MedVedaPrivacy Policy
Effective date: 20 September 2026
1. Who we are
This policy applies to the MedVeda mobile app (Android package com.ayurpulse.app) and the website medveda.in (together, the "Service"), operated by MedVeda ("MedVeda", "we", "us"), Dhule, Maharashtra, India. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we act as the Data Fiduciary for the personal data described below. Contact: medvedaforu@gmail.com.
2. Data we collect
| Category | What | Why |
|---|---|---|
| Account | Full name, email address, mobile number, password (managed by our authentication provider, Supabase Auth), email/mobile verification status | Create and secure your account, sign you in by email or mobile number, send account emails |
| Study profile | Selected course and academic year, referral code you were given or entered | Show the right content; run the referral programme |
| Purchases & payments | Orders, purchased products and scope, amount, status, Razorpay order and payment IDs, timestamps | Unlock content, order history, support, accounting and fraud prevention |
| Learning activity | Quiz attempts and scores; usage events such as screens viewed, chapters/notes/videos opened, quizzes attempted, orders created, purchases unlocked, and search terms | Save your progress, improve the app, understand which content is used |
| Notifications | Expo push token and device platform (e.g. Android), your notification preferences | Deliver push notifications you have allowed |
| Referrals | Your referral code, referrals made or received and their status | Operate Refer & Earn when it is enabled, and prevent abuse |
| Crash and error data | Error reports and performance traces sent to Sentry in release builds when enabled (device model, OS version, app version, error details) | Find and fix bugs |
| Support | Anything you send us by email or WhatsApp | Respond to you |
What we do not collect: we do not collect your location, contacts or photos. We do not store your debit/credit card numbers, UPI PINs or bank credentials; payments are handled by Razorpay.
Data stored on your device
The app keeps some data locally: your sign-in session (in the device's secure storage), downloaded notes and quizzes and an offline database (SQLite) with queued quiz scores awaiting sync, recently viewed chapters, recent searches, study streak, study-reminder and notification-preference settings. This data stays on your device until you delete downloads, sign out, clear app data or uninstall the app.
3. Why we use your data, and consent
We process your data to provide the Service you asked for (account, content, purchases), to run and secure it (fraud/abuse prevention, error monitoring), to communicate with you, and to comply with law. Where the DPDP Act requires consent, we rely on the consent you give when you register and use the app; you can withdraw consent by deleting your account (section 9), and you can switch off push notifications in the app or your phone settings at any time. We may also process data for "legitimate uses" the DPDP Act recognises, such as complying with legal obligations.
4. Who we share data with
We do not sell your personal data. We share it only with service providers that process it for us:
- Supabase – database, authentication, file storage and server functions. Our Supabase project is hosted on Amazon Web Services in the Asia-Pacific (Seoul, ap-northeast-2) region, so your data is stored and processed outside India.
- Razorpay – payment processing. Razorpay receives the details needed to complete a payment and has its own privacy policy.
- Expo (Expo Push Notification service) – delivers push notifications to your device using your push token.
- Sentry – crash and error reporting, when enabled in the release build.
- Google Play / Google – app distribution and, on our website, Google Fonts (see section 10).
- Resend – sends our account emails (email verification and password reset) on our behalf; it is set up as the custom SMTP provider for our authentication service. Resend receives your email address and the content of those messages in order to deliver them.
- Authorities – where required by law or to protect rights and safety.
Each provider handles data under its own terms and privacy policy.
5. How long we keep data
We keep your account and study data while your account is active. If you delete your account, we delete the data described on our Account & Data Deletion page. Account data is kept while the account is active. After account deletion, personal data is erased within 30 days, except records we must keep by law (payment, invoice and tax records, kept for up to 8 years under Indian tax and accounting laws). Crash reports and usage events are kept for up to 12 months, after which it is deleted or kept only in anonymised, aggregated form. Backups are overwritten in the normal cycle.
6. Security
We use encrypted connections (HTTPS) to Supabase, row-level access rules so that students can read only their own account data, secure device storage for your session, time-limited signed links for paid notes, and restricted administrative access. No system is perfectly secure; please keep your password private. If a personal data breach affects you we will notify you and the Data Protection Board of India as the law requires.
7. Your rights
Under the DPDP Act, you may: ask for a summary of the personal data we hold and who we share it with; ask us to correct or update inaccurate data (you can edit your name and profile in the app); ask us to erase your data; withdraw consent; nominate another person to exercise your rights in case of death or incapacity; and have your grievance addressed. To exercise these rights, use the in-app options or email medvedaforu@gmail.com from your registered email address. We will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is operational.
8. Children
MedVeda is intended for students of degree-level AYUSH courses and is not directed at children. If you are under 18, please use the app only with the consent and supervision of a parent or guardian. We do not knowingly collect data from children without verifiable parental consent; if you believe we have, contact us and we will delete it.
9. Deleting your account and data
You can delete your account in the app under Settings → Delete Account, or follow the steps on the Account & Data Deletion page.
10. Website, cookies and browser storage
This website does not use advertising or tracking cookies, and we do not run analytics scripts on it. Pages load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads. The sign-up verification and password-reset pages read a secure token from the link you opened, use it only to talk to Supabase, and remove it from the address bar immediately; they do not store it in cookies, localStorage or sessionStorage.
11. International transfers
Your data is processed in the Republic of Korea (Supabase region) and in other countries where our providers operate. The DPDP Act permits transfers to countries other than those the Government of India restricts.
12. Changes to this policy
We may update this policy. The "Effective date" above shows the latest version; for material changes we will notify you in the app or by email.
13. Grievance Officer and contact
Name: Ashwini
Email: medvedaforu@gmail.com
Phone: +91 76206 16068 (also WhatsApp)
Address: Dhule, Maharashtra, India
Support hours: Monday to Saturday, 10:00 AM – 6:00 PM IST (excluding public holidays)