Draft — pending legal review. The final wording of this policy is being finalised with qualified counsel. The structure below reflects what the published policy will cover.
DRAFT — pending legal review. Not legal advice.
Data & Sample Retention Schedule
This Schedule explains how long VAMS BioInnovation Private Limited ("VAMS", "we", "us") keeps the different kinds of information and physical material connected to your order, and why. It is written to be read alongside our Privacy Notice and Terms. Our services are informational and wellness-oriented; nothing here changes the fact that VAMS reports do not diagnose, treat, prevent or predict any disease.
We keep information only for as long as we actually need it, and no longer. When a retention period ends, we securely delete, anonymise or destroy the relevant record or sample.
How to read this Schedule
Data retention period and sample retention period below refer to the standard periods set out in our Privacy Notice and consent forms. Where a specific figure is still being finalised, we show a placeholder in square brackets.
Periods that are fixed by law (for example, tax and accounting records) are stated as qualified minimum periods.
Optional uses — such as longitudinal profiling, biobank retention, research or marketing — only apply if you have given separate, specific consent for them. If you have not consented, the shorter "core service" period applies. You can withdraw an optional consent at any time.
Retention Schedule by Record Type
| Record type | What it includes | Retention period | Trigger / basis |
|---|---|---|---|
| Order, invoice & statutory records | Order confirmations, invoices, payment references, tax and accounting entries | Retained for the minimum period required by applicable Indian tax, accounting and company law (generally at least 8 years from the end of the relevant financial year), then deleted | Legal obligation; starts at end of the financial year of the transaction |
| Identifiable microbiome data & reports | Your results, scores and personalised report linked to your identity | Retained for Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary. after your report is delivered, unless you ask us to delete it sooner or you have consented to longer retention | Delivery of your service; erasure on request (subject to legal holds) |
| Raw sequencing files | Underlying raw sequence data generated from your sample | Retained for Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary.; kept beyond this only where you have given separate consent (e.g. biobank/research) | Generation of the file; deleted or anonymised at end of period |
| Residual biological samples | Any physical sample material remaining after processing | Retained for Unless a different period is disclosed and consented to, residual biological samples will normally be destroyed within 30 days after the final report is issued. Samples may be retained longer only for necessary repeat testing, quality investigation, legal requirements or separately consented research., then securely destroyed — unless you have given separate, specific consent to biobank retention | Completion of processing; destroyed at end of period or on withdrawal of biobank consent |
| Support records | Emails, chat and tickets with our support team | Retained for up to 3 years after your last interaction, or longer if needed to handle a dispute or complaint | Last contact; extended by an active dispute |
| Consent records | Records of the consents you gave or withdrew, and when | Retained for as long as we rely on the consent, plus the period needed to demonstrate compliance (typically the life of the account plus Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary.) | Kept as proof of lawful processing under the DPDP Act |
| Marketing data | Contact details and preferences used for marketing, where you opted in | Retained until you unsubscribe or withdraw consent, and then only a minimal suppression record to honour your opt-out | Your marketing consent; ends on withdrawal |
Where more than one period could apply to the same record (for example, a report that is also relevant to an open complaint), we keep it for the longer of the applicable periods, and only for the record needed for that purpose.
Storage-limitation principle (DPDP Act, 2023)
Consistent with India's Digital Personal Data Protection Act, 2023, we follow the principle of storage limitation: we do not keep your personal data for longer than is necessary for the purpose we collected it for. Once a purpose is fulfilled — and no legal reason requires us to keep the data — we delete it or anonymise it so it can no longer be linked to you.
The periods in this Schedule are the maximum we intend to hold each record type. We may delete sooner where a record is no longer needed.
Legal holds
In some situations we are required, or reasonably need, to keep a record beyond its normal retention period. This is called a legal hold. It can apply where a record is relevant to:
an ongoing or anticipated legal claim, dispute or investigation;
a request or order from a court, regulator or competent authority; or
an obligation to keep records under applicable law.
While a legal hold is in place, the affected records are preserved and are not deleted, even if you have asked for erasure. When the hold ends, the records return to their normal retention period and are then deleted or destroyed in the usual way. A legal hold is limited to the specific records concerned — it does not pause deletion of your other data.
Your deletion and erasure rights
Under the DPDP Act, you have rights over your personal data, including the right to:
access the personal data we hold about you;
correct inaccurate or incomplete data;
erase your personal data where it is no longer needed for the purpose it was collected for, or where you withdraw the consent it was based on;
withdraw consent to any optional use (such as profiling, research, biobank retention or marketing) at any time, as easily as you gave it;
nominate another individual to exercise your rights in the event of your death or incapacity; and
raise a grievance with us, and — if unresolved — complain to the Data Protection Board of India.
When you ask us to erase your data, we will delete or anonymise it unless we are required to keep specific records to meet a legal obligation (for example, tax and invoice records) or a legal hold applies. In that case we keep only the minimum record required, for the minimum time, and delete the rest. Withdrawing consent does not affect anything we lawfully did before you withdrew it.
To exercise any of these rights, contact us at legal@vamsbiome.com, or our privacy contact at privacy@vamsbiome.com.
Secure destruction
When a retention period ends, or when a valid erasure request is completed, we dispose of the record or sample securely and irreversibly:
Digital data is deleted from our active systems and, on the routine cycle, from backups, using methods designed to prevent recovery; or it is irreversibly anonymised so it can no longer be linked to you.
Raw sequencing files are deleted or anonymised so they can no longer be attributed to you.
Residual biological samples are destroyed using appropriate methods for biological material, so no usable sample remains.
Where we use service providers to process data or handle samples on our behalf, we require them to apply equivalent deletion and destruction standards for material held on our instruction.
Backups are held on a rolling basis and are overwritten in the normal cycle; data removed from live systems is removed from backups as those backups are refreshed.
Version and Change History
Document name: Data & Sample Retention Schedule
Version: 1.0
Effective date: 10 July 2026
Change history: v1.0 (10 July 2026) — Initial publication.