Privacy Policy

1. Who we are. BodyTwin is provided by KLYRA INNOVATIONS PRIVATE LIMITED, C-32, SOBHA IVORY, St Johns Road, NA, Bangalore, Bangalore- 560042, Karnataka, India ("we"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary. You are the Data Principal.

2. What we collect.

• Account: your email address, to sign you in with a link we email you (or a one-time code in that email, once our email sender supports it).
• Profile (optional): anatomy choice, body type, height, weight, other details you choose to enter.
• Health records you add: injuries, body-map locations, dates, notes, lab values, tags.
• Documents you upload: blood reports, scans, PDFs and images. For DICOM scan files, we do not read patient identity fields.
• Usage and security logs: actions on your account (an audit log), share-link access, AI usage counts, and technical data such as IP address and device type, created when you use the service.
• Your consent record: which Terms and Privacy Policy version you accepted, and when.

We do not ask for Aadhaar, financial account numbers or location.

3. Why we use it. To provide the service (your body map, timeline and vault); to sign you in and keep your account secure; to run AI features you choose to use; to let you share records with people you choose; to prevent abuse and keep the service running; and to meet legal obligations. We use your data only for these purposes. We do not sell your data and do not use it for advertising.

4. Consent. We process your data on the basis of your consent, given when you accept these terms. You can withdraw consent at any time by deleting your account. Withdrawal does not affect processing done before it. Some features cannot work without your data.

5. AI features. If you use AI placement of an injury or AI reading of a lab report, the text or document content needed for that feature is sent to our AI provider, Anthropic, through our secure server function. It is used only to return a result to you. [Provider data-handling terms, including whether content is used for model training: status to be verified.] AI processing may happen on servers outside India. [Location: status to be verified.] AI output can be wrong and is not medical advice. You can use BodyTwin without AI.

6. Sharing. A share link lets anyone who has the link view the records you chose, until it expires or you revoke it. We log access to each link and show you the log. We do not share your records with anyone else.

7. Who else handles your data. Supabase (database, sign-in, file storage), hosted in Mumbai, India (ap-south-1). Cloudflare (delivers the app to your device and handles web traffic). Anthropic (AI features, section 5). [Email delivery provider – status to be verified] (sends your sign-in emails). They act on our instructions. We share data with authorities only when the law requires it.

8. Where your data lives. On your device, app data stays in your browser or app storage. The PIN lock only locks the screen; it does not encrypt data stored on your device. If you sign in, your records sync to our database in India, and access is restricted by row-level security so other users cannot read your data. We use standard protections from our infrastructure providers. No system is perfectly secure. Use a PIN, keep your device updated and do not share your sign-in link or code.

9. Your rights. Under the DPDP Act you may: access a summary of your data and who it is shared with; correct your data (you can delete a record in the app and add a corrected one, or write to the Grievance Officer); erase your data (Profile → Delete account permanently deletes your account, records and uploaded files; [backup and log retention after deletion: status to be verified]); export your records as a ZIP with original files; nominate another person to exercise your rights if you die or become incapacitated, by writing to the Grievance Officer; and complain to our Grievance Officer first and, if unresolved, to the Data Protection Board of India.

10. How long we keep data. We keep your data until you delete your account. After that we delete it, except where the law requires us to keep limited records. [Exact periods: status to be verified.]

11. Children. BodyTwin is for people aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn we have, we will delete it.

12. Data breaches. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

13. Cookies and tracking. BodyTwin uses local storage and a service worker to work offline and remember your settings. We do not use advertising trackers. [Any analytics tool: status to be verified.]

14. Changes. If we change this policy, we will show the new version in the app and ask you to accept again when the change is material.

15. Contact and Grievance Officer. Name: [status to be verified]. Email: [status to be verified]. Address: [status to be verified]. We will acknowledge your complaint promptly and aim to resolve it within [timeframe – status to be verified].