LeoME Labs legal
Privacy Policy
This Privacy Policy explains how LeoME Labs Private Limited collects, uses, stores, shares, and protects personal data through the LeoME Labs corporate website at leomelabs.com. The consumer products MedSpeak AI and KlinIQAI carry their own privacy notices on their own websites.
Last updated: May 31, 2026
1. Scope
This policy applies when you visit the LeoME Labs website or submit a contact form. It provides a clear, purpose-based notice aligned with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and — for users in the EU/Germany — the General Data Protection Regulation (GDPR).
1A. Legal frameworks
Depending on where you are and how you use the Services, this policy is informed by the Information Technology Act, 2000 and rules made under it (including the SPDI Rules, 2011 and the Intermediary Guidelines, 2021), the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and the EU/UK GDPR. The DPDP Rules, 2025 were notified on 14 November 2025, with substantive obligations being phased in; we are aligning our practices accordingly ahead of the applicable compliance dates.
2. Indian Startup / Data Fiduciary Details
- Company / Data Fiduciary
- LeoME Labs Private Limited
- Country
- India
- Registered office
- First Floor, C-133, BSF Camp Tigri, Tigri Extension, New Delhi, South Delhi, Delhi – 110062, India
- CIN
- U62099DL2026PTC466513
- Privacy and grievance contact
- [email protected]
3. Personal Data We Process
- Website and contact data, including contact-form submissions from investors, partners, applicants, and prospective clients — name, company, role, selected interest, message content, anti-bot verification result, IP address, browser/user-agent, and timestamps.
- Technical and security data, including device and browser information, log data, request metadata, abuse-prevention signals, error reports, and security events.
- Cookies and similar technologies, as described in our Cookie Policy.
4. Purposes of Processing
- Operate, secure, and improve the LeoME Labs corporate website.
- Respond to enquiries from investors, partners, applicants, and prospective clients, and send related communications.
- Prevent abuse, verify form submissions, debug issues, protect our infrastructure, enforce terms, and comply with applicable legal obligations.
- Respond to privacy, withdrawal, correction, export, deletion, and grievance requests.
5. Legal Basis and Consent
We process personal data for lawful purposes, including providing services requested by you or your organisation, performing contracts, complying with legal obligations, protecting our systems, and using consent where required.
Where we rely on consent, you may withdraw it by contacting [email protected]. Some features may stop working if the data needed to provide them can no longer be processed.
6. Processors and Service Providers
We use a small number of trusted service providers to run the website, in the following categories:
| Category | Purpose |
|---|---|
| Hosting & CDN (Cloudflare) | Serving the website, content delivery, and bot/anti-abuse verification on our contact form. |
| Database (Supabase) | Securely storing contact-form submissions and related operational logs. |
Our consumer products, MedSpeak AI and KlinIQAI, publish their own privacy and processor details on their respective websites.
7. Retention
We retain personal data only for as long as needed for the purposes described in this policy, unless a longer period is required for legal, tax, accounting, security, dispute, or compliance reasons.
Account and company records are generally retained while an account or customer relationship remains active. Contact, support, conversation, session, analytics, and log records are retained according to product, support, security, and operational needs. Deleted data may remain in backups for a limited period before scheduled deletion.
8. International Transfers
LeoME Labs is based in India, and our products may use infrastructure or service providers located in India, the European Union, the United States, or other jurisdictions. Where personal data is transferred across borders, we use contractual, technical, and organisational safeguards appropriate to the service and applicable law.
9. Security
We use administrative, technical, and organisational safeguards designed to protect personal data from unauthorised access, alteration, disclosure, or loss. These include server-side secret handling, role-based access, Supabase RLS/server controls where used, bot verification for public forms, logging, and operational access controls. No online service can guarantee absolute security.
9A. Personal Data Breaches
If a personal data breach occurs, we will assess and respond in line with applicable law. Where required, we will notify affected individuals and the relevant authority (for example the Data Protection Board of India, or an EU supervisory authority) within the applicable timelines, which can be as short as 72 hours. Notifications will describe, in plain language, the nature of the breach, the data involved, steps you can take, and how to contact us.
10. Children and Minors
LeoME Labs products are intended for business, professional, education, and training use. We do not knowingly target children for behavioural advertising or unnecessary tracking. If a feature is used by a child or person requiring guardian consent under applicable law, the responsible organisation or guardian must ensure valid consent and appropriate supervision.
11. Your Rights and Grievance Contact
- Request a summary of personal data processed about you and the processing activities connected to it.
- Request correction, completion, update, or erasure of personal data where applicable.
- Withdraw consent where processing is based on consent. Withdrawal does not affect processing already completed before withdrawal.
- Nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP framework.
- Raise a privacy grievance through the contact listed in this policy, and escalate to the Data Protection Board of India if unresolved.
- Ask us to explain the processors or categories of processors used for your personal data, subject to security and legal limits.
We aim to respond to verified requests within the timelines required by applicable law (for example, within 90 days for certain requests under the DPDP framework). To exercise privacy rights or raise a grievance, contact [email protected]. We may need to verify your identity or authority before acting on a request. See also our Grievance Redressal page.
Additional rights for EU/Germany users
If you are in the EU/Germany, the GDPR gives you the following rights, which you can exercise using the same contact:
- Rights of access, rectification, erasure, restriction, portability, and objection to processing.
- The right to withdraw consent at any time where processing relies on consent.
- The right to lodge a complaint with your local data protection authority (for example, in Germany, your state DPA).
12. Updates to This Policy
We may update this Privacy Policy as our products, service providers, legal obligations, or operating practices change. The updated version will be posted on this page with a revised last-updated date.