Privacy Policy
Version 2026-11-02 • effective 2 November 2026
This policy explains what personal data XPRISM, the Experimental Pharmacology Research & Interactive Student Module ("the Lab", "we"), collects, why, who can see it, how long we keep it and how you can exercise your rights. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000.
1. Who is responsible for your data
Aaron Innovations, Kolkata, India, operates the Lab and is the Data Fiduciary for data collected through it. Where your college uses the Lab for its students, your college decides which students and staff are enrolled and how marks are used. For those purposes your college is also a Data Fiduciary, and we process data on its instructions.
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Name, username, role, college, roll / enrolment number, e-mail address (optional for college students; required for free-trial accounts as the username), institution and occupation (free trial, optional), hashed password | You, or your faculty / college admin |
| Trial usage | Which experiment modules you have opened in the free trial and when each visit started and ended | Generated when you use the Lab |
| Academic records | Batches you belong to, assignments, experiment submissions (observation tables, calculated answers, viva answers), automatic scores, marks and feedback | Generated when you use the Lab |
| Security & audit | Sign-in times, failed sign-in counts, IP address of key actions (sign-in, grading, exports, data requests), consent records | Generated automatically |
| Technical | Session and security cookies (see section 8) | Your browser |
We do not collect Aadhaar numbers, financial information, health information, precise location, photographs, or biometric data. Experiments run entirely in your browser; simulation data that you do not submit is not sent to us.
3. Why we use it (purposes) and our legal basis
- To provide the Lab: create your account, show you your assignments, save and score your submissions. Basis: your consent, given at sign-up or first sign-in.
- Teaching and assessment: let your faculty review your work, give marks and feedback, and export marks for your college's internal assessment. Basis: consent, and your college's legitimate educational purpose as a use for which you voluntarily provided data (DPDP Act, s. 7(a)).
- Security: protect accounts (e.g. lock after repeated failed sign-ins), investigate misuse, keep an audit trail. Basis: consent and legal obligations on reasonable security safeguards.
- Free trial: enforce the one-visit-per-module rule and respond to your subscription enquiries. Basis: your consent.
- Ethics agreement: record that you accepted the trial rules and the ethical-use-of-animals undertaking (version and time). Basis: consent.
- Service e-mails: password-reset messages only. We do not send marketing.
We do not sell, rent or trade personal data, do not show advertising, do not profile you for marketing, and do not use your data to train artificial-intelligence models.
4. Who can see your data
- You: your own profile, submissions, marks and feedback.
- Your faculty: data of students in the batches they teach.
- Lab assistants of your college: enrolment and progress, without the ability to change marks.
- Your college admin: data of all users of your college, to manage accounts and handle your requests.
- Platform administrators of Aaron Innovations: only as needed to run, secure and support the service, including managing free-trial accounts and individual subscriptions.
- Service providers (Data Processors): the hosting provider of our server in India and, if configured, an e-mail delivery service for password resets. They process data only on our instructions under contract.
- Authorities: only when required by law, court order or a lawful request.
Students of one college cannot see data of another college, and students cannot see each other's submissions or marks.
5. How long we keep it
- Accounts and academic records: while your college uses the Lab and for 3 years after your last activity, so that internal-assessment marks can be verified. After that, personal data is erased or de-identified.
- Audit and security logs: up to 1 year, or longer if needed for an ongoing investigation, and at least as long as the law requires.
- When an account is deleted on request, your name, roll number, e-mail, submissions and feedback are erased. Your college may keep de-identified marks (not linked to you) for statistics.
6. Your rights
Under the DPDP Act you have the right to:
- Access a summary of your personal data and how it is processed. Use My data → Download all my data at any time.
- Correction and completion of inaccurate or incomplete data. Ask from My data or ask your faculty.
- Erasure of your data when it is no longer needed, or when you withdraw consent, subject to legal retention.
- Withdraw consent at any time, as easily as you gave it, by requesting account deletion. Withdrawal does not affect processing done before it. Without consent you will not be able to use the Lab for assessed work.
- Grievance redressal (section 9) and, if not satisfied, to complain to the Data Protection Board of India.
- Nominate another person to exercise these rights in the event of your death or incapacity, by writing to the grievance officer.
We aim to respond within 30 days, and in any case within the period prescribed under the DPDP Rules.
7. Children
The Lab is intended for students of degree and diploma pharmacy programmes, who are normally 18 or older. If you are under 18, you may use the Lab only with the verifiable consent of your parent or lawful guardian, obtained through your college. We do not track or monitor children's behaviour, and we do not direct advertising at anyone. If we learn that a child's data was collected without such consent, we will delete it.
8. Cookies
We use only strictly necessary cookies: a session cookie to keep you signed in, and a CSRF cookie that protects forms against forgery. We do not use analytics, advertising or third-party tracking cookies, and the Lab loads no resources from other websites. Simulations may store small preferences in your browser (e.g. sound on/off) that never leave your device.
9. Security
Passwords are stored only as salted hashes. All traffic is encrypted with HTTPS. Access is restricted by role and college. Accounts lock after repeated failed sign-ins. Key actions are written to an audit log that cannot be edited. The server and backups are access-controlled. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Rules.
10. Grievance officer & contact
For any question, request or complaint about your personal data, contact:
Grievance Officer: Dr. Vara Prasad Saka
E-mail: drvaraprasadsaka@gmail.com
Aaron Innovations, Kolkata, India
11. Changes to this policy
If we change this policy in a way that affects you, we will update the version number and ask you to review and accept it the next time you sign in.