Privacy Policy

Introduction

Haemologix ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal and medical information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our blood donation platform and services, including our website and the Haemologix For Donors mobile app (together, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

How We Use Your Information

We use the collected information for the following purposes:

1. Service Provision: To connect hospitals with eligible blood donors, manage blood inventory, and facilitate emergency blood alerts
2. User Authentication: To verify your identity and manage your account through Clerk authentication services
3. Medical Matching: To match blood type compatibility and eligibility for donations
4. Geolocation Services: To find nearby donors and blood banks using location data
5. Notifications: To send SMS alerts via Twilio and email notifications for emergency blood requests
6. Analytics: To improve our Service, analyze usage patterns, and enhance user experience
7. Compliance: To comply with legal obligations, including the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable medical data protection laws
8. Security: To detect and prevent fraud, abuse, and unauthorized access

Data Sharing and Disclosure

DPDPA Compliance

Haemologix operates as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). You are the Data Principal in respect of your personal data. We implement:

• Lawful, consent-based processing: We process your personal data only for the specific purposes you consented to, and you may withdraw that consent at any time
• Purpose limitation and data minimisation: We collect only the data needed to match you with blood requests and confirm your eligibility to donate
• Reasonable security safeguards: Encryption, role-based access controls, audit logging and staff training to prevent personal data breaches
• Data Processor obligations: Third parties who process personal data on our behalf do so under contract and only on our instructions
• Erasure on request: We delete your personal data when you withdraw consent or request deletion, except where retention is required by law
• Breach notification: We notify affected Data Principals and the Data Protection Board of India of personal data breaches as required by the DPDP Act

If you are not satisfied with how we have handled your personal data, you may raise a grievance with us using the contact details below. If your grievance remains unresolved, you have the right to escalate it to the Data Protection Board of India.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data in transit (TLS/SSL) and at rest (AES encryption)
• Access Controls: Role-based access controls and authentication requirements
• Secure Storage: Data stored in secure, compliant cloud infrastructure
• Regular Audits: Security assessments and vulnerability testing
• Data Backup: Regular backups with disaster recovery procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Your Rights and Choices

You have the following rights regarding your personal information:

1. Access: Request access to your personal and medical information
2. Correction: Request correction of inaccurate or incomplete information
3. Deletion: Request deletion of your account and associated data at any time via our account deletion page
4. Portability: Request a copy of your data in a portable format
5. Opt-Out: Opt-out of non-essential communications and marketing
6. Account Settings: Update your profile information and preferences through your account dashboard

To exercise these rights, please contact us at the information provided below.

Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy, comply with legal obligations and medical record retention requirements, and resolve disputes and enforce our agreements. Medical records may be retained for extended periods as required by law or medical best practices.

When you request deletion of your account, we verify that the request came from the account owner and then permanently delete your personal, contact, health and eligibility information, your uploaded documents, your location data and your responses to blood requests. Verified requests are completed within 30 days.

We retain anonymised records of completed donations for medical traceability and hospital audit requirements. These records are stripped of all identifying information and cannot be linked back to you. We also retain records we are legally required to keep, for only as long as the law requires. Full details are on our account deletion page.

Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending email notifications for significant changes

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: