Privacy Policy

Welcome to the Privacy Policy of Swastify Foundation. This Policy explains what we collect through this website and the Qavach® Parent App (together, the “Platform”), how we use it, and the choices available to you and your child.

Index: Personal Information · Information We Collect · Our Use of Your Information · How Information Is Collected · Samples Collection · Children’s Data & Parental Consent · Data Protection & Grievance Officer · User Account Deletion · Data Breach Notification · Research Use of Data · Data Storage & Hosting · External Links · Cookies · Google Analytics · Your Rights · Compliances · Confidentiality · Other Information Collectors · Our Disclosure of Your Information · Accessing, Reviewing and Changing Your Profile · Security · Severability · Amendment · Consent Withdrawal, Data Download & Data Removal Requests · Medical Disclaimer · Contact Us

Headings are for organizational purposes only and do not affect interpretation of this Policy.

Information we collect

We may collect: – Personal data, including name, date of birth, email address, postal address, and relationship to the child (when applicable) – Government ID, where required — see “Children’s Data & Parental Consent” below – Device and usage information, via permissions granted for location, storage, etc. – Tracking information, such as IP address, device ID, and platform interaction data – Personal health information, including individual and family medical history, blood group, etc. – Biospecimens (e.g. blood, urine, stool) — not stored; see “Samples Collection” – Digital samples (e.g. photographs, videos, x-rays, scans) – Diagnostic measurements (e.g. height, weight, blood pressure, visual acuity, ECG)

This policy applies to all visitors, including those who do not register. We use this information only to provide opted-in services, communicate account/service updates, provide support, and comply with applicable law. Where a requested service involves a third party (e.g. partner clinic or lab), relevant information may be shared with that third party solely to fulfil your request. You may withdraw consent for non-essential communications at any time by emailing [INSERT CONTACT EMAIL].

Children’s data & parental consent

Because Qavach serves children aged 2 to 5, nearly all personal and health data we collect relates to a child who cannot themselves provide consent under law.

• We obtain verifiable consent from a parent or legal guardian before collecting or processing a child’s personal data, in line with the Digital Personal Data Protection Act, 2023.
• We do not use a child’s personal data for behavioural monitoring, tracking, or targeted advertising, and do not knowingly serve targeted ads to children.
• Aadhaar number is optional, not mandatory, for using the Platform. Where voluntarily provided, it is collected, stored, and used solely in accordance with the Aadhaar Act, 2016. [CONFIRM with counsel]: alternative identifiers (e.g. birth certificate, passport, school ID) should be accepted as substitutes.
• Upon the child reaching the age of majority, we will, where feasible, transition data control to the individual and seek their independent consent to continue processing; until then, the parent/guardian retains full control, including the right to access, correct, or delete the child’s data.

Our use of your information

Health data, samples, and diagnostic measurements you provide are used to deliver and improve screening services, maintain internal records, and comply with legal/statutory requirements. We do not sell, license, or trade your personal information, and will not share it with others except as instructed by you or required by law.

How information is collected

We identify the purpose of collection before or at the point of collection, and retain personal information only as long as necessary for that purpose, collected through lawful, fair means with your knowledge and consent.

Samples collection

Biospecimens are not stored — they are consumed in generating the assessment report. Digital samples (photographs, scans, x-rays) are retained for [INSERT RETENTION PERIOD], after which they are securely deleted unless retained longer with separate, explicit consent for research purposes.

Research use of data

Anonymized health data may be used for disease surveillance and public health research, research and medical publications, building new digital health products and AI models, and supporting wellness/preventive health initiatives. This requires separate, affirmative consent, distinct from your consent to receive screening services. Declining this consent does not affect your ability to use Qavach’s core screening services. [CONFIRM anonymization threshold with counsel.]

Data protection & grievance officer

Name: [INSERT NAME] Email: [INSERT EMAIL] Address: M/S Swastify Foundation, J-002, NCC Urban Nagarjuna Residency, Telecom Nagar, Gachibowli, Hyderabad – 500032, India

We aim to acknowledge grievances within [INSERT TIMEFRAME] and resolve them within [INSERT TIMEFRAME].

Data storage & hosting

Data is stored on servers located in [INSERT LOCATION]. Where data is processed or stored outside India, this will be disclosed along with applicable safeguards.

Data breach notification

In the event of a data breach affecting your or your child’s information, we will investigate and contain it as quickly as reasonably possible, notify affected users via email within [INSERT TIMEFRAME, e.g. 72 hours of confirmation], and notify the relevant regulatory authority where required by law.

User account & data retention

• PHR maintained for 12 months at no extra cost after services are provided.
• Offline copies downloadable at any time during this period; security of the downloaded copy is your responsibility.
• Deletion may be requested at any time within the 12 months.
• If not renewed, the account is suspended and PHR erased, with reminder notices from month 10 (up to 6 total).
• Anonymized data may continue to be used after deletion, where covered by separate research consent. Identifiable records cannot be retrieved once deleted.

External links

We do not control and are not responsible for third-party content, privacy practices, or availability linked from the Platform.

Cookies

By default, only strictly necessary cookies are active. Analytical, functionality, and targeting cookies require explicit opt-in via the cookie consent banner. Targeting cookies are not used on pages involving children’s data. Cookie preferences can be managed via [INSERT: settings link] or browser settings.

Google Analytics

We use Google Analytics to understand usage patterns; some anonymous data may be transmitted to and stored by Google on servers in the United States, governed by Google’s privacy policy.

Your rights

Subject to applicable law, you (or your child’s parent/guardian) have the right to access, correct, object to, or request erasure of data; withdraw consent; be informed of cross-border transfers; and lodge a complaint with the relevant authority.

Compliances

This is an electronic record under the Information Technology Act, 2000, published per Rule 3(1) of the IT (Intermediary Guidelines) Rules, 2011, and Rule 4 of the IT (Reasonable Security Practices Rules), 2011. We additionally process personal data in accordance with the Digital Personal Data Protection Act, 2023 and its rules as they come into force. [CONFIRM Significant Data Fiduciary classification with counsel.]

Confidentiality

Information is treated as confidential and not disclosed to third parties except where legally required. We do not sell, share, or rent personal information.

Other information collectors

This policy covers only data we collect directly. Information you share with other parties is governed by their own policies.

Our disclosure of your information

Disclosed only to external service providers fulfilling your request, or to law enforcement as required by law. Where reasonably possible, you will be notified by email before any such disclosure.

Accessing, reviewing, and changing your profile

You can review and update submitted information (except email ID) through the Platform; we will promptly correct inaccurate information on request.

Security

We follow industry-standard security practices including [INSERT: actual measures — encryption, access controls, etc.]. No system is completely secure.

Severability

If any part of this Policy is found invalid, the remainder continues in full force.

Amendment

This Policy may be updated periodically. Material changes affecting children’s data processing will be communicated directly to parents/guardians by email.

Consent withdrawal, data download & deletion requests

Email [INSERT CONTACT EMAIL] or contact the Grievance Officer above.

Medical disclaimer

Qavach provides preventive screening and risk-identification services. It is not a substitute for emergency medical care. If your child is experiencing a medical emergency, contact your physician or emergency services immediately.

Contact us

[INSERT CONTACT EMAIL] or write to: M/S Swastify Foundation, J-002, NCC Urban Nagarjuna Residency, Telecom Nagar, Gachibowli, Hyderabad – 500032, India