Privacy Policy

TinyHealers Kidscare Private Limited · Version 1.1 · Effective 29 October 2026

Final review by our legal counsel is in progress. This text describes how TinyHealers works today.

This policy explains what personal data TinyHealers collects, why, who can see it, and the choices and rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as their provisions come into force, and — until then and alongside them — the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Health records are "sensitive personal data" under the SPDI Rules, and we treat them with the care that requires.

By tapping "I agree" in the app you give the consent described in section 6. You can withdraw it at any time (section 10).

In short

1. Who we are

TinyHealers is operated by TinyHealers Kidscare Private Limited (CIN U86201KA2025PTC202791), 10/539/469, Mehta Mansion, 5th Cross, Gandhinagar, Yelahanka, Bengaluru, Karnataka 560064, India ("TinyHealers", "we", "us"). We decide why and how your personal data is used, so we are the Data Fiduciary under the DPDP Act.

The TinyHealers apps are published on the Apple App Store and Google Play by our technology and publishing partner Potebaki Limited. Potebaki Limited handles any personal data only on our written instructions, as our service provider (Data Processor), and may not use it for any purpose of its own.

If you link your child to a clinic or doctor, that clinic is responsible for the medical records it creates while caring for your child, under the laws that apply to clinics and doctors.

2. Who TinyHealers is for

TinyHealers is for parents and legal guardians aged 18 or older, living in India, to keep their children's health records. It is not meant to be used by children themselves. A child's personal data is processed only with the consent of their parent or lawful guardian.

3. What we collect

• Account: your mobile number (to log you in with a one-time code) and, if you add it, your name. If you choose "Try it first — no login", we create an account without a mobile number until you save it.
• Your child's details: name, date of birth, sex, allergies, parents' heights, and the clinic you link (if any).
• Health records you or your clinic add: vaccines given and due, growth measurements, medicines and prescriptions (including photos), daily care logs (feeds, sleep, nappies, temperature, medicine doses), development milestones, family health history, newborn screening results, and notes and questions you send to your clinic.
• Memories: titles, notes and photos you add to the memory book.
• Insurance details (optional): if you choose to note them, your family's health-insurance or Ayushman card details — the type of cover, insurer or scheme, policy or card number, helpline, cover amount, renewal date and which children are covered. Only you can see them (not family members you add, and not clinics); we use them only to show them back to you and to remind you before renewal, and they are deleted with your account.
• Family members you add: their name or relation (for example "Dadi") and mobile number, so they can log in and follow your child's record.
• ABHA (optional): if you ask us to create or link your child's Ayushman Bharat Health Account, the ABHA number, ABHA address and ABHA card. We never store Aadhaar numbers or one-time codes — they pass, encrypted, directly to the National Health Authority's systems (see section 8).
• Reminders (optional): if you turn on reminders on the website, a technical address for your browser so we can send them. In the phone apps, reminders are scheduled on your phone itself.
• Security logs: when your device talks to our servers we record a minimal security log — IP address, date and time, the page or function used (not its contents) and the device or browser type — to keep the service secure, investigate misuse and meet our legal duties. These logs are kept for 180 days, as required by CERT-In's directions under the Information Technology Act, 2000, and then deleted automatically.
• Voice answers (optional): if you use TinyHealers Vaidya, our automated voice helper (not a doctor), your phone's or browser's own speech service (for example Google or Apple) turns your voice into text on its side. We never receive or keep a voice recording — only the answers you check and save.

We do not collect your location, contacts, call logs or advertising identifiers, and we do not use advertising or third-party analytics tools in the app.

4. Information kept on your phone

To let you see your child's record without internet, the app keeps a copy of the records you last opened on your own phone. Your login and settings (such as language) are also kept on the phone. This copy is removed when you log out. Anyone who can unlock your phone may be able to see it, so please keep your phone locked.

5. Why we use it

We use personal data only to run TinyHealers for your family:

• showing your child's vaccine schedule, growth charts, milestones and records;
• sending the reminders you ask for (for example vaccines and birthdays);
• sharing records with the family members, clinics and doctors you choose, and receiving records your clinic adds;
• creating or linking an ABHA when you ask us to;
• logging you in, keeping your account secure, preventing misuse, and fixing problems;
• answering your questions and complaints;
• meeting our obligations under law.

We do not sell personal data; use it for advertising or marketing by others; track, profile or monitor the behaviour of children; show targeted advertising; or use your family's records to train artificial-intelligence models or share them with AI companies. Prescription photos are read on our servers in India, not sent to outside AI services.

If we ever want to use personal data for a new purpose, we will tell you first and, where the law requires, ask for your consent.

