Draft for legal review, not yet in force.

Privacy policy

Astitva, a product of Velcro Ventures OPC Private Limited
Last updated: [date of publication]

This policy is for the people who use the Astitva app. It says what the app collects about you, why, where it is kept, who can see it and for how long. It also says what you can ask us to do with it, and how to ask.

The short version

What you log day to day stays on your phone: how each day felt, your dates, what you ate, how you moved and your body details. We never receive it.
Your account, your profile and what you post in Talk are kept on our servers.
Talk shows your first name and the first letter of your last name, like Priya S. Your full name goes only to a practitioner or lab you book.
We do not sell your data. There are no adverts in Astitva, and no advertising or analytics trackers.
You can see, correct and delete your data, and you can delete your account at any time.

Who we are

Astitva is a product of Velcro Ventures OPC Private Limited, a company registered in India ("we", "us").

Registered address: [registered address]
Email: [contact email]

We decide what Astitva collects and why. That makes us responsible for your personal data under Indian law, including the Digital Personal Data Protection Act 2023 (the DPDP Act), which calls us the data fiduciary.

This policy covers the Astitva app. The practitioners you can book use a separate app, Astitva for Practitioners, which has its own privacy policy.

What stays on your phone

Some of what you tell Astitva never leaves your phone. We do not receive it and cannot see it.

Where you are. Your stage and phase, the day you started it, and the dates you give the app: your cycle start, a transfer, a blood test, a negative result, the due date of a pregnancy you lost. The days you mark as hard. The app uses these to choose what Today shows, to be quieter on hard days, and to time reminders and tests.
How each day felt. Your daily check-ins.
Move and Eat. The poses you mark as done and the meals you mark as eaten.
Your body details, if you give them. Age, height, weight, how you eat (for example vegetarian or Jain), allergies, and conditions such as PCOS, endometriosis, thyroid, low ovarian reserve, unexplained infertility or a male factor. The app uses them to build your food plan. All of these are optional.
Your reminder settings.

How this is kept:

The app keeps it encrypted, with a key held in your phone's secure keystore.
It is left out of Android's backups, so it is not copied to your Google account. This also means it does not come with you to a new phone. Your account, your profile and your posts do.
It is kept for your account. Signing out does not erase it, but nobody sees it while you are signed out, and anyone who signs in to Astitva on this phone with another account sees only their own. Sign back in and it is there again.
It is erased when you delete your account in the app, or when you uninstall Astitva or clear its storage.

Reminders are made on your phone too, not sent by us. They never show their words on a locked screen, whatever your phone's own settings are; unlock it to read one. Some mention a date you gave the app, such as a transfer. You can turn each kind off under You.

What we keep on our servers, and why

Your account

Your email address and password. To make your account, let you sign in on any phone, send you a 6-digit code if you forget your password, and reply when you write to us. Your password is stored only in a scrambled, one-way form. Nobody can read it, including us.
Connection records. When you sign up and sign in, and technical details about each connection, such as your internet (IP) address and the time. To keep your account safe and to find faults.

Your profile

Your first name and last name, your date of birth and your gender, which you give when you make your account.

Your name. Talk shows your first name and the first letter of your last name, like Priya S. When you book a session or a test, the booking form starts with your first name and last name, and you can change them there.
Your date of birth. Astitva is for people 18 and over. Your date of birth is never shown to anyone else. A practitioner you book sees your age, worked out from it on the day you book. When you book a test, the lab form starts with your age.
Your gender. A practitioner you book sees it.

Our database lets only your own account read your profile. You can see and change it under You, Your details.

Talk, the circle

Your posts and replies, the topic you choose, and when you posted. To run the circle.
Who can read them: anyone signed in to Astitva, under your first name and initial. The circle is not on the open web, but anyone can make an account, so write only what you would be comfortable with a stranger reading. Other members could copy what you write.
Reports. When you report a post, we record the reason and the time on the post. We do not record who reported it, and the writer is never told.
Moderators, who today are the people who run Astitva, see reported posts and posts that have been taken down.

Before you post, the app checks your words for a few phrases that can mean someone is in danger, or is telling someone else what medicine to take. The check runs on your phone. It shows you the helplines or a short note, it never stops you posting, and its result is not sent to us.

Sessions with a practitioner (from [version])

The booking: the practitioner, the date and time, the price and how it is split, the time you agreed to the session terms, the name you give for the session (it starts as your first name and last name), your age on the day you book and your gender. Cancellations and missed sessions. If you raise a dispute, its reason and what you write.
Payment references from Razorpay: the order, payment and refund numbers. Not your card, UPI or bank details. Razorpay handles those, and we never see them.
Why: to hold the time, take payment, pay the practitioner, deal with cancellations, refunds and disputes, and keep the records tax law requires.
Who can see it: you; the practitioner, who sees the name you gave, your age, your gender and the time, but not your email address or anything you log in the app; and the people at Astitva who handle payments and disputes.

What you say in a session is between you and the practitioner. Every practitioner agrees with us to keep what you tell them confidential, as the rules of their profession require. [for the lawyer: true only once every practitioner listed has agreed to the practitioner agreement itself, where this duty is written.] Sessions are video calls inside the app, carried by 100ms. Astitva and 100ms never record your calls. The practitioner may keep a private clinical note, as their profession requires. Astitva never sees it.

The call itself (from [version]):

Your picture and your voice travel through 100ms's servers while the call is on, to reach the practitioner, and are not kept.
Your camera and microphone: the app asks for them the first time you join a call. You can turn your camera off during the call, or refuse it and talk by voice. The call cannot work without the microphone.
Bluetooth earbuds or a headset: if they are connected when you join, your phone may ask whether Astitva can connect to nearby devices. This lets the call play through them, and Astitva uses it for nothing else. If you refuse, the call still works.
What 100ms is told: that someone is joining as the patient, or as the practitioner, and never your name, email address or account. While the call is on it also sees what any call service needs, such as your phone's internet address and the quality of the connection.
When each of you joined and left the call, kept with the booking. If one of you says the other never came, this is how we can check. You, the practitioner and the people at Astitva who handle disputes can see it.

Tests from home (from [version])

Tests from home are not connected to a laboratory yet. Until they are, what you enter there stays on your phone. When they are connected:

Your lab details: the name on your ID, your mobile number, age, address and pincode, and the time you agreed to share them. For a panel that tests your partner's sample, his name and age, kept on that order only.
Your orders: the test, the collection date and slot, where the order has got to, the lab's report and the clinician's reading.
Why: so the lab can send someone to collect your sample, test it and send the report, and so that a clinician reads every result.
Who can see it: you; [lab partner], which receives your lab details and the test with each booking; and the clinician who reads reports for us. Nobody else at Astitva can open your report in Astitva's own tools.

The lab keeps its own records, under the law for laboratories and its own privacy policy. If you book a panel for your partner's sample, please do it with his agreement: his name, age and results will be in your account.

You can change or delete your lab details at any time in Book, Tests. Deleting them does not delete your past orders.

Astitva Plus (from [version])

Plus is bought through Google Play, and Google takes the payment. Astitva learns only which plan you have and whether it is active, never your payment details.

If you delete your account, the record of your purchases is erased, except each purchase's reference number, which we keep so that no other account can claim it. Our records no longer connect that number to you, but Google's can: Google knows which Google account made the purchase [to confirm with the lawyer: keeping the number for good, for this reason]. Deleting your account does not cancel Plus in Google Play: cancel it there first.

Notifications from our servers (from [version])

When a booking changes (confirmed, cancelled, marked as missed, under review), our servers keep a short note for you and send it to your phone through Firebase Cloud Messaging, a Google service. A note may show on your locked screen, depending on your phone's own settings. To send these notes, the app gives us a device token: a code that lets us reach Astitva on your phone.

When you write to us

What you send us and our reply. To answer you, and to keep the record of complaints the law requires.

Who else receives your data

Each receives only what it needs, for the reason given.

Practitioners you book (from [version]). Independent professionals, responsible for the care they give.
[lab partner] and the clinician who reads your results (from [version]).
Razorpay Software Private Limited (from [version]), which takes payment for sessions and tests. Your card, UPI and bank details go to Razorpay, under its own privacy policy.
Google. Google Play delivers the app, and takes payment for Plus (from [version]). Firebase Cloud Messaging carries notifications (from [version]).
Supabase, Inc., which runs our database, sign-in and file storage for us, as our data processor. Its servers for Astitva are in [region, to confirm].
100ms Inc (from [version]), which carries the picture and sound of a session's video call while it is on, as our data processor. Astitva and 100ms never record your calls, and 100ms is never told your name. It keeps its own record of each call, the times each side joined and left, as the service needs. Its servers for Astitva's calls are in India [to confirm: 100ms account set to India].
[email provider, to confirm], which carries our email, including the code for resetting your password.
Courts and government agencies, when the law requires us to, for example under a court order.

We do not sell, rent or trade your personal data, and we do not use it for advertising or marketing. If that ever changes, we will ask you first. If Astitva is ever sold or merged into another company, your data would move only under this policy, and we would tell you first.

Most of what you tell Astitva is about your health. Indian law treats health information, and your password and payment details, as sensitive. We collect it only with your consent, and use it only for the reasons in this policy.

You give consent step by step, when each thing is needed:

When you make your account: to this policy and the terms of use.
Before your first post: to the community guidelines.
When you book a session: on the "Before you book" screen. The time you agreed is recorded.
When you join a session's call: your phone asks you for the camera and the microphone the first time, and for nearby devices when Bluetooth earbuds or a headset are connected (from [version]).
When you save your lab details. The time you agreed is recorded.

You can withdraw consent at any time, as easily as you gave it:

Delete your lab details in Book, Tests.
Cancel a booking.
Turn your camera off during a call, or take the camera, the microphone or nearby devices away from Astitva in your phone's settings.
Turn reminders off under You, or notifications off in your phone's settings.
Ask us to remove a post.
Delete your account, which withdraws everything.

Withdrawing consent does not undo what was done before it. Some things cannot happen without the data they need: a session needs a booking, and an account needs an email address.

Astitva is for adults

Astitva is for people 18 and over. When you sign up, you give your date of birth before any account is made. If you are under 18, the app stops there and keeps nothing you typed. If you later change your date of birth to one under 18, the app signs you out.

We do not check dates of birth against documents. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you know of one, please write to [contact email].

Your rights

You have the right to:

Know what we hold: a summary of your personal data, what we do with it, and who we have shared it with.
Correct it or bring it up to date. Your first name, last name, date of birth and gender are under You, Your details. Your stage and phase are under You, and your dates are in Track. Your lab details are in Book, Tests. For anything else, write to us.
Have it erased. Delete your lab details in Book, Tests. Delete your account in the app, in the You tab, or through our account deletion page. There is no button to delete a single post: write to us and we will remove it.
Withdraw your consent, as above.
Nominate someone to use these rights for you if you die or become unable to act for yourself. Write to us with their name and how to reach them.
Complain, to us first, and then, if you are not satisfied, to the Data Protection Board of India.

To ask, write to [contact email] from the email address of your account, so we can find it. If you write from another address, we will ask you to show the account is yours before we act. We reply within the times on our grievances and contact page.

The law also asks something of you: give us true information, and do not use anyone else's name or details.

How long we keep things

What is on your phone: until you delete it, delete your account in the app, or remove the app.
Your account and profile: until you delete your account. After that, a locked record of your email address, first name and last name, date of birth and gender, when the account was made and closed, and when you agreed to this policy and the terms, is kept for 180 days, because India's IT Rules 2021 require platforms that host posts to keep it. Then it is erased.
Accounts nobody uses: [proposed: deleted after 3 years without a sign-in, with an email 48 hours before].
Your posts and replies: until you ask us to remove them or you delete your account. When you delete your account, each one shows "Removed by its author", without your words or your name, and the replies other members wrote under them stay. A post or reply of yours that a moderator took down, or that was hidden after a report, is kept locked with its words for 180 days after you delete your account, in case the law needs it, and then erased. While your account is open, a post a moderator takes down is hidden at once and kept locked [proposed: and erased at 180 days].
Bookings and payment records (from [version]): until 8 years after the end of the financial year of the last payment or refund on them, the longest period company and tax law ask us to keep accounts. If you delete your account, your account, your name, age and gender, and what you wrote in a concern are removed from them at once [proposed: the CA to confirm a receipt needs no name].
Disputes: [proposed: 3 years after the decision]. If you delete your account, the reason and what was decided stay with the payment records, without what you wrote.
When each side joined and left a call (from [version]): with the booking, [proposed: 3 years after the session, the same as disputes]. After an account is deleted, it stays with the booking's payment records. The call's picture and sound are never kept.
Lab details: until you delete them or your account. Lab orders, reports and readings: until you delete your account. After that, each order, with the name and age its sample was taken under, its results and the doctor's reading, is kept locked without your account for [proposed: 3 years], as medical records, and then erased. An order called off before any sample was taken is erased at once. The lab's PDF of each report is deleted when you delete your account.
Notifications from our servers: [proposed: 90 days], and deleted when you delete your account.
Device tokens: [proposed: until you sign out or delete your account].
Plus purchases (from [version]): until you delete your account. After that, only each purchase's reference number is kept, so that no other account can claim it.
Emails and complaints you send us: [proposed: 3 years after the last message].
Sign-in records: each sign-up, sign-in, password reset and account deletion, with the email address and the internet address (IP address) it came from. Kept for 180 days, because India's CERT-In directions ask for logs to be kept that long, and then erased, a deleted account's too.
Technical logs: [proposed: 1 year].
Backups: Supabase backs up our database, and each backup keeps a copy for [backup period, per our Supabase plan]. Deleted data leaves the backups when that period ends.

How we protect it

Everything between the app and our servers is encrypted in transit (HTTPS).
Our database checks every request against your account. You can read only what is yours, or what is meant to be shared, like posts in Talk. Members cannot change or delete each other's data.
Supabase encrypts what is stored on its servers.
Card, UPI and bank details go straight to Razorpay or Google, never to us.
The people who run Astitva can reach data on our servers through Supabase's own tools. We use that access only to keep Astitva working, to act on a request from you, or when the law requires it.
No system is perfectly safe. A screen lock on your phone protects what Astitva keeps there.
If a breach affects your data, we will tell you, the Data Protection Board of India and CERT-In, as the law requires.

Where your data is kept

Our servers are run by Supabase in [region, to confirm]. [If the region is outside India, add: "This means your data is kept outside India."] Razorpay processes payments in India. Video calls run on 100ms's servers in India [to confirm: 100ms account set to India]. Google's services may process data in other countries.

Changes to this policy

When we change this policy, we change the date at the top and tell you in the app before the change takes effect. If a change means using your data in a new way, we ask for your consent first.

Complaints and contact

Our grievance officer: [grievance officer's name], [designation], Velcro Ventures OPC Private Limited, [registered address]. Email: [grievance email]. Phone: [phone number].

We acknowledge every complaint within 24 hours and resolve it within 7 days. Some complaints have shorter limits, set out on our grievances and contact page. If you are not satisfied with how we handled a complaint about your personal data, you can complain to the Data Protection Board of India.