Privacy Policy

Who we are

MitraSync (“MitraSync”, “we”, “us”) is operated by Bharat Together. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we act as the Data Fiduciary for the personal data you provide. In v1, the founder also serves as the contact point for data-protection matters (see Grievance Redressal).

What MitraSync is

MitraSync is a free tool that helps families organise medical records and produce a doctor-ready summary and an emergency card. It is not a medical device, does not provide medical advice, and does not interpret your health data. See the separate Medical Disclaimer.

What data we process

• Account data: your email address (used for one-time-passcode sign-in; we store no passwords).
• Profile data: names, relationship, month/year of birth, and optional blood group for each person you add.
• Health records you enter or upload: medications, lab values you transcribe, doctor-visit notes, vaccinations, and documents/photos you upload.
• Delegation data: who you have invited to view or manage an account, and at what access level.
• Operational/technical data: sign-in events and a security audit log (who accessed which record, when, from which device, at what access level), kept to protect your account and to handle grievances.
• Aggregate usage measurement: cookieless, privacy-preserving website analytics (via Cloudflare Web Analytics) and internal aggregate counts (e.g. number of summaries generated). These contain no health content and do not identify you individually.

What we do NOT do

• We do not sell your data.
• We do not show advertising and do not allow advertisers to target you.
• We do not use third-party advertising or behavioural-tracking cookies or trackers.
• We do not interpret, diagnose, score, or predict from your health data.

Why we process it (legal basis)

We process your data on the basis of your consent, which you give at sign-up and (separately) each time you share access with another person, and to provide the service you have asked for. Health records are processed only to display them back to you and to generate the artifacts you choose to create.

Where it is stored

Record metadata is stored in a database hosted in Mumbai, India (ap-south-1). Uploaded documents are stored as private objects in Cloudflare R2, accessible only through short-lived signed links and addressed via the Mumbai-resident metadata. All data is encrypted in transit (TLS) and at rest. Sign-in emails are sent through an email relay and contain only the one-time code; they do not store your health information.

Who can see your data

• Only you, and the people you explicitly grant access to, can see an account's records, subject to the access level you set (Uploader-only, Caregiver, or Full).
• We, as the operator, do not read your health records as part of running the service; our usage measurement is limited to aggregate counts that carry no health content.

How long we keep it

We keep your data while your account is active. When you delete a record or your account, we remove it (see Right to Erasure). A backup copy may persist for up to 30 days before it is automatically expired. The security audit log is retained for as long as required for grievance handling (currently up to 1 year).

Your rights (DPDP)

• Access your data and get a copy (we provide a full export as a structured file).
• Correct operational data you entered.
• Erase any record or your entire account.
• Withdraw consent at any time — withdrawal is as easy as giving consent, and stops further processing of the affected data.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance and, if unresolved, approach the Data Protection Board of India.

Children's data

See the separate Children's Data & Parental Consent document. In short: profiles for anyone under 18 may be created and managed only by a consenting parent or legal guardian; minors cannot register their own account; and we do not track or target children.

Changes

If we change this policy, we will update the version and effective date and, for material changes, ask for your consent again.

Contact

help@mitrasync.com