Privacy Policy
Last updated: [date of lawyer-approved version]
CareVoyage is run by [legal entity name], [registered address], India. We are the "data fiduciary" for the personal data you give us. This policy explains what we collect, why, and your rights.
What we collect
- Account details: your email address, and your name if you sign in with Google.
- Profile details: your name, country, preferred language and whether you are the patient or family.
- Trip details: the patient's country, treatment type, city in India, hospital, number of attendants and arrival date.
- Checklist progress: which documents you mark as "Have it", "Pending" or "Not needed".
- Saved contacts and any "Report wrong info" messages you send.
- Referral details: your referral code and who referred you, if anyone.
We do not collect medical records, passport numbers or document scans in this version. The treatment type you choose can reveal health information, so we treat it with extra care.
Why we use it
- To build and save your personalised document checklist.
- To show the contacts you saved and the person who referred you.
- To keep your account secure and stop abuse.
- To check and correct directory entries when you report a problem.
We use your data only for these purposes. We never sell it. We never use it to train AI models.
Your consent
We ask for your consent when you create your account. You can withdraw it at any time by deleting your account. Withdrawing consent does not affect processing done before you withdrew.
Your rights
- See a summary of the personal data we hold about you.
- Correct or update your details.
- Delete your account and all your trips. We remove your personal data within 30 days.
- Nominate someone to act for you if you die or cannot act yourself.
- Raise a complaint with our Grievance Officer, then with the Data Protection Board of India.
Where your data is stored
Your data is stored in India (Mumbai region) by our database provider. We use these service providers to run CareVoyage: Supabase (database and sign-in), Vercel (hosting), Resend (sign-in emails), Google (if you choose "Continue with Google") and Cloudflare (bot protection). [Confirm the provider list and any transfers outside India.]
How long we keep it
We keep your data while your account is open. When you delete your account, we delete your personal data within 30 days, unless the law requires us to keep it longer. [Confirm retention for backups and logs.]
Children
You must be 18 or older to create an account. A parent or guardian can plan a trip for a child patient. [Confirm verifiable parental consent requirements.]
Grievance Officer
[Name], Grievance Officer
Email: [grievance email]
Address: [address]
We reply within [number] days.
Changes to this policy
We will tell you by email before any important change takes effect.