Data protection

1. Our commitment

Children's health information needs more care than most data. This page explains the safeguards we apply, how you can use your rights under the Digital Personal Data Protection Act, 2023, and what we do if something goes wrong. It supplements our privacy policy.

2. Principles we follow

• Purpose limitation: we use data only for the care and service purposes we told you about.
• Data minimisation: we ask only for what a feature needs.
• Accuracy: you can correct your data and your child's at any time.
• Storage limitation: we delete or anonymise data once we no longer need to keep it.
• Security: we apply reasonable technical and organisational safeguards.
• Accountability: we keep records of how data is processed and who accessed it.

3. Technical and organisational safeguards

• Encrypted connections (TLS) for all app and website traffic.
• Separate account types for parents, doctors, and staff, with role-based permissions for staff.
• Short-lived access tokens and server-issued credentials for video consultations.
• Human review of every doctor's credentials before they can see patients.
• Audit logs of administrative actions and verification decisions.
• Error monitoring that removes sensitive values before logs are stored.
• Contracts requiring our service providers to protect data and use it only on our instructions.

4. Making a data request

You can ask us to:

• Give you a summary of your personal data and who we have shared it with.
• Correct or complete inaccurate data.
• Erase data, subject to records we are legally required to keep.
• Stop processing based on consent you have withdrawn.
• Record a nominee who can act for you.

How to ask

1. Many changes can be made directly in the app under Settings or the child's profile.
2. Otherwise, email [privacy@your-domain] from the address linked to your account.
3. We may ask you to confirm your identity before acting, to protect your data.

How quickly we respond

5. If there is a data breach

If a breach affects your personal data, we will contain it, notify the Data Protection Board of India and CERT-In as required, and tell affected users without undue delay. Our notice will explain what happened, the likely impact, and the steps we and you can take.

6. Where data is stored

Data is hosted with cloud providers that meet recognised security standards. Where data is processed outside India, we do so only to countries not restricted by the Government of India under the DPDP Act, and with contractual safeguards in place.

7. Grievances and escalation

Please contact our Grievance Officer first:

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

8. Contact