Draft — pending legal review. The final wording of this policy is being finalised with qualified counsel. The structure below reflects what the published policy will cover.
Subprocessors and International Data-Transfer List
DRAFT — pending legal review. Not legal advice.
VAMS BioInnovation Private Limited ("VAMS", "we", "us", "the Company") uses a
limited number of carefully selected third-party service providers, called
"subprocessors", to help operate our website, fulfil orders, and deliver our
wellness and microbiome-related services. This page explains what a subprocessor
is, the categories of subprocessors we rely on, how we vet and contract with
them, the safeguards that apply when personal data is transferred internationally,
and how we notify you of changes.
This page should be read together with our Privacy Policy. Terms defined in the
Privacy Policy have the same meaning here.
What is a subprocessor?
A subprocessor is a third-party organisation that processes personal data on
our behalf, under our instructions, to help us provide a service you have
requested. For example, when you place an order, a payment provider processes
your payment details; when we ship a kit, a logistics provider handles the
delivery. In each case the third party is acting for us, under contract, and not
for its own independent purposes.
VAMS remains accountable to you for personal data handled by our subprocessors.
We do not permit a subprocessor to use your personal data for its own marketing
or unrelated purposes.
How we select and contract with subprocessors
Before engaging a subprocessor, and on an ongoing basis, we take reasonable steps
to satisfy ourselves that the provider can meet appropriate standards of security
and data protection. Our practice is to:
Vet each provider for security practices, reliability, and data-protection
maturity before engagement.
Contract in writing. Each subprocessor is engaged under a contract (such as
a data-processing agreement or equivalent terms) that requires the provider to
process personal data only on our instructions, keep it confidential, apply
appropriate technical and organisational security measures, and assist us in
meeting our obligations under applicable law, consistent with India's Digital
Personal Data Protection Act, 2023 (the "DPDP Act").
Limit scope. We share only the personal data a subprocessor needs for the
specific function it performs (data minimisation).
Review our subprocessors periodically and when circumstances change.
Engaging a vetted, contracted subprocessor does not reduce your rights. VAMS
remains responsible for ensuring your personal data is handled in accordance with
our Privacy Policy and applicable law.
Categories of subprocessors we use
We group our subprocessors by the function they perform. The categories below
describe the types of providers we rely on. The specific providers within each
category are listed in the table further down this page.
Payment processing — to take payment securely for orders and manage refunds.
Shipping and logistics — to deliver sample-collection kits to you and return
samples or items to a designated processing location.
Laboratory and sequencing processing — to carry out the laboratory analysis
and genomic sequencing that underpins your report. VAMS is not itself a
laboratory; this work is performed by specialist processing partners under
contract.
Cloud hosting and storage — to host our website, applications, and databases,
and to store data securely.
Analytics — to understand how our website and services are used, so we can
improve them.
Customer support — to help us respond to your questions and manage support
requests.
Communications — to send transactional messages (such as order updates) and,
where you have consented, other communications.
Not every category involves the same personal data, and some categories process
little or no directly identifying information. Where a service can be delivered
without sharing directly identifying data (for example, by using a pseudonymous
identifier for a sample), we prefer that approach.
Current subprocessor list
The list below is maintained dynamically and kept current. Specific
subprocessor names, purposes, locations, and safeguards are configured in our
content management system (Sanity) and updated there as our providers change, so
this page always reflects our current arrangements.
> The following table is maintained and updated in Sanity. The rows shown here
> are placeholders. The live, current list is published from
> `https://www.vamsbiome.com/legal/subprocessors` and reflects our arrangements as at the effective date
> below.
| Name | Purpose | Location | Safeguard |
|------|---------|----------|-----------|
| Maintained in the current subprocessor register (updated in Sanity) | Payment processing | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Shipping and logistics | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Laboratory and sequencing processing | Samples may be processed by qualified third-party laboratories in India or another location disclosed to the customer before sample submission or processing. The specific processing laboratory and country will be identified in the order documentation or test report where applicable. | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Cloud hosting and storage | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Analytics | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Customer support | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
| Maintained in the current subprocessor register (updated in Sanity) | Communications | As disclosed in the current register | Contractual and applicable Indian-law safeguards |
*Columns: Name — the provider; Purpose — the function it performs for us;
Location — the primary country or region where processing takes place;
Safeguard — the contractual or legal safeguard that applies to any transfer.
All cells are maintained and updated in Sanity.*
International data transfers
Some of our subprocessors may process personal data outside India. Where a
transfer of personal data outside India takes place, we do so consistent with the
DPDP Act and any conditions or restrictions the Central Government may specify in
relation to transfers to particular countries or territories.
When personal data is transferred internationally, we take reasonable steps to
ensure it remains protected, including:
engaging each recipient under a written contract that requires appropriate
security measures and processing only on our instructions;
limiting the data transferred to what is necessary for the relevant function;
and
applying additional contractual or technical safeguards where appropriate,
which are recorded in the Safeguard column of the subprocessor table above.
The specific location and safeguard for each provider are maintained in the table
above and updated as our arrangements change.
How we notify you of changes
We may add, remove, or replace subprocessors from time to time as our services
evolve. When we do:
we update the subprocessor table above (maintained in Sanity) so it always
reflects our current providers;
we update the Version and Change History block below to record the change;
and
where a change is material to how your personal data is handled, we take
reasonable steps to inform you in advance — for example, through a notice on
this page, an update to our Privacy Policy, or a direct communication where
appropriate.
We encourage you to review this page periodically. Continuing to use our website
or services after a change indicates that you are aware of the then-current list;
it does not, by itself, replace any separate consent required under the DPDP Act.
Your rights
Your rights in relation to personal data handled by our subprocessors are the
same as those set out in our Privacy Policy. These include, where applicable, the
right to access and to correct your personal data, to request erasure, to withdraw
consent, to nominate another individual to exercise your rights, and to raise a
grievance through our grievance-redressal process. You may also complain to the
Data Protection Board of India.
Contact us
If you have questions about our subprocessors, our international transfer
practices, or how your personal data is handled, please contact our privacy
contact:
privacy@vamsbiome.com
VAMS BioInnovation Private Limited
Plot No. 59, A-12-4-1, Near Matha Towers, K P Nagar, Benz Circle, Vijayawada, Andhra Pradesh 520008, India
Version and Change History
Document name: Subprocessors and International Data-Transfer List
Version: 1.0
Effective date: 10 July 2026
Change history: v1.0 (10 July 2026) — Initial publication.