Draft — pending legal review. The final wording of this policy is being finalised with qualified counsel. The structure below reflects what the published policy will cover.
DRAFT — pending legal review. Not legal advice.
Minor / Guardian Consent & Age Policy
This Minor / Guardian Consent & Age Policy ("Policy") explains who may use the products,
website, and services (collectively, the "Services") of VAMS BioInnovation Private Limited ("VAMS", "we",
"us", or "our"), the age requirements that apply, and how a parent or lawful guardian may provide,
manage, and withdraw consent where a minor is to be tested. This Policy should be read together
with our Privacy Policy, Terms of Service, and Consent documents.
We treat the personal data of children with heightened care, consistent with India's **Digital
Personal Data Protection Act, 2023 ("DPDP Act")** and the rules made under it. Under the DPDP Act,
a "child" is an individual who has not completed eighteen (18) years of age.
1. Our Services Are Intended for Adults (18+)
The Services are designed and intended for use by adults who are eighteen (18) years of age or
older. Our reports are informational and wellness-oriented; they are not diagnostic and are not a
substitute for professional medical advice, examination, or treatment.
By creating an account, placing an order, or otherwise using the Services, you confirm that you are
at least 18 years of age and legally capable of entering into a binding agreement.
2. Accounts and Purchases Require an Adult (18+)
Accounts. You must be 18 or older to register for, hold, or operate an account.
Purchases. You must be 18 or older to purchase any product or service, to provide payment
details, and to accept our Terms of Service.
Ordering on behalf of a minor. An adult account holder may purchase a test intended for a
minor, but only where that adult is the minor's parent or lawful guardian (or is acting with the
documented authorisation of the parent or lawful guardian) and provides the verifiable consent
described in Section 3.
We do not permit minors to independently register accounts, make purchases, or accept our terms.
3. Testing a Minor Requires Verifiable Guardian Consent
Where a test is intended for a minor, we require the **verifiable consent of the minor's parent or
lawful guardian** before we collect a sample, process personal data relating to the minor, or
generate any report about the minor.
By providing consent on behalf of a minor, the parent or lawful guardian confirms that they:
are the minor's parent, or are the minor's lawful guardian under applicable law;
are at least 18 years of age and legally competent to consent;
have the authority to consent to the collection and processing of the minor's personal data;
understand the nature, purpose, and limitations of the Services, including that reports are
informational and wellness-oriented and are not diagnostic; and
have read the Privacy Policy and applicable Consent documents.
Consent for the purchased service is granular and unbundled: consent to test a minor is
separate from, and does not imply, consent to any optional use (such as product marketing,
longitudinal profiling, algorithm development, commercial research, biobank retention, or sharing
with research collaborators). The core service can be obtained without agreeing to any optional
use, and no optional use will be applied to a minor's data.
We may decline or discontinue testing where guardian consent cannot be established, is withdrawn,
or where we have reason to believe the person providing consent is not the minor's parent or
lawful guardian.
4. Age Verification
To help ensure that account holders are adults and that testing of a minor is properly authorised,
we take reasonable, proportionate steps to verify age and guardian status. These steps may include:
self-declaration of age and date of birth at account creation and at checkout;
confirmation of parent/guardian status and authority when a test is intended for a minor;
requesting appropriate verification (which may include verifiable details or documentation)
consistent with the DPDP Act and applicable rules, and in a manner that minimises the personal
data we collect for this purpose; and
additional checks where an inconsistency or reasonable doubt arises.
We may refuse, suspend, or cancel an account, order, or test if age or guardian status cannot be
reasonably verified, or if information provided is inaccurate or misleading. Any data collected for
verification is used only for that purpose and retained no longer than necessary, consistent with
our Privacy Policy and the Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary..
5. Heightened Protection of Children's Data (DPDP Act, 2023)
Consistent with the DPDP Act, we apply the following additional safeguards to a child's personal
data:
Verifiable guardian consent as the basis for processing. We process a child's personal data
only after obtaining verifiable consent from the child's parent or lawful guardian.
