Privacy policy
What personal data HealthSathi collects, why, who processes it and your rights.
This policy explains how HealthSathi handles personal data. [Owner to confirm: the legal name and address of the business that is the data controller, and the privacy contact email.]
What we collect and why
- Newsletter: your email address, chosen language, the wording of the consent you gave and when you confirmed. Used only to send the newsletter you asked for. You can unsubscribe at any time from any newsletter email.
- Free resources: your email address, to deliver the resource after you confirm your subscription.
- Purchases: digital products are sold through Superprofile. When you buy, you enter your details and pay on Superprofile's checkout; Superprofile processes the payment, delivers the files and shares order details (such as your name, email and what you bought) with us so we can support you. HealthSathi never sees your card or UPI details.
- Contact form: your name, email and message, so we can reply. Please do not send health details or medical records.
- Security: to prevent abuse we keep short-lived rate-limit counters keyed to a one-way hash of your IP address, and security logs that do not contain passwords or payment data.
We do not ask for or store health information about you.
Cookies and similar technologies
Essential cookies remember your language and privacy choices. Analytics and advertising only run if you opt in. See the cookie policy.
Service providers
We use these processors to run the site:
- Vercel — website hosting, and (only with your consent) privacy-friendly analytics and performance measurement.
- Superprofile — checkout, payment processing and delivery of digital products. See Superprofile's own privacy policy.
- Resend — sending emails.
- Upstash — rate limiting (hashed identifiers only).
- Google AdSense — advertising, only if enabled and only with your consent.
- [Owner to confirm: database host (e.g. Neon) and file storage provider (e.g. Cloudflare R2), and their regions.]
Some providers process data outside your country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
How long we keep data
- Newsletter: while you are subscribed; after you unsubscribe we keep only your email and unsubscribed status so we do not add you again by mistake.
- Orders: as long as required for tax and accounting. [Owner to confirm: retention period required in your country.]
- Contact messages: 12 months.
- Security logs and rate-limit counters: up to 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent at any time. Contact us using the contact form. You can also complain to your local data-protection authority.