Privacy Policy

01Introduction & Who We Are

Welcome to Zuvi Care, a digital women’s healthcare platform operated by ZUVI-CARE SOLUTIONS PRIVATE LIMITED (“we”, “us”, “our”, or the “Company”). We are incorporated under the Companies Act, 2013 (CIN: U62011KA2026PTC217514) and registered in Karnataka, India.

Zuvi Care is a discovery and appointment-booking platform. We help you find obstetricians and gynaecologists practising near you, book in-person appointments at their clinics, message them about a booked appointment, and keep a health profile you may choose to share with a doctor you consult. We also offer Ask Zuvi, an AI health companion that answers questions using only health articles our medical team has reviewed and approved. Ask Zuvi is not a doctor and does not diagnose; see section 2.6 for what it records.

We are not a healthcare provider. We do not practise medicine, employ the doctors listed on the Platform, or provide diagnosis, treatment, or medical advice. Consultations happen in person at the doctor’s clinic. The Platform does not currently offer teleconsultation, video consultation, prescription services, diagnostic or laboratory ordering, or a community forum.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, your rights as a Data Principal under the Digital Personal Data Protection Act, 2023 (DPDP Act), and how to contact us.

By using the Zuvi Care platform, website (zuvicare.com), or mobile application, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform.

02What Personal Data We Collect

2.1 — Data You Provide Directly

We collect the following categories of personal data that you voluntarily provide when registering or using Zuvi Care:

Account Data: Email address, name, and password (stored only as a salted hash, never in plain text). If you sign in with Google, we receive a Google account identifier and your email address from Google. We also record sign-in timestamps, sign-in method, and failed sign-in attempts for account-security purposes.
Profile Data: Date of birth, gender, profile photo (if you upload one), your city and locality, and an emergency contact name and phone number (if you provide one).
Health Profile Data (sensitive personal data): A structured health profile you complete voluntarily and at your own pace. It may include height, weight, blood group, phone number, address, menstrual history, obstetric history, contraception history, medical conditions, surgical history, medications and allergies, family history, lifestyle information, and your current health concerns. Your health profile is private to you by default. It is shared with a doctor only for the sections you expressly select, and only with a doctor you have booked with.
Health Records You Upload: Documents and images you choose to upload (for example, scans or test reports), along with the file name, file type, size, and any label you give them. Each uploaded record is private until you expressly mark it as shared with a doctor.
Appointment Data: The doctor and clinic you book, appointment date and time, visit type, your stated reason for the visit, notes you share with the doctor, and any cancellation or rescheduling history. You may also keep private notes against an appointment; these are visible only to you and are never shared with the doctor.
Message Data: Messages and attachments exchanged between you and a doctor you have booked with. These messages are private to that conversation and are not public or visible to other patients.
Doctor-Generated Data: Notes a doctor records against your appointment. A doctor may keep private clinical notes that are not visible to you, and may separately share notes with you.
Pre-Login Discovery Data: If you use our guided doctor-matching questions before creating an account, we store your stated concern, urgency, locality, whether it is a first visit, and any doctor-gender preference, against a temporary session identifier and a hashed (non-reversible) form of your IP address. We do not link this to your identity unless you subsequently create an account.
Notification Preferences: Your choices about which emails and in-app notifications you receive.

We do not collect payment information. Appointments booked through the Platform are currently free to book, and payment for consultation is made by you directly to the doctor or clinic. We do not operate a payment gateway and do not receive or store card, UPI, or bank details.

2.4 — Health Tools That Stay On Your Device

The Platform offers self-help health tools — including cycle and period tracking, pregnancy tools, conception tracking, and sleep, water, and nutrition logs. Data you enter into these tools is stored only in your own browser, on your own device. It is not transmitted to our servers, we cannot read it, it is not linked to your account, and it is not shared with doctors or anyone else.

Because this data lives in your browser’s local storage, it will be lost if you clear your browsing data, use a different browser or device, or browse in private mode. It is not backed up by us and cannot be recovered by us. Anyone with access to your device and browser profile may be able to see it.

2.5 — Speaking Your Question (Voice Input)

Ask Zuvi lets you speak a question instead of typing it. This is entirely optional, the microphone is used only while you are holding a recording open, and you can always type instead.

