Privacy Policy

1. Data we collect

• Account information you provide: name, phone number.
• Health documents you upload directly: prescriptions, lab reports, scans, discharge summaries, vaccination records, and insurance documents.
• Profile details you choose to add: age, gender, blood group, known conditions, allergies, emergency contact information, and family members you add to your vault.
• Questions you ask Biosy AI, to generate an answer grounded in your own documents where relevant (or general medical knowledge when it isn't — see Section 2).
• A device push notification token, used to deliver reminders and alerts.

2. How we use your data

We use your data to build and display your personal health vault, to power the Biosy AI assistant (which answers using your own uploaded documents when relevant, and general medical knowledge when no relevant document is found — always for your information only, never a diagnosis), to generate your Emergency Health Card, to send medication and vaccination reminders, and to operate core account and security functions. We do not sell identified personal health data, and we do not share data with insurers or any other third party for their own purposes — see Section 4.

3. Where your data is stored

All data is stored on AWS infrastructure in the Mumbai (ap-south-1) region. We use a small number of specialist service providers to operate specific features, each bound by contractual data protection obligations and none permitted to use your documents to train their own models:

• Hosting & storage — AWS (Mumbai, ap-south-1).
• Document processing — AWS Bedrock and Anthropic's Claude extract and classify text from your uploaded documents.
• AI search & the Biosy AI assistant — OpenAI generates embeddings for document search, stored in a private vector index (Pinecone).
• Sign-in & notifications — Firebase (Google) handles authentication and push notifications.
• Document integrity — every document is SHA-256 hashed and the hash is anchored on the public Polygon blockchain; only this tamper-evident hash is recorded on-chain, never the medical data itself.

4. Data we do not access or share

Biosy does not integrate with the Ayushman Bharat Digital Mission (ABDM) today, does not access ABDM, does not request or store any ABHA ID or ABHA-linked data, and does not share your data with insurers or any third party for their own purposes. If this changes in the future, this policy will be updated and you will be asked for explicit consent before any such data collection or sharing begins — nothing described here happens automatically or retroactively.

5. Your rights

In line with the Digital Personal Data Protection Act, 2023, you have the right to access, correct, and request deletion of your personal data held by Biosy, and to withdraw consent for any optional data use at any time. Requesting account deletion locks your account immediately, and all personal data is permanently deleted within 30 days. See our Delete Your Data page for exactly how to do this, in-app or by email. To exercise any other rights, contact us using the details below.

6. Security

We use encryption in transit and at rest, access controls, and blockchain-based document verification to protect your data. No system is completely immune to risk, and we continue to invest in security as Biosy moves toward public launch.

7. Changes to this policy

We may update this policy as Biosy develops, particularly around formal incorporation and public launch. Material changes will be reflected on this page with an updated date.

8. Contact us

For privacy questions, data access or deletion requests, contact us at hello@biosy.in.