6. Your consent

We process your and your child's personal data on the basis of your consent as the parent or lawful guardian, given in writing in the app (Rule 5 of the SPDI Rules; sections 6 and 9 of the DPDP Act). When you start using TinyHealers you confirm that you are 18 or older and the parent or lawful guardian of each child you add, and we keep a record of that consent.

Some processing is allowed by law without consent, for example to comply with a law or court order, or to respond to a medical emergency (section 7 of the DPDP Act).

7. Who can see your data

• You and any other parent or guardian you add — full access.
• Family members you add (for example Dadi or Nani) — they can view the record and help log daily care, but cannot share it further or change who can see it.
• Your clinic and doctors you approve — they see the records of the children you link to them and can add records (for example vaccines given). You can stop sharing in Family & sharing.
• Service providers who help us run TinyHealers, only as needed and under contract that requires them to protect the data:

When you tap Share (for example a birthday card or a vaccination record) your phone sends it to the app you pick, such as WhatsApp. What happens next is governed by that app's policy.

We may disclose personal data if required by law, a court order or a lawful request from a government authority, and only to the extent required. If TinyHealers is merged or acquired, your data will move only under the same protections, and we will tell you before that happens.

8. ABHA and Aadhaar

Creating or linking an ABHA is voluntary — TinyHealers works fully without it. If you choose it, we show the National Health Authority's consent text and you enter the Aadhaar number and one-time code yourself. They are encrypted on our server with the National Health Authority's public key and sent straight to its systems. We do not store or log Aadhaar numbers or one-time codes.

You can unlink the ABHA from TinyHealers at any time. Unlinking does not delete the ABHA itself; you can manage or delete it through the National Health Authority's ABHA services.

9. Where and how we keep it

Your data is stored on servers in Bengaluru, India. All connections between the app and our servers are encrypted (HTTPS). Access is restricted to people who need it to run the service, and photos can be opened only by people with access to the child's record. We take nightly backups, which are kept privately for 14 days.

We follow reasonable security practices as required by section 43A of the Information Technology Act, 2000 and the SPDI Rules (and, once in force, section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules). Our server clocks are synchronised with the Government of India's time servers.

If a personal data breach or cyber security incident happens, we will report it to CERT-In within the time its directions require, and inform affected users and the Data Protection Board of India as the law requires, with what happened, the likely impact and what we are doing about it.

10. How long we keep it, and deleting it

• We keep your data while your account is active, so your child's record is there when you need it — often for years.
• Delete my account (in the app's menu) permanently erases your account and the records of every child only you can see, including photos, from our live systems straight away. Backups that contain them expire within 14 days.
• If another parent also has access to a child, that child's record stays for them; only your access is removed.
• If a child is linked to a clinic, the clinic keeps the medical records it is required by law to keep; your access is removed.
• Where a law requires us to keep certain data or security logs for a fixed time (for example under the DPDP Rules, 2025), we keep only that, securely and only for that purpose, and then delete it.
• Withdrawing consent: you can withdraw your consent at any time as easily as you gave it — by deleting your account, removing a child, unlinking ABHA or stopping sharing, or by writing to us (section 14). Processing done before withdrawal remains lawful. Withdrawing means we can no longer keep the record for you.

11. Your rights

Under the DPDP Act you have the right to:

• access a summary of your personal data and how it is used, and the list of those we have shared it with;
• correct, complete or update it — most of it you can edit in the app yourself;
• erase it (see section 10);
• nominate another person to exercise these rights if you die or become unable to;
• have your grievance answered by our Grievance Officer (section 14), and then, if you are not satisfied, complain to the Data Protection Board of India.

Write to contact@tinyhealers.com from, or mentioning, the mobile number on your account. We may verify that the request is really from you. We respond as quickly as we can, and in any case within 30 days (or any shorter time the law sets).

12. When your child turns 18

A child's record is held on the child's behalf. When your child turns 18 they may ask us to give them control of their record, or to delete it.

13. Family members you add

When you add a family member's mobile number you confirm that they have agreed to be added. They can ask us at any time to remove their number, and you can remove them yourself in Family & sharing.

14. Grievance Officer and contact

Grievance Officer: Payal M Jain (Director), TinyHealers Kidscare Private Limited, 10/539/469, Mehta Mansion, 5th Cross, Gandhinagar, Yelahanka, Bengaluru, Karnataka 560064, India. Email: contact@tinyhealers.com · Phone: +91 78299 91118 (Monday–Saturday, 10 am–6 pm).

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

15. Changes to this policy

If we change this policy we will update the date at the top and tell you in the app. If a change affects how we use your or your child's data in a significant way, we will ask for your consent again before it applies.