NPL Health

1. Who we are

National Path Lab & Research Center Pvt. Ltd. (“NPL”, “we”, “us”), company registration number 109945/069/070, is the data controller responsible for your personal data in the NPL Health application.

NPL Health is operated for NPL by Whitefriars Management Ltd (trading as Kalpa), which acts as our data processor and provides the underlying technology platform.

Data protection contact: Bimal Mani Joshi, National Path Lab & Research Center Pvt. Ltd. — bimalmani.joshi@nationalpathlabs.com. Registered office: Pushpalalpark-06, Butwal, Rupandehi, Nepal.

2. What this policy covers

This policy applies to the NPL Health mobile app and website (health.nationalpathlabs.com) — a wellness and health-insights service. It is separate from NPL’s laboratory diagnostic services and the NPL lab-booking app, which are covered by NPL’s general terms.

3. Important — not a medical device

NPL Health is a wellness product. It is not a medical device and does not diagnose, treat, cure or prevent any disease or condition. The insights, scores and trends it provides are for general wellness and informational purposes only. Always consult a qualified healthcare professional for medical advice or before making any health decision.

4. The data we collect

Account & identity

• Your mobile phone number (used to sign you in via a one-time passcode).
• Basic profile details you choose to provide (e.g. name, age, sex, height, weight).
• Where you consent, your NPL patient reference so we can link your laboratory results to your account.

Health & wellness data

• Data from your wearable or phone via Google Health Connect (Android) or Apple Health (iOS) — such as steps and activity, heart rate, heart-rate variability, resting heart rate, blood oxygen, and sleep.
• Laboratory blood-test results imported from NPL’s laboratory systems, where you have consented to link your records.
• Wellness scores and trends we derive from the above (for example, a biological-age estimate).

Technical data

• App version, device type and operating system, and basic diagnostic/error logs used to keep the service working.

5. We do not collect genetic data

The NPL Health app does not collect, process, display or store any genetic or genomic data. Genetic testing offered by NPL’s laboratory business is entirely separate from this app and is not part of NPL Health.

6. How we use your data

• To provide the service — sign-in, your health dashboard, wellness insights, scores and trends.
• To generate plain-language explanations of your data using an AI assistant (see Section 8).
• To link and display your NPL laboratory results, where you have consented.
• To maintain, secure, troubleshoot and improve the app.

Restricted use. Health and fitness data obtained through Google Health Connect or Apple Health is used only to provide wellness insights to you. We do not use this data for insurance eligibility, underwriting, employment decisions, or credit, and we do not sell it. This restriction is required by the Health Connect and Apple Health platform policies and we apply it strictly.

7. Consent and legal basis

We rely on your consent to collect and process your health data, which you give when you connect a data source or link your lab results. You can withdraw consent at any time by disconnecting the source or deleting your account (see Section 10). Where applicable law treats health data as a special category, we process it only with your explicit consent and the protections described here.

8. Who we share data with

We do not sell your data. We share it only with the following, and only as needed to run the service:

• Google (Gemini AI) — to generate the natural-language health explanations in the app. Your data is processed only to answer your request and is not used to train Google’s foundation models.
• Google Health Connect / Apple Health — the platform layer your wearable data flows through (on your own device).
• Google Cloud Platform — secure hosting of the application and database.
• Eprima — SMS provider used to deliver your one-time sign-in passcode.
• Whitefriars Management Ltd (Kalpa) — our technology processor operating the platform on NPL’s behalf.

We may also disclose data where required by Nepali law or to protect the rights and safety of users.

9. Storage, security and retention

• Your data is stored on secured Google Cloud infrastructure with access controls and encryption in transit.
• Access is limited to authorised NPL and Kalpa personnel who need it to operate the service.
• We retain your data for the life of your account and, after your account is closed, for up to 10 years, in line with the retention of clinical and laboratory records, after which it is deleted or anonymised — unless a longer period is required by law.

10. Your rights

You may, at any time:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Disconnect any wearable or data source, stopping further collection.
• Ask us to delete your account and associated data.

To exercise any of these, contact Bimal Mani Joshi at bimalmani.joshi@nationalpathlabs.com. We will respond within a reasonable period and in line with applicable law.

11. Children

NPL Health is not intended for and should not be used by anyone under the age of 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy as the service develops. We will post the updated version at this address and update the effective date. Material changes will be notified in the app.

13. Governing law

This policy is governed by the laws of Nepal.

14. Contact

National Path Lab & Research Center Pvt. Ltd.

Attn: Bimal Mani Joshi — bimalmani.joshi@nationalpathlabs.com

Pushpalalpark-06, Butwal, Rupandehi, Nepal