Privacy Policy & Data Protection

1. Introduction & Scope

This Privacy Policy describes how Cannulix Healthcare Technologies ("Cannulix", "we") collects, processes, and protects your "Digital Personal Data". This policy applies to all users accessing our platform within India.

By using our services, you acknowledge that we act as a Data Fiduciary determining the purpose of processing your data.

2. Data We Collect

We collect data only necessary for fulfilling healthcare services:

• Personal Data: Name, Mobile Number, Email Address, and Physical Address (for home visits).
• Sensitive Personal Data (Health): Medical history, current symptoms, prescriptions uploaded via WhatsApp, and age/gender for accurate diagnosis.
• Technical Data: IP Address, device type, and location data (if granted) to match you with nearby providers in Hanumangarh.

3. Purpose & Lawful Basis

We process your data under the following lawful grounds defined in the DPDP Act:

3.1 Consent-Based: To create your booking, send OTPs, and connect you with a Service Provider (Nurse/Lab). You provide explicit consent for this.

3.2 Legitimate Uses (Section 7): In case of a medical emergency involving you, we may share your data with hospitals or authorities without prior consent to protect your life or health.

3.3 Improvement: Anonymized data is used to analyze service demand in Hanumangarh and improve platform performance.

4. Consent Management

Your consent is the foundation of our data processing.

• Free & Informed: We ask for permission via a clear notice (e.g., pop-up or checkbox) before collecting data.
• Right to Withdraw: You may withdraw your consent at any time by emailing our Grievance Officer. Withdrawal will stop future processing but does not invalidate past actions (e.g., completed bookings).
• Impact: Withdrawing consent for essential data (like phone number) may lead to cancellation of pending services.

5. Data Sharing & Disclosure

We do not sell your data. We share it only for service facilitation:

5.1 Service Providers: Your name, address, and condition are shared with the assigned Nurse or Lab Technician solely for the purpose of the home visit.

5.2 Third Parties: We may use trusted partners for SMS delivery, cloud hosting (e.g., Firebase), or analytics. They are contractually bound to protect your data.

5.3 Legal Obligation: We may disclose data to law enforcement agencies if required by Indian law or court order.

6. Data Principal Rights

As a Data Principal, you have the following rights under the DPDP Act:

• Right to Access: You can request a summary of your personal data being processed by us.
• Right to Correction: You can ask us to correct inaccurate or misleading personal data.
• Right to Erasure: You can request the deletion of your data once the purpose (service) is fulfilled, unless retention is required by law.
• Right to Grievance Redressal: You can approach our Data Protection Officer (DPO) for any complaints.

7. Security & Data Retention

Security: We implement reasonable security safeguards (encryption, access controls) to prevent unauthorized access or data breaches. In case of a breach, we will notify you and the Data Protection Board within 72 hours.

Retention: We retain your personal data only as long as necessary. Transactional health records may be retained for up to 5 years as per medical laws, after which they are securely deleted or anonymized.

8. Cookies & Tracking

We use cookies to maintain your session and analyze traffic. We do NOT use cookies to track your health status across other websites. You can manage cookie preferences in your browser settings.

9. Children's Privacy

Cannulix does not knowingly collect data from children under 18 without verifiable parental consent. If a parent books a service for a child, they act as the lawful guardian consenting to the data processing.

10. Grievance Officer

For any privacy-concerns, consent withdrawal, or exercising your rights, please contact our appointed Data Protection Officer: