Kado Care ("we", "us", "our") operates the personal health records platform at app.kado.care and via WhatsApp. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), Kado Care is the Data Fiduciary — the entity responsible for determining the purpose and means of processing your personal data.

Privacy Officer contact: himanshu@kado.care

We collect only what is necessary to provide you the Kado Care service (principle of data minimisation):

Data you provide directly

• Phone number — used to identify you and send your health records link
• Health reports (PDFs/images) — documents you share on WhatsApp or upload directly

Data derived from your reports

• Biomarker values — health parameters extracted using AI (e.g. blood glucose, haemoglobin, cholesterol)
• Diagnoses and conditions — medical information mentioned in your reports
• Report metadata — date, type, and source of each report

Data collected automatically

• Usage data — pages viewed and features used (no advertising tracking)

We do not collect your name, email, Aadhaar number, financial information, or location unless explicitly provided by you.

We process your personal data for the following specific, lawful purposes only:

• Analysing your health reports using AI to extract biomarker data
• Displaying your health records and insights in the Kado Care app
• Sending you WhatsApp messages with links to your records
• Improving the accuracy of our AI pipeline (anonymised and aggregated only)

We will never use your health data for advertising, profiling for third parties, insurance underwriting, or any purpose beyond providing you the Kado Care service. If we wish to use your data for any new purpose, we will seek fresh consent before doing so.

By sending us a health report on WhatsApp or uploading it on app.kado.care, you provide free, specific, informed, and unambiguous consent for us to process that data as described in this policy.

You have the right to withdraw consent at any time by writing to himanshu@kado.care. Upon withdrawal, we will stop processing your data and delete it within 30 days. Withdrawing consent may mean you can no longer use the Kado Care service.

Children's data: Our service is intended for individuals aged 18 and above. We do not knowingly collect data from minors. If you believe a minor has shared data with us, please contact us immediately.

Your data is stored on Supabase servers located in Mumbai, India. We implement the following security measures:

• Encryption in transit (HTTPS/TLS) for all data transfers
• Encrypted storage at rest for all health reports and biomarker data
• Access controls — only authorised systems can access your data
• No third-party access to your raw health reports beyond what is described in this policy

Data retention: We retain your data for as long as you use Kado Care. Upon deletion request, we permanently delete all your data within 30 days.

AI processing: Health reports are processed by Anthropic's Claude AI to extract biomarker data. Anthropic acts as a Data Processor and does not retain your data beyond the processing session. See Anthropic's privacy policy at anthropic.com/privacy.

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India promptly upon becoming aware of the breach
• Notify affected users directly via WhatsApp or available contact method
• Provide details of: the nature of the breach, data affected, steps taken, and remediation measures

We do not sell your personal data to any third party. We share data only in the following limited circumstances:

• Anthropic (AI processing): Health report PDFs are sent to Anthropic's API solely to extract biomarker data. Anthropic does not retain your data.
• Supabase (data storage): Your data is stored on Supabase's infrastructure in Mumbai, India.
• Legal requirement: If required by law, court order, or government authority under applicable Indian law.

All third-party service providers are contractually bound to process your data only as directed by us and in accordance with applicable data protection laws.

Under the DPDP Act, 2023, you have the following rights. To exercise any of them, write to himanshu@kado.care.

This Privacy Policy is compliant with:

• Digital Personal Data Protection (DPDP) Act, 2023 — India's primary data protection law
• DPDP Rules, 2025 — notified on 13 November 2025 by MeitY, full compliance by May 2027
• Information Technology Act, 2000 and the IT (Reasonable Security Practices) Rules, 2011
• Telemedicine Practice Guidelines, 2020 — to the extent applicable to digital health platforms

Any disputes arising from this policy shall be subject to the jurisdiction of courts in New Delhi, India.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via WhatsApp. The updated policy will always be available at kado.care/privacy with a revised effective date.