This policy describes exactly how the service works today and is published so nothing is hidden. It has not yet been reviewed by a lawyer against the Digital Personal Data Protection Act, 2023. That review is happening before we take bookings from the public.
What we collect
Only what is needed to collect a sample and return a report.
- Your account — name, email address and profile picture from Google when you sign in, plus the mobile number you give us.
- Who the test is for — name, age, gender and relationship to you, so a report is attached to the right person.
- Where to come— address, landmark and pincode. If you tap “use my current location”, your device coordinates are sent to our address lookup provider and the resulting address is saved with the booking.
- Your bookings — the tests ordered, slot, amount and status, and any report a pathologist releases to you.
We do not collect payment card details. You pay the phlebotomist at your door in cash or by UPI, so no card number ever reaches us.
Where it is stored
- Database — a managed PostgreSQL database hosted by Neon in AWS
ap-southeast-1(Singapore). Singapore is the nearest region to Hyderabad available to us and keeps the service fast; it does mean your data is processed outside India. - Reports and documents — Cloudflare R2 object storage, reachable only through a signed, expiring link generated after we have checked you are allowed to see it.
- Email — Brevo sends your booking confirmation and report notification.
- Sign-in — Google, through Firebase. We receive your email address and name; Google does not receive your test results.
- Address lookup — LocationIQ (OpenStreetMap data), or Google Maps, used only if you tap the location button.
Who can see your results
Test results are the most sensitive thing here and are treated that way. A report is released only after a qualified pathologist signs it off, and it can then be opened by you, when signed in to your account, and by our lab and operations staff who need it to do their job.
We never put a result in an email or a message. A notification tells you a report is ready and links to it behind sign-in — it never carries the finding itself, because email is forwarded, backed up and read on shared screens.
Every successful read of a report is recorded with who opened it and when.
What we never do
- Sell your data, or share it with advertisers or data brokers.
- Share your results with an employer, insurer or family member without your instruction.
- Send results over email or WhatsApp.
How long we keep it
Bookings and reports are kept as long as your account exists, so you can compare a result against an earlier one — which is most of the value of having them. Medical records are also subject to retention rules we must follow, so a released report may be retained after an account is closed.
Your choices
- See what we hold — your profile, family members, addresses and bookings are all visible in your account.
- Correct it — edit your details there at any time.
- Have it deleted — email or call us and we will remove your account and personal details, subject to the retention rules above.
Contact
Questions about anything on this page, or to ask for your data to be removed: