Privacy Policy

This Privacy Policy applies to all users of the Swaniyam mobile app and related services. Swaniyam helps users manage medicine schedules, log symptom and intake records, and view insights from their own entries.

We are committed to handling your data responsibly, transparently, and in line with applicable law, including:

• Information Technology Act, 2000 and applicable Rules
• Digital Personal Data Protection Act, 2023 (DPDP Act), as applicable

For users in other regions, we also honour applicable local privacy requirements where relevant.

For the purposes of this policy, the following terms are defined as:

• Personal Data
  Any data about an identifiable individual.
• Sensitive Personal Data
  Health-related and wellness-related data you submit in the app.
• Processing
  Collection, storage, use, disclosure, deletion, or other handling of data.
• Data Fiduciary
  The entity determining the purpose and means of processing (us).
• Data Principal
  The individual to whom personal data relates (you).
• Consent
  A free, specific, informed, and unambiguous indication of your agreement.
• Third Party
  Any person or entity other than you and us, including service providers.

A. Information You Provide Directly

• Name, email address, gender, date of birth, weight, height, blood group
• Account credentials and login verification inputs (email/password, OTP)
• Medicine entries, medicine schedules, planned and unplanned medicine logs
• Symptom entries and severity information
• Profile photo selection (if you choose to add one)

B. Information Collected Automatically

• Authentication and session information required to keep you signed in
• Standard technical metadata processed by backend and auth providers (e.g. timestamps, server logs, IP metadata)
• Device and app context such as OS version and app behaviour during normal operation

C. Health & Sensitive Data

Swaniyam may process sensitive wellness and health-adjacent data such as:

• Symptom logs and severity records
• Medicine schedules and intake logs (planned and unplanned)
• Weight, height, blood group, and related profile details

Legal basis: Explicit consent and service delivery necessity for the features you request.

D. Data from Third-Party Integrations

Based on current integrations, Swaniyam connects with:

Swaniyam currently does not include HealthKit or Google Fit integrations. If added in future, this policy will be updated before that release.

We process personal data under one or more of the following legal bases:

• Consent
  Profile and health-related entries, optional features, and sensitive data handling
• Contractual necessity
  Account creation, login, syncing your entries, and core app functions
• Legal obligation
  Compliance with applicable legal and regulatory requirements
• Legitimate interest
  App security, fraud prevention, service reliability, and limited operational analytics

We use your data to:

• Provide and personalise core app functionality
• Maintain medicine tracking, symptom logging, and user insights
• Support login, account management, and security
• Improve product quality and reliability
• Respond to support requests and legal requests

• We obtain consent through in-app actions and consent language shown at onboarding and at relevant feature entry points
• You can withdraw consent at any time by contacting us or deleting your account
• If consent is withdrawn, we may stop providing affected features and initiate deletion or anonymisation as legally permitted
• Sensitive and health data processing is handled with separate prominence and a clear statement of purpose

We may share data with:

• Supabase
  Backend infrastructure (authentication and database)
• Google / Apple
  Social sign-in only when you choose those methods
• DailyMed (NLM)
  Medicine search requests you actively initiate
• Legal authorities
  When required by valid and lawful legal process
• Business transfer
  Merger or acquisition with notice where legally required

Where we use aggregated or anonymised data, it is used in non-identifiable form only and cannot be traced back to any individual.

Current services and SDKs integrated in the app:

The current app includes no integrated ad SDK, no ATT tracking flow, and no dedicated analytics or crash reporting SDK. Each third-party service operates under its own privacy policy as linked above.

If HealthKit integration is added in a future release, this policy will be updated prior to release and will include all required Apple disclosures, specifically that:

• HealthKit data will not be used for advertising or marketing purposes
• HealthKit data will not be shared with third parties without explicit user permission
• HealthKit data will not be sold under any circumstances

• Data is stored using cloud infrastructure provided by our backend stack (currently Supabase) and on-device app storage for session continuity
• We use encryption in transit (HTTPS/TLS) and apply access controls appropriate to service operations
• We apply authentication controls and backend security measures and review our practices periodically
• If processing occurs across borders, we apply reasonable contractual and organisational safeguards as required by applicable law

We retain data only as long as necessary for service delivery and legal purposes:

• Account data
  Retained while active, plus up to 90 days after closure, unless a legal retention obligation applies
• Health and wellness logs
  Retained while active; deleted within 30 days of a valid deletion request unless a legal hold applies
• Technical logs
  Retained for up to 12 months for security and troubleshooting
• Backup data
  Rolling backups purged within 30–90 days

You can request deletion of your account and data by:

• Using the in-app account deletion flow (if enabled), or
• Emailing from your registered account email address

Timeline: We will acknowledge your request within 48 hours and complete deletion within 30 days, subject to legal exceptions.

We may retain minimal data where required by law, security, or dispute resolution. Otherwise, your profile and all health and wellness records are permanently deleted from active systems.

Subject to applicable law, you may exercise the following rights:

To exercise any right, contact . We may verify your identity before processing. Response target: within 30 days.

Swaniyam is intended for users aged 18 and above by default unless a separate child-compliant flow is implemented.

• We do not knowingly collect personal data from individuals under 18 without verifiable parental or guardian consent
• If minors are permitted in future, verifiable parental consent and additional protections will be implemented before processing any child data — in compliance with the DPDP Act, 2023
• We do not conduct behavioural tracking or profiling of minors under any circumstances
• Parents or guardians may contact to request deletion of a child's data

We maintain incident response processes to identify, contain, and remediate security incidents.

• If a confirmed breach materially affects your personal data, we will notify affected users and relevant authorities as required by applicable law
• This includes applicable CERT-In obligations under Indian law where relevant
• For high-risk confirmed incidents, our target notification objective is within 72 hours where legally required and feasible
• Notifications will describe what data was affected, what occurred, and what steps are being taken

The Swaniyam native iOS app does not rely on browser cookies in the native app context.

If we launch web-based components in the future, we may use essential and analytics cookies and will provide appropriate cookie controls and an updated cookie policy at that time.

• The "Last Updated" date and version number at the top of this page will always reflect the current version
• Material changes will be communicated via in-app notice, email, or other suitable channels before they take effect
• Continued use of the app after the effective date constitutes acceptance of the revised policy where permitted by law

As required under the Information Technology Act, 2000 (Rule 5(9)) and the DPDP Act, 2023, we have appointed a Grievance Officer:

Service levels:

• Complaint acknowledgement within 48 hours of receipt
• Resolution within 30 days, subject to complexity and applicable law

For all privacy-related queries, data requests, or concerns: