme participation continues; follow-up and longitudinal studies you are part of; periods required by law or, where the law permits, by an ethics-approved research protocol; security and audit purposes where justified; and the establishment, exercise or defence of legal claims or disputes. We do not keep this information indefinitely. When it is no longer needed, we delete it or, where lawful and appropriate, irreversibly anonymise it. A verified deletion request is handled under section 11.

9.2 Anonymised Data. Because Anonymised Data no longer identifies a participant under clause 2.2, we may keep it for as long as we find it useful, without a fixed period, to the extent permitted by applicable law.

9.3 Backups and logs. Deleted information may remain for a limited time in backups and logs until they are overwritten or deleted in the ordinary course. The law may also require us to keep certain records for minimum periods.

9.4 A Programme document may set retention periods for data collected under that Programme. Those periods apply in addition to this section.

10. Your rights

10.1 Subject to applicable law, and as the relevant provisions come into force, you may ask for a summary of the Personal Data we process about you and what we do with it, and for the identities of the other organisations with which it has been shared; ask us to correct, complete or update your Personal Data; ask us to erase your Personal Data; withdraw a consent you have given; have a grievance addressed; and nominate another person to exercise these rights for you if you die or cannot act for yourself.

10.2 To exercise these rights, contact us as set out in section 15. We take proportionate steps to verify your identity and to find your records. Section 11 explains how verification works for deletion requests.

10.3 We will respond to a grievance within one (1) month of receiving it. We will respond to any other request under this section within a reasonable period, not exceeding ninety (90) days from receipt.

10.4 If you are not satisfied with our response, you may, as applicable law provides, when that route is available and after raising the matter with us, approach the Data Protection Board of India.

10.5 Depending on where you are located and whether the relevant law applies to CogTrack, you may have additional rights.

10.6 Your rights are subject to the exceptions and limits that applicable law provides, including where we must keep or disclose information by law.

11. Deleting your account and data

11.1 How to ask. To request deletion of your account and associated Personal Data, go to https://privacy.cogtrack.in/delete-account/. You can use that page without installing or signing in to the app. The CogTrack app also has a "Delete account & data" option in its account or settings area, which leads to the same page.

11.2 Verification. We verify deletion requests in a proportionate way before acting, so that nobody can delete another person's data. Knowing an email address is not enough to delete an account, and a participant code alone is not treated as proof of identity. The deletion page explains how verification works for each pathway.

11.3 What we delete. After verification, we delete the Personal Data associated with the verified person from the records we control, and instruct our service providers to do the same. Depending on the pathway, this includes the account and sign-in records, profile and participant information, test sessions, responses and scores, links between baseline and follow-up sessions, relationships with clinicians, questionnaire and other assessment data, and identifiable Programme, hospital or organisation linkage. Switching off or freezing an account is not deletion.

11.4 What may be kept. We keep only what is necessary, and only for as long as the reason applies, in these limited cases: information that applicable law requires us to keep, including minimum retention periods that apply to certain personal data, traffic data and logs; information that applicable law permits us to keep for research or statistical purposes, but only where an ethics-approved research protocol requires it; information needed to establish, exercise or defend legal claims; limited security and audit records, where justified; copies in backups and logs, until they are overwritten or deleted in the ordinary course; and Anonymised Data, including data already irreversibly anonymised or aggregated before your request.

11.5 We will tell you in our response what has been kept, why, and for how long. We do not use "research" as a general reason to keep Identifiable Data or Pseudonymised Data indefinitely.

11.6 Hospitals and programmes. We can delete the copies that CogTrack controls. A hospital, clinician or Programme organisation that independently holds its own lawful copy has its own responsibilities for that copy, and you should contact it directly about it. Where CogTrack itself remains responsible for a copy, this paragraph does not limit our obligations.

11.7 We will respond to deletion requests within the period in clause 10.3.

12. Age

12.1 The Services are intended for people aged eighteen (18) or over. We do not knowingly collect Personal Data of anyone under eighteen (18). If you think we have, please contact us and we will take appropriate action, which will normally be to delete it unless the law requires or permits us to keep it.

13. Technologies we use

13.1 The Services may use browser storage, session tokens or similar technologies where needed to keep you signed in and to operate and secure the Services. Our hosting providers generate standard server and security logs. The Android application is distributed through Google Play, and Android shows you the permissions it requests at installation or first use.

13.2 If we introduce analytics, advertising or similar tracking technologies, we will update this Policy and, where the law requires, ask for your consent before they are used.

14. Changes to this Policy

14.1 We may update this Policy, for example on incorporation, on a Transaction, when we add features, or when the law changes. We will change the "Last updated" date and tell you about material changes through the Services or by email. Where the law requires your fresh consent to a changed purpose, we will obtain it before applying the change to your Personal Data.

15. Contact and grievances

15.1 You can contact us about this Policy, your information, or a grievance at:

Privacy and grievance contact: Yajvin Agarwal — Privacy and Grievance Contact

Email: pnctapp@gmail.com

Postal address: Shree Kunj, Road No. 12, 8-2-682/B/6/B, Banjara Hills, Hyderabad, Telangana, India

15.2 We will acknowledge and respond to your communication as set out in clause 10.3.