When you speak, your browser sends the audio to the company that makes your browser in order to transcribe it. For Google Chrome that is Google; for Safari it is Apple. This happens inside your browser, before the words reach us, and it is governed by that company’s privacy policy rather than this one. Zuvi never receives, hears, or stores the audio recording itself.

What we receive is the text. It reaches us only when you press Send, and it is then handled exactly like a question you had typed: stored against your account as part of that conversation, and described in section 2.6. You can read and edit the transcribed text before sending it, and nothing is sent automatically.

If you would rather no third party hear the question, type it. The microphone button does not appear at all in browsers that do not offer speech recognition.

The “Read aloud” option uses the speech voices installed on your device or provided by your browser to read an answer back to you. Depending on your device and the voice selected, that text may be processed by your browser or operating system provider.

2.6 — Questions You Ask Ask Zuvi (sensitive personal data)

Ask Zuvi is an AI health companion. It is not a doctor, and it answers only from health articles our medical team has reviewed and approved. You must be signed in to ask it anything.

We store the questions you ask, in your own words, and the answers you were given, against your account, so that you can return to a conversation later. We also record which approved articles were used to ground each answer. Questions you ask Ask Zuvi are health information about you, and we treat them as sensitive personal data.

A small number of authorised Zuvi staff can read these questions and answers. We do this for two reasons only: to check that Ask Zuvi is answering safely and correctly, and to find the health topics women are asking about that our articles do not yet cover, so we can write them. Access is granted individually rather than by job title, and every export of this data is logged.

Your Ask Zuvi conversations are not shared with doctors on the Platform, are not attached to your appointments, and are not used to advertise to you. If you have allowed Ask Zuvi to use what you record in the on-device health trackers, that information is sent with your question only for as long as it takes to answer it, and you can withdraw that permission at any time in the chat itself.

2.2 — Data We Collect Automatically

When you use the Platform, we automatically collect:

Usage Data: Pages visited, features used, time spent, search queries, click patterns, and navigation paths.
Device Data: Device type, operating system, browser type and version, IP address, and device identifiers.
Location Data: Country and city-level location inferred from IP address. We do not collect precise GPS location unless you expressly grant permission.
Cookie and Tracking Data: As described in our Cookie Policy.

2.3 — Data We Receive from Third Parties

From Doctors on the Platform: Notes a doctor records against an appointment you booked with them.
From Google (only if you use Google Sign-In): Your email address and a Google account identifier, used solely to create and authenticate your account. We do not receive your Google password, contacts, or any other Google data.

We do not purchase personal data, and we do not receive personal data from data brokers, advertisers, diagnostic laboratories, insurers, or employers.

03Why We Collect & Process Your Data

Under the DPDP Act, 2023, we process your personal data only on the basis of your free, specific, informed, unconditional, and unambiguous consent. For health data, we obtain explicit consent before collection. We process your data for the following purposes and no others:

To create and secure your account: Registering you, verifying your email address by one-time code or Google Sign-In, authenticating your sign-ins, and protecting your account against unauthorised access. Data used: Account Data.
To help you find a suitable doctor: Matching you to obstetricians and gynaecologists based on your locality, stated concern, urgency, and preferences, and ranking search results. Data used: Profile Data, Pre-Login Discovery Data.
To book and manage your appointments: Reserving a slot with your chosen doctor and clinic, confirming, rescheduling, or cancelling it, and maintaining your appointment history. Data used: Account Data, Profile Data, Appointment Data.
To share health information with a doctor you have chosen: Making available to that doctor only the health profile sections and health records you have expressly selected for sharing. Data used: Health Profile Data, Health Records You Upload — limited to what you have shared.
To let you and your doctor communicate: Delivering and storing messages and attachments between you and a doctor you have booked with. Data used: Message Data.
To send you service communications: Appointment confirmations, reminders, reschedule and cancellation notices, sign-in codes, and account notices, according to your notification preferences. Data used: Account Data, Appointment Data, Notification Preferences.
To keep the Platform safe and accountable: Detecting and preventing fraud, abuse, and unauthorised access; maintaining audit logs of administrative actions and of access to health data; and investigating complaints. Data used: Account Data, usage and device data, audit logs.
To operate and improve the Platform: Diagnosing faults, monitoring reliability, and understanding in aggregate which features are used. Wherever practicable this is done using aggregated or de-identified data. Data used: usage and device data.
To comply with law: Meeting our obligations under applicable law and responding to lawful orders from courts or regulators. Data used: as strictly required.

