Privacy Policy

1.Who We Are

SwasthSathi is an open health screening initiative developed by Team COGNITEX, KSV University, Gandhinagar, Gujarat, India. The platform was created for ImpactThon 2025-26 and is operated as a non-commercial public health tool.

Contact: For privacy inquiries, reach us at thakkarshlok2007@gmail.com.

2.Legal Basis (DPDP Act 2023)

This policy is framed in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act). We process your personal data on the following bases:

• Consent: You explicitly create an account and submit a health screening form. Submission constitutes consent to process the data entered.
• Legitimate Use: Account registration and authentication data are processed to deliver the service you request.

You may withdraw consent at any time by requesting deletion of your account and data (see Section 7).

3.Data We Collect

We collect the minimum data required to operate the screening service:

We do not collect cookies for analytics or advertising. We do not use third-party tracking scripts.

4.How We Use Your Data

• To compute and display your diabetes and hypertension risk assessment.
• To store your screening history so you can track risk changes over time.
• To authenticate your account and secure your records from other users.
• To display your name and location on the dashboard.

We do not use your data for marketing, profiling, advertising, or any commercial purpose.

5.Data Storage & Security

Your data is stored in Supabase (PostgreSQL), a managed cloud database with the following protections:

• Row-Level Security (RLS): Every database query is restricted by auth.uid() = user_id. No user can read, modify, or delete another user's records — this is enforced at the database level, not just the application layer.
• Encryption in transit: All communication between your browser and the database uses HTTPS/TLS.
• Encryption at rest: Supabase encrypts stored data at rest using AES-256.
• Access control: Direct database access requires authenticated credentials that are not exposed in the client-side application.

Supabase infrastructure is hosted on AWS. For Supabase's own data processing and security policies, see supabase.com/privacy.

6.Data Sharing

We do not sell, rent, or share your personal data with any third party, with the following limited exceptions:

• Supabase (infrastructure provider): Your data is stored on their servers as described above. They act as a data processor on our behalf.
• Legal obligation: If required by Indian law or a lawful court order, we may disclose data to competent authorities.

The OCR feature (Tesseract.js) runs entirely in your browser. Report images are never transmitted to any server.

7.Your Rights under DPDP Act 2023

As a Data Principal under the DPDP Act, you have the following rights:

To exercise any right, email thakkarshlok2007@gmail.com with the subject line "DPDP Data Request". We will respond within 30 days.

8.Data Retention

We retain your data for as long as your account is active. If you request account deletion, all personal data and health screening records will be permanently deleted within 30 days of the verified request.

Aggregate, de-identified statistical data (e.g., number of screenings performed) may be retained indefinitely as it cannot identify any individual.

9.Children's Privacy

SwasthSathi is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a child has submitted data, please contact us for immediate deletion.

10.Special Category Data (Health Information)

Health and medical data is a special category of sensitive personal data under the DPDP Act. By submitting a health screening form, you explicitly consent to the collection and processing of this data solely for the purpose of generating your personal risk assessment.

11.Changes to This Policy

We may update this policy as the platform evolves. Material changes will be announced on the homepage. Continued use after the effective date of any revision constitutes acceptance of the updated policy.