No processing detrimental to a child. We do not undertake processing of a child's personal
data that is likely to cause any detrimental effect to the well-being of the child.
No tracking or behavioural monitoring of children. We do not undertake tracking or
behavioural monitoring of children through our Services.
No targeted advertising to children. We do not direct targeted or behavioural advertising at
children.
Data minimisation and purpose limitation. We collect only the child's personal data needed to
provide the requested service and use it only for the consented purpose.
These protections apply regardless of whether the child's data was provided by the child or by the
parent or lawful guardian.
6. How a Guardian Provides, Exercises, and Withdraws Consent
A parent or lawful guardian who has consented to the testing of a minor may exercise the following
rights on behalf of the minor, in accordance with the DPDP Act:
Access the minor's personal data that we hold and information about how it is processed.
Correction and completion of the minor's personal data that is inaccurate or incomplete.
Erasure of the minor's personal data, subject to our legal and record-keeping obligations.
Withdrawal of consent. The guardian may withdraw consent (in whole or in part) at any time.
Withdrawal is as easy to exercise as giving consent. Following withdrawal, we will cease the
relevant processing within a reasonable period, subject to legal obligations; withdrawal does not
affect processing carried out before withdrawal, and may mean we can no longer provide part or all
of the Service.
Grievance redressal. The guardian may raise any concern or complaint about the handling of
the minor's personal data, and we will respond within the timelines required by law.
Nomination. Where applicable, the guardian may nominate another individual to exercise these
rights in the event of the guardian's death or incapacity.
Complaint to the Data Protection Board of India. If a concern is not resolved to the
guardian's satisfaction, the guardian may lodge a complaint with the Data Protection Board of
India.
To exercise any of these rights, or to provide or withdraw consent, the parent or lawful guardian
may contact us using the details in Section 8. We may need to verify the identity and guardian
status of the person making the request before acting on it, and will limit the additional data
collected for this verification to what is necessary.
7. VAMS Does Not Knowingly Collect Children's Data Without Guardian Consent
We do not knowingly collect, process, or retain a child's personal data without the verifiable
consent of the child's parent or lawful guardian.
If we become aware that we have collected a child's personal data without such consent — for
example, where a minor has created an account or placed an order by misrepresenting their age — we
will take reasonable steps to stop the processing and delete that data promptly, unless we are
required to retain it by law.
If you believe that a minor has provided us with personal data without the appropriate guardian
consent, or that a minor is using the Services without authorisation, please contact us at
legal@vamsbiome.com (or our privacy contact at privacy@vamsbiome.com) so we can
investigate and take appropriate action.
8. Contact Us
For any questions about this Policy, or to provide, manage, or withdraw consent on behalf of a
minor:
General contact: legal@vamsbiome.com
Privacy / data protection contact: privacy@vamsbiome.com
Registered office: VAMS BioInnovation Private Limited, Plot No. 59, A-12-4-1, Near Matha Towers, K P Nagar, Benz Circle, Vijayawada, Andhra Pradesh 520008, India
This Policy is governed by the laws of India (Laws of India, including applicable laws of the State of Andhra Pradesh). Nothing in this Policy
limits any right or remedy available to you under applicable consumer-protection or data-protection
law, including recourse to statutory grievance mechanisms, the Data Protection Board of India, the
relevant Consumer Commissions, or other competent regulators (Ministry of Corporate Affairs; Ministry of Electronics and Information Technology; Data Protection Board of India; Department of Consumer Affairs and Central Consumer Protection Authority; and, depending on the product or claim, CDSCO, FSSAI, relevant State authorities and other competent regulators.).
Version and Change History
Document name: Minor / Guardian Consent & Age Policy
Version: 1.0
Effective date: 10 July 2026
Change history: v1.0 (10 July 2026) — Initial publication.