Privacy Notice

Welleni ("we", "us", "Welleni") operates a platform connecting patients and hospitals in Hyderabad for appointment booking, health records, and emergency response. This notice explains what personal data we collect through the Welleni website and app, why, how long we keep it, who we share it with, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This notice is given to you as a Data Principal before or at the time we collect your personal data, in line with Section 5 of the DPDP Act.

1. Who we are (Data Fiduciary)

[LEGAL REVIEW: insert registered business name, entity type (e.g. proprietorship/Pvt Ltd), registered address, and CIN/registration number if incorporated.] For the purposes of the DPDP Act, Welleni is the Data Fiduciary determining how and why your personal data is processed on this platform.

2. What personal data we collect

[LEGAL REVIEW: confirm this table matches the live production schema — it was built from a code-level audit, not a data-mapping exercise with the Supabase project owner.]

3. Why we process your data (purpose limitation)

• To create and manage your patient or hospital account and verify your identity (mobile/email OTP)
• To let you book, manage and receive reminders for appointments
• To maintain your health records and make them available to you and, where you direct us to, to a treating hospital
• To operate the Emergency SOS feature — sharing your location and Medical ID with the nearest hospital/responder to save time in an emergency
• To process payments for consultations (via Razorpay)
• To respond to demo requests and enquiries from hospitals
• Where you've separately opted in: to send appointment reminders, health tips and offers by WhatsApp, SMS or email
• To keep the platform secure and prevent fraud or misuse

We do not use your health data for advertising, and we do not sell personal data to third parties.

4. Legal basis / consent

Under the DPDP Act, we process most of your data on the basis of your consent, given when you register, tick the consent checkbox, or otherwise provide data to us. Some processing (for example, sharing your Medical ID with a hospital during a genuine SOS emergency, or complying with a legal/regulatory request) may rely on the "legitimate uses" permitted under Section 7 of the DPDP Act rather than consent, where applicable. [LEGAL REVIEW: confirm which Section 7 ground(s) apply to SOS processing and document this properly, e.g. for a "medical emergency" ground.]

5. Who we share data with (third parties)

[LEGAL REVIEW: for each vendor above, confirm a data processing agreement / terms with appropriate DPDP-aligned clauses is in place, especially for Supabase and Fast2SMS. Also confirm whether any vendor stores data outside India and whether that triggers any cross-border transfer restriction under Section 16 of the DPDP Act — as of this draft the Act permits transfers except to countries the Government restricts by notification, but this should be re-checked at review time.]

6. Data retention

[LEGAL REVIEW / PRODUCT DECISION NEEDED: no retention schedule currently exists in the product. Draft position below — must be confirmed against actual medical record-keeping norms (e.g. any applicable clinical establishment / medical council retention rules) and finalised by the founder + counsel.]

• Account data: retained for as long as your account is active, and for a reasonable period after you close it or request erasure, only where we have a legal reason to keep it (e.g. unresolved payment disputes, legal claims, or a statutory retention requirement).
• Health records you upload: retained until you delete them or request erasure, subject to any minimum retention required by applicable healthcare recordkeeping rules.
• OTP codes: discarded immediately after verification or expiry (5 minutes).
• "Request a demo" enquiries: retained for up to 12 months from the enquiry date, unless you become a customer.
• Consent records and data-rights request logs: retained for as long as needed to demonstrate compliance, even after account closure.

7. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access — get a summary of the personal data we hold about you and how it's being processed
• Correction — ask us to correct inaccurate or incomplete personal data
• Erasure — ask us to delete your personal data, unless we need to keep it for a legal reason
• Withdraw consent — withdraw any consent you've given (e.g. for marketing messages) as easily as you gave it, without affecting processing that already happened lawfully before withdrawal
• Grievance redressal — raise a complaint with us, and if unsatisfied, with the Data Protection Board of India
• Nominate — nominate another individual to exercise your rights on your behalf in the event of death or incapacity

You can exercise these rights using our Data Rights Request form. We aim to respond within a reasonable time; [LEGAL REVIEW: set and publish a specific SLA, e.g. 30 days, consistent with counsel's advice and any timeline prescribed under the DPDP Rules.]

8. Grievance Officer

9. Children's data

Welleni is not directed at children. Where a parent/guardian manages a minor's health record on their behalf, that parent/guardian's verifiable consent is required. [LEGAL REVIEW: the product does not currently have a dedicated guardian-consent flow for minor patients — this is an open item, flagged in DPDP_PROGRESS.md.]

10. Security

We use measures such as password hashing, role-based access, and transport encryption (HTTPS) to protect your data. No system is 100% secure; see our Terms of Service for more. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India in line with the DPDP Rules — see our internal breach response process.

11. Changes to this notice

We'll update the "Last updated" date above if this notice changes materially, and where required, seek fresh consent.

Terms of Service

1. Acceptance of terms

By creating an account or using Welleni, you agree to these Terms and our Privacy Notice. [LEGAL REVIEW: expand with standard eligibility, account, and acceptable-use clauses appropriate for a health-tech marketplace.]

2. The service

Welleni connects patients and hospitals for appointment booking, health record storage, and emergency response coordination. [LEGAL REVIEW: add a clear medical disclaimer — Welleni is a booking/records platform, not a medical provider, and SOS is not a substitute for calling emergency services directly.]

3. Data protection clause

This clause supplements our Privacy Notice and sets out our data-protection commitments as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Lawful processing. We will process your personal data only for the purposes disclosed to you at collection, on the basis of your consent or another lawful ground recognised under the DPDP Act, and consistent with our Privacy Notice.
2. Data minimisation. We collect only the personal data reasonably necessary for the purpose it's collected for.
3. Security safeguards. We will implement reasonable technical and organisational measures — including encryption in transit, access controls, and password hashing — to protect your personal data against unauthorised access, loss, or breach, as required under Section 8(5) of the DPDP Act. [LEGAL REVIEW: security gaps identified during this audit are logged in DPDP_PROGRESS.md and must be remediated before this clause is safely relied upon.]
4. Breach notification. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India without undue delay, in the manner prescribed under the DPDP Rules, 2025. Our internal process is documented in BREACH_RUNBOOK.md.
5. Your rights. You may exercise your rights to access, correct, erase your data, or withdraw consent at any time via our Data Rights Request form, free of charge, subject to the limited exceptions set out in the DPDP Act.
6. Retention. We retain personal data only for as long as necessary for the purposes described in our Privacy Notice, or as required by law.
7. Third parties. We share personal data with third-party processors (e.g. Supabase, Razorpay, our SMS provider) strictly to operate the service, as described in our Privacy Notice, and we take reasonable steps to ensure they protect your data appropriately.
8. Grievance redressal. Complaints about how your personal data is handled can be raised with our Grievance Officer (contact details in the Privacy Notice and in the site footer) and, if unresolved, with the Data Protection Board of India.

4. Payments

Payments are processed by Razorpay. Welleni does not store your card or UPI credentials. [LEGAL REVIEW: add refund/cancellation policy.]

5. Limitation of liability

[LEGAL REVIEW: standard liability-limitation language required — not drafted here as it needs counsel's judgment given this is a health platform.]

6. Governing law

[LEGAL REVIEW: confirm governing law/jurisdiction clause — typically the courts of the city where the company is registered, e.g. Hyderabad/Telangana.]