Privacy Policy

1. Who we are (Data Fiduciary)

GDM Technoworld Pvt. Ltd., Sector 3, HUDA Sector, Fatehabad, Haryana, India. Contact: gdmtechnoworld@gmail.com.

Grievance Officer: Saurabh Mehta, gdmtechnoworld@gmail.com

2. What we collect

• Order & shipping details: name, phone, email, and shipping address when you buy a card
• Medical / emergency information you enter for your card (blood group, allergies, conditions, medications, emergency contacts, and related profile fields)
• Photo of the card holder
• Two ID proofs (Aadhaar: only last 4 digits stored; please upload a masked Aadhaar from myAadhaar so only last 4 digits are visible)
• Address and address proof
• Private insurance and/or government scheme details and card images
• Phone number and a PIN (stored only as a secure hash — we never store your PIN in plain text)
• Access logs when Full Details is viewed (time, mode, hospital/staff if emergency access)

2A. Payments (Razorpay)

Payments are processed securely by Razorpay. We do not store your card number, UPI PIN, or full payment instrument details on KavachSaathi servers. Razorpay may process payment data under its own privacy policy.

2B. Medical data security

Medical and emergency data is stored securely and shown only via the card's QR (public emergency view) and PIN-protected full profile. We never sell or share personal data for advertising. Your private fields stay protected by your PIN.

3. Why we collect it

So that anyone who scans your KavachSaathi card in an emergency can see life-saving medical information quickly, and so that hospital staff (with your PIN or logged emergency access) can use insurance / admission documents when needed.

4. Who can see what

• Public scan view: photo, name, emergency medical info, insurer name and/or government scheme name (not policy numbers or ID numbers).
• Full Details with your PIN: all profile and document fields needed for hospital admission.
• Hospital emergency access (patient unconscious): insurance / admission information only — not ID images, ID numbers, or address proof. Each use is logged.
• Admin: only when needed for support; revealing ID numbers requires confirmation and is logged.

Work details

You may optionally save work or employer information (organisation, city, designation, employer contact, and PIN-only fields such as employee ID, ESIC number, and company insurance). Each public-capable field has its own visibility toggle. Employee ID, ESIC, and company policy numbers never appear on the public emergency card. When you list an employer contact, you must confirm they have agreed to be listed. Organisation-linked pre-fill (when available) can be edited or hidden by you at any time.

5. Where data is stored

Google Firebase / Cloud Storage in the Mumbai region (asia-south1). Sensitive fields are encrypted at rest. Document files are private (no public bucket access; short-lived signed links only).

6. How long we keep data

While your card profile is active. After you delete documents/profile or request deletion, we remove associated personal data within 30 days (except where law requires a longer record, such as limited access logs).

7. Your rights (DPDP Act 2023)

You may access, correct, delete documents, withdraw consent, nominate another person, or raise a grievance via /my-profile or email gdmtechnoworld@gmail.com.

8. Children

A parent or guardian must create and manage the profile for anyone under 18.

9. Selling / ads / sharing

We do not sell your data. We do not use it for advertising. We share it only as described above, or when required by law.

10. Data deletion

You can request deletion of your personal data by emailing gdmtechnoworld@gmail.com (include your order number or Health ID; never send your PIN).

Also see our Terms of Use.