Privacy Policy

Last updated: March 2025 · Compliant with DPDP Act, 2023

In plain language: We collect only the health information you give us, we store it securely, we never sell it, and you can delete your account and all your data at any time.

1. What We Collect

  • •Phone number or email address for account creation
  • •Name, date of birth, and gender for your health profile
  • •Health conditions, allergies, and symptom diary entries you choose to enter
  • •Consultation notes and prescriptions issued by your doctor
  • •Payment information (processed by Razorpay — we never store card details)
  • •Device and usage data for platform security and improvement

2. How We Use Your Data

  • •To connect you with homeopathic doctors for consultations
  • •To display your health history to your doctor during consultations
  • •To send appointment reminders and prescription notifications via WhatsApp
  • •To generate AI remedy suggestions (no personal data leaves HealRoots servers)
  • •To comply with legal obligations under Indian healthcare regulations

3. Data Sharing

  • •Your doctor: sees your health profile and symptom diary for your consultations only
  • •Razorpay: receives payment data necessary to process transactions
  • •We never sell your data to advertisers, data brokers, or third parties
  • •Government authorities: only if legally required by a court order

4. Your Rights (DPDP Act 2023)

  • •Right to access: request a copy of all data we hold about you
  • •Right to correction: fix inaccurate data in your profile
  • •Right to erasure: delete your account and all associated data
  • •Right to grievance redressal: contact our Data Protection Officer
  • •Right to nominate: designate a person to exercise rights on your behalf

5. Data Security

  • •All data is encrypted at rest (AES-256) and in transit (TLS 1.3)
  • •We use Supabase for application data storage. Contact us for current hosting-region and processor details before sharing sensitive records.
  • •Access to production databases is restricted to core engineering team with MFA
  • •Report suspected security or privacy issues using the contact details below.

6. Data Retention

  • •Active accounts: data retained for the duration of your account
  • •You may request account deletion. We will explain what can be deleted and any records that must be retained before confirming completion.
  • •Clinical and payment records may require retention for applicable professional, legal, or accounting obligations. We do not promise automatic deletion or a fixed retention period on this page.

7. Contact & Grievances

Data Protection Officer: privacy@healroots.app

We will respond to all data requests within 72 hours.