SwasthOne ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights over it. It applies to the SwasthOne mobile app and this website.
By using SwasthOne, you agree to the collection and use of information as described in this policy.
1. Who We Are
SwasthOne is operated by Radhe Ramya Corporation LLP, a Limited Liability Partnership registered in India (LLPIN: ACV-2647, GSTIN: 24ABNFR1900J1Z8), with its registered office at Office 208, Second Floor, Madhav Darshan, Limbda Lane, Jamnagar, Gujarat 361001, India. If you have any questions about this policy, contact us at privacy@swasthone.in.
2. What Data We Collect
Account Information
- Phone number (required for login via OTP)
- Name (provided by you during setup)
Family Member Profiles
- Name, relationship, age, gender, blood group, allergies
- Phone number (optional, used to invite members)
Medical Records
- Documents you upload: lab reports, prescriptions, X-rays, discharge summaries, and other medical files (PDF or image)
- Metadata: document title, type, category, date, doctor name, patient name
- AI-generated summaries and extracted data from your documents
Medications
- Medication name, dosage, frequency, start/end dates, notes
Identity Verification (Optional)
- Masked Aadhaar number (last 4 digits only), name, date of birth, and gender — collected only if you choose to verify your identity via Aadhaar. We do not store your full Aadhaar number.
Device & Technical Data
- Device type, operating system version
- Push notification token (FCM) — used only to send you notifications
- Crash reports via Firebase Crashlytics (includes device info and error stack traces)
- App usage analytics via Firebase Analytics (screen views, feature usage — no health data)
3. How We Use Your Data
- To provide the service: Store and display your medical records and family profiles
- To power AI insights: Your documents are sent to Google Vertex AI (Gemini) for analysis. See Section 5 for details.
- To send notifications: Join requests, record updates, medication reminders
- To verify identity: Aadhaar-based verification for family admins (optional)
- To improve the app: Anonymised crash and usage data
- To comply with law: As required under Indian law
4. Data Storage
Your data is stored on Supabase (PostgreSQL database and file storage), hosted in India (Mumbai / ap-south-1 region). Medical document files are stored in a secure cloud storage bucket and are accessible only to your family group.
We use industry-standard HTTPS encryption for all data in transit. Data at rest is encrypted by our storage provider.
5. Third-Party Services
We use the following third-party services. Each has its own privacy policy:
- Supabase — Database and file storage
- Google Vertex AI (Gemini 2.5 Flash) — Document analysis and AI health chat. Your document contents and health context are sent to Google's Vertex AI API and processed on Google's cloud servers. Under Google's Vertex AI terms, your data is not used to train Google's models. Google's data processing terms apply.
- Firebase (Google) — Push notifications (FCM), crash reporting (Crashlytics), and usage analytics. Firebase Phone Authentication may also be used as a fallback OTP channel when the primary SMS provider is unavailable; in that case your phone number is sent to Google to deliver the OTP.
- OTP / login SMS — To deliver the one-time password used for login, we rely on one of the following DLT-registered or telecom-integrated providers. Only your phone number is shared with the provider used for a given login:
The specific provider used may change based on availability, network reliability, and cost. We do not share any health data with these providers — only your phone number and the OTP text.
- Meta (WhatsApp) — Optional WhatsApp notifications for record confirmations and reminders. WhatsApp notifications are opt-in; you can turn them off at any time in the app or by replying STOP.
- Sandbox.co.in — Aadhaar OTP-based verification (only if you choose to verify). Sandbox receives only your Aadhaar number and the OTP needed to complete verification, and does not store your Aadhaar data beyond the verification session. See Sandbox's privacy policy at sandbox.co.in.
We do not sell your data to any third party.
6. Data Sharing
We share your data only in these cases:
- With doctors you choose: When you initiate a sharing session, the doctor receives your records for that session only. No permanent link is created.
- Within your family group: The family admin can see records for all members they manage.
- With service providers: As listed in Section 5, strictly to provide the service.
- As required by law: If required by a court order or applicable Indian law.
7. Children's Data
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, processing the personal data of a child (under 18) requires the verifiable consent of a parent or legal guardian. A simple self-declaration is not sufficient.
Until SwasthOne has implemented a verifiable parental-consent mechanism (for example, DigiLocker-based identity verification), the ability to add profiles for minors is disabled. We do not knowingly collect the personal data of any child without verifiable parental consent. If you believe a minor's data has been added without proper consent, contact us at privacy@swasthone.in and we will delete it promptly.
8. Your Rights (DPDP Act 2023)
Under India's Digital Personal Data Protection Act, you have the right to:
- Access — request a copy of your personal data
- Correction — update or correct inaccurate data
- Erasure — delete your account and all associated data
- Withdraw consent — at any time, for any specific purpose
- Nominate — nominate a person to exercise your rights in case of death or incapacity
- Grievance redressal — raise a complaint with our Grievance Officer
To exercise any of these rights, contact us at privacy@swasthone.in or use the account deletion feature in the app.
9. Data Retention
We retain your data for as long as your account is active. When you delete your account:
- All your personal data, family member profiles, medical records, and medications are permanently deleted
- Uploaded files are removed from storage
- Deletion is processed within 30 days
- Anonymised, aggregated analytics data (not linked to you) may be retained
See our full Data Deletion Policy for details.
10. Cookies
The SwasthOne mobile app does not use cookies. This website uses only essential cookies required for basic functionality. For details, see our Cookie Policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or SMS notification. The "Last updated" date at the top of this page reflects the most recent version.
12. Contact & Grievance