Privacy Policy
Last updated: 2026-04-18
Published by SaralCare Healthtech Pvt. Ltd., Bengaluru, India, the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023.
We operate under India’s Digital Personal Data Protection Act (DPDPA) 2023. The short version: we collect only what we need, we never sell anything, we log every access, you can always see what we hold on you, and you can delete it whenever you like.
1What we collect
(a) Your account: name, email, phone, date of birth. (b) Your parent's care data: vitals measured by the Sahayak, medications, doctor names, visit observations, home-safety notes. (c) Usage data: login times, which pages you open, which reports you read. (d) Messages: what you send us via WhatsApp, email, in-app chat, and what we send you.
2What we do NOT collect
We do NOT collect your financial account details beyond what Razorpay/Stripe require for a subscription. We do NOT track your location outside the app. We do NOT read your parent's non-SaralCare communications. We do NOT install any analytics that persist beyond your session.
3What we use it for
Exactly three things: (a) delivering the service you subscribed to, (b) improving the service in aggregate (never using your individual data to train AI models or sell insights), (c) meeting legal and regulatory obligations. That is the whole list.
4What we never do with it
We never sell personal data. Not to advertisers. Not to pharmaceutical companies. Not to insurance companies. Not anonymised-but-identifiable. Never. We never use your parent's health data for advertising or marketing. We never share data with any third party that is not essential for delivering your service (e.g., SendGrid for email, Razorpay for payments), and each such vendor has signed a data-processing agreement.
5Where it lives
All care data lives in India, in our database provider's Mumbai region. We do not replicate it outside India. Overseas family members (NRI) can use SaralCare from anywhere, but their parent's care data stays in India. Encrypted in transit (TLS 1.2+) and at rest. Passwords are stored only as salted hashes (bcrypt).
6Who can see it
(a) You, always, in full. (b) Your Sahayak and our ops team, for the care you subscribed to. (c) The doctor you ask us to consult on a specific question. (d) No one else. We log every access. You can see that log in Settings → My Data.
7Your rights under DPDPA
You have the right to: access everything we hold on you (instant, in-app), correct anything that is wrong (in-app or by emailing us), erase everything (one request, seven-day processing), withdraw any non-essential consent (Settings → Consent), grievance redressal (email ashwinsk@saralcare.com). We cannot make any of these rights harder than they need to be, and we won’t try.
8Children
SaralCare is not for people under 18. If you believe we are inadvertently holding data on a minor, email us immediately and we will delete it within 24 hours.
9Cookies & tracking
We use a small number of cookies for session authentication. We do not use third-party advertising cookies, ever. We do use a single analytics tool (PostHog) self-hosted in our Bangalore environment to understand which features are used, never to track you across sites.
10Data breaches
If there is a data breach, we will notify affected users within 72 hours of detection (DPDPA standard). We publish breach incidents on our annual transparency report. We carry cyber-liability insurance.
11Grievance officer
Ashwin Kulkarni (founder, acting DPO) · ashwinsk@saralcare.com · +91 98450 65330 · 15-day response SLA under DPDPA. We acknowledge receipt within 48 hours.
Question about any of this? Message Ashwin directly on +91 98450 65330 or email ashwinsk@saralcare.com. We acknowledge within 48 hours.