We will never use your health data for advertising or commercial profiling; sell or rent your personal data to anyone; share your health data with advertisers, data brokers, insurers, or employers; or use your data for any purpose not listed above without first obtaining fresh, specific consent from you.

04Your Consent Rights

Under the DPDP Act, 2023, you have the following rights:

Right to give consent: Consent must be free, specific, informed, unconditional, and unambiguous. We obtain consent through clear opt-in toggles — never pre-ticked checkboxes.
Right to withdraw consent: You may withdraw your consent for any purpose at any time through your account settings (Settings > Privacy > Consent Management) or by emailing info@zuvicare.com.
Right of Access: You may request a copy of all personal data we hold about you.
Right of Correction: You may request correction of any inaccurate or incomplete personal data.
Right of Erasure: You may request deletion of your personal data. We will comply unless we are required to retain data by law (e.g., consultation records must be kept for 7 years).
Right of Grievance Redressal: You may file a complaint with our Grievance Officer. If unsatisfied, you may approach the Data Protection Board of India.

To exercise any of the above rights, email info@zuvicare.com. We will acknowledge your request within 72 hours and respond substantively within 30 days.

05How We Share Your Data

We do not sell your personal data. We may share your data only in the following limited circumstances:

With Doctors on the Platform: When you book a consultation, your health profile and consultation details are shared with the doctor you are consulting. This is done with your explicit consent.
With Diagnostic Laboratories (when applicable): If you order a lab test, your name, contact details, and test request are shared with the partnered laboratory with your explicit consent.
With Technology Service Providers (Data Processors): We use third-party service providers for cloud hosting (e.g., AWS/GCP), payment processing (e.g., Razorpay), email delivery, SMS notifications, and analytics. All are bound by Data Processing Agreements.
With Regulatory Authorities: We may disclose data to comply with applicable law, court order, or direction from a regulatory authority (including the Data Protection Board of India).
In Connection with a Business Transfer: If Zuvi-Care Solutions is acquired or merged, your data may be transferred to the acquiring entity, subject to the acquiring entity honouring this Privacy Policy.

We will not share your health data, personal data, or consultation records with any advertiser, data broker, insurance company, or employer without your explicit separate consent.

06Cross-Border Data Transfers

Your personal data is stored in India by default. If we use any service provider whose servers are located outside India, we ensure: (a) the transfer is to a country notified by the Government of India as providing adequate data protection; or (b) the service provider is bound by standard contractual clauses approved under the DPDP Act.

07Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Consultation records and prescriptions are retained for a minimum of 7 years as required by Telemedicine Guidelines, 2020. Account data is retained until you delete your account, after which it is purged within 30 days except where retention is legally required.

08Data Security

We implement the following security measures to protect your personal data:

Encryption at rest: All health data and personal data stored on our servers is encrypted using AES-256 encryption.
Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3.
Access controls: Role-based access controls ensure that only authorised personnel can access health data, and only to the extent necessary for their role.
Audit logs: All access to health records is logged and regularly reviewed.
Vendor security: All data processors are assessed for security compliance and bound by Data Processing Agreements.
Breach response: In the event of a data breach, we will notify the Data Protection Board of India and affected users within 72 hours.

09Children’s Data

Zuvi Care is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18 without verifiable parental or guardian consent. If you believe a minor has provided us with personal data without parental consent, please contact info@zuvicare.com immediately.

10Cookies & Tracking

Please see our separate Cookie Policy (available on the Platform) for full details of the cookies and tracking technologies we use, the categories of cookies (strictly necessary, functional, analytics), how to manage your cookie preferences, and the third-party analytics tools we use.

11Third-Party Links

The Platform may contain links to third-party websites or services. This Privacy Policy applies only to the Zuvi Care Platform. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party site you visit.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or Platform features. When we make material changes, we will: (a) update the Last Updated date at the top of this Policy; (b) notify you by email if the change is material; and (c) where required by law, seek fresh consent.

13Grievance Officer & Contact

To exercise your rights, report a concern, or ask any question about this Privacy Policy, please email info@zuvicare.com. We take all privacy concerns seriously and will respond promptly.

Grievance Officer: The Grievance Officer, ZUVI-CARE SOLUTIONS PRIVATE LIMITED
Email: info@zuvicare.com
Response time: Acknowledgement within 72 hours, substantive response within 30 days.