Aroviya Health
Legal

Privacy Policy

Draft — pending legal counsel review before real health-data launch. This page reflects the current public preview only and is not a compliance certification (e.g. HIPAA, GDPR, DPDPA) for any jurisdiction.

1. Who this policy covers

This policy is issued by [Operator legal entity — to be confirmed] and covers the public preview of Aroviya Health available at this domain. It does not cover third-party sites we link to.

2. What we collect today

During the public preview we collect:

  • Account and profile data: full name, email address, and a hashed password.
  • Basic product usage data needed to operate the service (e.g. sign-in activity).
  • Cookies and analytics strictly necessary to run the site (e.g. session/auth cookies). We do not currently run third-party advertising trackers on the public marketing pages.

3. What we do not collect during preview

The public preview does not accept real personal health information (PHI). Health-record upload, storage, OCR, and AI-explanation features are disabled until the relevant regional compliance approvals are complete. Please do not submit real medical records or other health data through this preview.

4. Service providers we use

  • Supabase — authentication and account data storage.
  • Resend — transactional email (e.g. verification codes, account notices).

These providers process data on our behalf under their own security and data-handling terms. We do not sell your data to these or any other providers.

5. Health data is never sold or used for advertising

When health-data features are enabled after compliance approval, health data will never be sold, and will never be used for advertising or marketing purposes. This commitment applies regardless of the feature's launch status.

6. Your data rights

You can request a copy of your account data, ask us to correct it, or ask us to delete your account by contacting [Privacy contact email — to be confirmed]. We aim to acknowledge requests promptly; some steps may currently require manual review while the public preview's tooling is being built out.

7. Compliance roadmap

Privacy and compliance requirements (including any applicable health-data regulations) are validated per launch region before real health data is accepted there. No region is presumed compliant by default.

8. Contact

Questions about this policy or your data can be sent to [Privacy contact email — to be confirmed]. See also our Terms of Service.