Privacy Policy

01 Who we are

inome.health ("we", "us", "our") is a personal health AI assistant service. For the purposes of India's Digital Personal Data Protection Act 2023 (DPDPA), we are the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.

02 Data we collect

We collect only the data needed to operate the service. Health data is classified as sensitive personal data under DPDPA 2023 and is handled with additional safeguards.

Account & identity data

• Email address and full name (required for account creation)
• Hashed password (we never store your password in plain text)
• Age, gender, height, weight, date of birth
• Geographic information: country, state/region, city, timezone
• Cultural / religious preferences that affect dietary advice

Health data (sensitive — encrypted at rest)

• Medical conditions (e.g. hypertension, diabetes)
• Current medications and dosage schedules
• Symptoms you log (name, severity, body area, duration)
• Mood and stress levels (1–10 scale)
• Blood pressure readings and heart rate
• Sleep duration and quality scores
• Step count, active minutes, calories burned
• Food intake and meal logs (including Indian food database lookups)
• Body weight and BMI
• Blood glucose / SpO₂ (if manually logged or from wearables)

Conversation data (encrypted at rest)

• All messages you send to the AI assistant
• All responses the AI generates
• Session identifiers used to group conversations

Wearable device data (OAuth tokens encrypted at rest)

• Fitbit: activity, sleep, heart rate, weight data via OAuth 2.0
• Google Fit: activity, heart rate, sleep data via OAuth 2.0
• Apple Health: activity and biometric data (where connected)
• OAuth access and refresh tokens (stored encrypted; never shared)

Technical data

• IP address (collected at login and consent events for audit trail)
• User agent string (browser / device identifier)
• API request logs and structured application logs (retained 30 days)
• Firebase Cloud Messaging device token (for push notifications, if enabled)

03 How we use your data

We use your data only for the purposes you have consented to and that are necessary to operate the service.

04 Legal basis for processing

Under DPDPA 2023, we rely on the following bases for processing your personal data:

• Consent (Section 6) — the primary basis for all health data processing. You give explicit, informed, purpose-specific consent at registration and can withdraw it at any time.
• Legitimate use (Section 7) — for processing necessary to provide the service you have signed up for (e.g. account authentication, password reset, responding to your support messages).
• Legal obligation — where processing is required to comply with applicable Indian law.

Consent is collected per purpose (see Section 3 table above). Withdrawing consent for health_data_processing will disable the core AI features but will not delete your account unless you also request erasure.

05 Data sharing & third parties

We share your data only with the service providers listed below, and only to the extent required to operate the service. We do not share data with advertisers.

Each AI provider processes your messages under their own data processing agreements (DPAs). Prompts are sent without your name, email, or database identifier — only the conversation content and your anonymised health context.

5a Google user data & Limited Use

With your explicit consent, inome.health connects to Google Health Connect and the Google Fitness API to read (read-only) your activity and fitness data, heart rate, ECG, irregular-rhythm signals, sleep, and health metrics and measurements. We also use your basic Google profile and email to create and sign in to your account.

We use this Google user data solely to provide the personalised health-insight features you request inside inome.health. We do not sell it, do not use it for advertising, and do not transfer it to others except as needed to provide the service, for security, or to comply with law. No humans read this data except with your explicit consent or where required for security or legal reasons.

inome.health's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time (which revokes our access), and you can permanently delete all stored data via your right to erasure described in Section 09.

06 Cross-border data transfers

Some of our service providers (listed above) are located outside India. Where we transfer personal data internationally, we ensure adequate protections are in place through:

• Data processing agreements with each provider that include standard contractual clauses
• Using providers who operate under frameworks providing equivalent data protection (e.g. EU GDPR adequacy decisions)
• Encrypting data in transit (TLS 1.2+) and at rest (Fernet AES-128-CBC)

Your health data stored in our database remains within the AWS eu-west-2 (Ireland) region. AI inference calls to LLM providers are sent message-by-message; no bulk export of your health records occurs.

07 Data retention

When you delete your account, all personal data is hard-deleted from our database in a specific order to respect foreign-key constraints. This is not a soft delete — data cannot be recovered after erasure.

08 Security measures

We take the security of health data seriously and implement the following controls:

Encryption

• In transit: All connections use TLS 1.2 or higher. The API is only accessible over HTTPS in production.
• At rest — field level: Sensitive database columns (medical conditions, medications, conversation content, symptoms, wearable OAuth tokens) are encrypted using Fernet (AES-128-CBC + HMAC-SHA256) at the application layer, before being written to the database.
• At rest — disk level: AWS RDS storage encryption is enabled on the production database.
• Passwords: Stored as bcrypt hashes — never in plaintext.
• Encryption keys: Stored in AWS Secrets Manager, not in source code or environment files.

Access controls

• JWT-based authentication with short-lived access tokens and refresh token rotation
• Every API endpoint enforces owner-only access — you cannot access another user's data
• Rate limiting on all sensitive endpoints (login, registration, chat)
• Admin endpoints restricted by superuser check

Infrastructure

• Database runs in a private VPC with no public internet access
• AI agent service (AgentCore) has no direct internet exposure — authenticated via AWS SigV4
• Structured JSON logs with correlation IDs for security auditing

09 Your rights under DPDPA 2023

As a Data Principal under India's DPDPA 2023, you have the following rights. All are exercisable directly through the app or by contacting us.

You may also lodge a complaint with India's Data Protection Board if you believe your rights have been violated.

10 Children's data

inome.health is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at support.app and we will delete the data promptly.

If we discover that we have inadvertently collected data from a child, we will delete it immediately and terminate the account.

11 Cookies & local storage

The inome web application uses the following browser storage:

We do not use third-party tracking cookies, advertising cookies, or analytics pixels. Google Fonts is loaded from Google's CDN — Google may set its own cookies per their privacy policy.

12 Changes to this policy

We may update this Privacy Policy to reflect changes in the law, our services, or data practices. When we make material changes:

• The "Effective" date at the top of this page will be updated
• The policy version number in our system (DPDPA_POLICY_VERSION) will be incremented
• We will notify you by email and in-app notification at least 14 days before changes take effect
• If the changes require fresh consent, we will ask you to re-consent before continuing to use the service

Continued use of inome after the effective date constitutes acceptance of the updated policy.

13 Contact & grievance officer

For any privacy-related questions, data requests, or complaints:

If we are unable to resolve your complaint satisfactorily, you have the right to escalate to India's Data Protection Board (once established under DPDPA 2023).