{{LIKE THIS}} must be completed before publication.
Privacy Policy
Effective date: {{EFFECTIVE_DATE}} · Version: {{POLICY_VERSION}} · Last updated: 10 June 2026 (draft)
Sugar Sakhi (“we”, “us”, “our”) is a physician-led, AI-assisted continuity-of-care platform for children living with Type 1 Diabetes (T1D), built by Wadia Warriors and piloted at B.J. Wadia Hospital for Children, Mumbai. This Privacy Policy explains what personal data we collect through the Sugar Sakhi web app (sugarsakhi.com/app) and this website, why we collect it, how we protect it, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Data Fiduciary: {{LEGAL ENTITY NAME}}, {{REGISTERED ADDRESS}}. For any privacy question or to exercise your rights, contact our Grievance Officer (see “Contact & grievances” below).
1. Children’s data and guardian consent
Sugar Sakhi is used to support the care of children (under 18). We process a child’s personal data only with the verifiable consent of a parent or lawful guardian, who operates the account on the child’s behalf, as required by the DPDP Act. At onboarding the app records the guardian’s name, their relationship to the child (parent / legal guardian), and an explicit attestation that they are that guardian and consent on the child’s behalf, together with the version of this notice they accepted. Consent is versioned (we re-ask if the wording materially changes) and can be withdrawn at any time (see “Your rights” and “Withdrawing consent”).
We do not use children’s data for behavioural tracking, profiling, or targeted advertising, and we do not run advertising on the platform.
2. What personal data we collect
| Category | Examples |
|---|---|
| Identity & contact | Child’s name, date of birth, caregiver’s mobile number (used for one-time-password sign-in) |
| Clinical / health data | Glucose readings, insulin doses and vials, meals/carbohydrates, ketone readings, blood tests (e.g. HbA1c), growth (height/weight), skin checks, sick-day/emergency events, and emotional-wellbeing screening responses |
| Care relationship | The treating physician you are enrolled with, and clinical “flags” raised for review |
| Consent records | That consent was given/withdrawn, and the version of the notice you accepted |
| Device & technical | Push-notification token (if you enable notifications) and basic technical data needed to operate the app securely |
Emotional-wellbeing (distress) scores are calculated and visible only to the clinical team; they are never shown to the family and are excluded from any data export.
3. Why we use your data (purposes)
- To provide day-to-day diabetes self-management tools to the family.
- To give the treating clinician a dashboard and timely safety alerts (“flags”) so a child does not fall through the gap between clinic visits.
- To route a counsellor referral when a wellbeing screen indicates it.
- To produce aggregate, de-identified programme metrics (counts and ratios only, never individual identities) to run and evaluate the pilot.
Our lawful basis is your consent under the DPDP Act. We practise data minimisation: we collect only what is needed for these purposes.
4. The AI assistant
Sugar Sakhi includes an educational AI assistant. When you ask it a question, only your question text and our curated education content are sent to our AI provider (Google’s Gemini API) to generate an answer. Your child’s clinical record is never sent. The assistant provides general education only; it never tells you how much insulin to give and never claims a doctor has seen anything. Some AI processing may occur on servers outside India (see “Where your data is stored”).
5. Who we share data with
We do not sell your data or share it for advertising. We share it only with:
- Your treating clinicians at the pilot hospital, who are bound by professional confidentiality.
- Our technology processors, who process data on our instructions under data-processing terms: Google Cloud / Firebase (secure database, authentication, and notifications) and Google’s Gemini API (the AI assistant, as described above).
- Authorities, only where required by law.
6. Where your data is stored
Your records are stored in Google Cloud’s Mumbai region (asia-south1), in India. Limited AI-assistant requests (the question text + our education content, never the record) may be processed by Google outside India; we disclose this so you can make an informed choice when using the assistant.
7. How long we keep it & erasure
We keep personal data only as long as needed for the purposes above or as required by law. When you withdraw consent or request erasure, we permanently delete the child’s personal data across our systems. We retain a de-identified access/audit record (with the child no longer identifiable) where retention is needed for medical-legal and compliance reasons.
Indicative retention schedule (recommended default, to be confirmed by our DPO):
- Clinical & profile data: kept while the account is active and for up to 12 months after the last activity or the end of the pilot (whichever is earlier), then deleted.
- On consent withdrawal / erasure request: the child’s personal data is deleted promptly (no waiting period).
- De-identified access/audit log: retained for up to 3 years for medical-legal and compliance purposes; the child is not identifiable in it.
- Consent records: kept as evidence that consent was given and later withdrawn.
8. Your rights under the DPDP Act
- Access: a summary of the personal data we process about the child.
- Correction & erasure: correct inaccurate data or have data erased.
- Withdraw consent: as easily as it was given.
- Grievance redressal: raise a complaint with our Grievance Officer.
- Nominate: nominate another person to exercise these rights in the event of death or incapacity.
You may also escalate to the Data Protection Board of India if your grievance is not resolved.
9. Withdrawing consent / deleting data
You can withdraw consent and erase the child’s data at any time from within the app (Settings → Consent & data), or by contacting our Grievance Officer below. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
10. How we protect your data
Access is restricted by authenticated, role-based controls; clinician access to a child’s record is ownership-checked and audited; secrets are held in a managed secret store; and data is stored within the Mumbai region.
If a personal-data breach ever affects your child’s data, we will contain it first, then notify the Data Protection Board of India in the prescribed form and inform you promptly, in plain language (English, Hindi or Marathi), on the registered caregiver phone: what happened, what data was involved, what we are doing about it, and how to reach our Grievance Officer.
11. Changes to this policy
If we make material changes, we will update the version above and ask you to re-confirm consent in the app where required.
12. Contact & grievances
Grievance Officer: Dr Sudha Rao
Email: [email protected]
Address: c/o B.J. Wadia Hospital for Children, Acharya Donde Marg, Parel,
Mumbai 400012, Maharashtra, India
We aim to acknowledge requests within 7 working days and resolve them
within the timeframe required under the DPDP Act.