Privacy notice

This notice explains what personal data SynQ collects, why, and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP) and DPDP Rules 2025.

We collect only what we need for the purposes below.

• Mobile number, first name, preferred language, age confirmation — account, sign-in, telling the clinic who is coming.
• Symptoms you select — showing general information; sending to the clinic you choose.
• Documents you upload — filing them into your Timeline; sharing with clinics you choose.
• Booking details — managing your visit and history.
• Family profile details — booking for family members.
• Device info and app usage (no health data) — security and fixing problems.
• Cookies: only essential and preference cookies. No advertising cookies. No health data in URLs or analytics.

Each purpose has its own switch — nothing is pre-ticked. Required to book: sharing your details with the named clinic, and storing booking history. Optional: storing documents, recall reminders, using de-identified data to improve the service, marketing. You can withdraw any consent in one tap.

Only with: (a) the clinic you choose, after a consent screen naming it; (b) service providers under data processing agreements (cloud hosting, SMS, notifications); (c) authorities where legally required. We never sell data.

• Google Cloud (Mumbai, India) — hosting.
• SMS / push provider — notifications.
• Payment gateway — clinic subscriptions only.

• Encryption in transit and at rest.
• Role-based access checked on the server; clinics separated at database level.
• Audit log of every access, visible to you.
• OTP re-check before sensitive actions.

We keep data only as long as needed for the purpose or as law requires.

• Symptom entries (identifiable): 24 months, then de-identified.
• Abandoned check-ins with symptoms: 72 hours, then purged or de-identified.
• Booking records: 3 years.
• Your documents: until you delete them, or 3 years after last activity (with notice).
• Consent records: 7 years.
• Audit and access logs: at least 3 years.
• Notification logs: 12 months.

• Access, correct, download and erase your data.
• Withdraw consent — as easy as giving it.
• Nominate someone to act for you.
• Complain to the Grievance Officer, then to the Data Protection Board of India.

Profile → Your data → Delete my data. We confirm what is deleted now and what must legally be kept (and for how long).

Under-18s are managed by a parent or guardian with verifiable consent. No tracking or targeted ads for children.

If a breach affects you, we will inform you and the Data Protection Board as required (detailed report within 72 hours).

Built to HIPAA's safeguards (standard · not certified) · Built to ABDM's data standards (not yet integrated; SynQ cannot create or link an ABHA number today) · Built to SOC 2 criteria (readiness · not audited).

Versioned with a last updated date. Material changes require fresh consent.

Data questions: [name] · [privacy@domain]. Grievance Officer: [name], [designation] · [grievance@domain] · [+91 ______].