Privacy Policy

1. Who We Are (Data Fiduciary)

SymptomSense ("we", "our", "us") operates the AI-powered symptom-checker and health-triage service at symptomsense.in. For the purposes of the DPDP Act, we act as the Data Fiduciary that determines the purpose and means of processing your personal data. You are the Data Principal.

Medical disclaimer: SymptomSense provides AI-generated health information for educational and triage purposes only. It is not a medical device and is not a substitute for professional medical diagnosis, advice, or treatment. Always consult a qualified doctor. In an emergency, call your local emergency number.

2. Personal Data We Collect & Why (Notice under Section 5)

We collect only the data needed to deliver the service you request. The table below itemises what we collect, why, and the lawful basis.

You may use the triage tool without providing your name, contact number or lab report - those are optional and only used to enrich or deliver your report.

3. Consent & Withdrawal (Section 6)

We process your personal data on the basis of your free, specific, informed and unambiguous consent, given by a clear affirmative action before you begin a triage session or upload a report. You may withdraw your consent at any time. Withdrawal is as easy as giving consent - use the Data Rights request page or email our Grievance Officer (Section 9). Withdrawing consent will stop further processing and, on request, lead to erasure of your data, though it does not affect processing already carried out.

4. Who We Share Data With (Data Processors & Transfers)

• AI processing providers - Google (Gemini API) and Anthropic (Claude API) process your symptom text and uploaded report content to generate analysis. These providers may process data on servers outside India; such cross-border transfer is permitted under Section 16 of the DPDP Act to countries not restricted by the Central Government. We request ephemeral processing and do not authorise use of your data to train their models where such control is available to us.
• Doctor & lab discovery - location (PIN code) is used to show relevant local providers.
• Payment gateway - Razorpay processes payments; card/UPI credentials are entered on the gateway, not on our servers.
• Communication providers - SMS/OTP and email providers deliver verification and report messages you request.

We do not sell your personal data or use it for third-party advertising.

5. How Long We Keep Data (Retention & Erasure, Section 8(7))

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. In summary: triage sessions and health data are retained for up to 24 months and then erased or anonymised; uploaded lab report files are deleted from our servers shortly after analysis; account data is kept while your account is active and erased on account closure or on an erasure request; and security logs are retained as required for lawful purposes. Full details are set out in our internal Data Retention Policy, a summary of which is available on request from our Grievance Officer. You can ask us to erase your data at any time (Section 6).

6. Your Rights as a Data Principal (Sections 11-14)

• Right to access (Section 11): obtain a summary of the personal data we hold about you and how it is processed.
• Right to correction & erasure (Section 12): have inaccurate data corrected or completed, and have data erased when no longer needed.
• Right to grievance redressal (Section 13): a readily available means to raise a grievance with us.
• Right to nominate (Section 14): nominate another individual to exercise your rights in the event of death or incapacity.
• Right to withdraw consent (Section 6(4)): as described in Section 3.

Exercise any of these rights via our Data Rights request page or by contacting the Grievance Officer below. We will respond within the timelines prescribed under the DPDP Act.

7. Children's Data (Section 9)

SymptomSense is intended for users aged 18 and above. We do not knowingly process the personal data of children (under 18) without verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child's data has been provided to us, contact our Grievance Officer for prompt erasure.

8. Data Security (Section 8(5))

We implement reasonable security safeguards to protect your data, including HTTPS/TLS encryption in transit, access controls on administrative functions, restriction of internal diagnostic tools, minimisation of data sent to third parties, and prompt deletion of uploaded files after processing. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under Section 8(6). No method of internet transmission is completely secure, but we work to protect your data using industry-accepted measures.

9. Grievance Officer & Contact

For any privacy question, to exercise your rights, or to raise a grievance, contact:

If your grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India as provided under the DPDP Act, 2023.

10. Cookies

We use strictly necessary cookies to maintain your session during a triage chat and for security. We do not use cookies for third-party advertising. You can disable cookies in your browser, but core functionality may be affected.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last Updated" date, and, where required, notified to you.