Data Sovereignty & Privacy Policy: Your Health Records Belong Solely To You
SYVORA Health is architected in strict compliance with the Digital Personal Data Protection Act (DPDP Act 2023), Google API Services User Data Policy, and Zero-Cloud privacy principles.
Master Privacy Policy & Security Protocol
Effective Date: January 1, 2026 • Version 2.4 (Active)
6 Fundamental Privacy Guarantees
Unlike legacy centralized medical systems, SYVORA Health is fundamentally engineered around zero-cloud telemetry and patient cryptographic sovereignty.
100% On-Device Vault
Health records stay securely encrypted inside your local device sandbox (IndexedDB/RxDB). Zero clinical data on our servers.
Private Google Drive Sync
Backups mirror strictly into your personal Google Drive hidden AppData folder. SYVORA cannot inspect or monetize this file.
Stateless AI Vision OCR
Prescriptions are parsed ephemerally in volatile RAM. Images are instantly purged and NEVER used to train AI models.
Bank-Grade Billing (Razorpay)
We never store debit/credit card numbers or UPI credentials. Payments are processed via PCI-DSS Level 1 certified Razorpay.
1-Click Total Data Erasure
Under DPDPA 2023, you retain absolute sovereignty. Instantly purge all local database records and Google Drive cloud backups.
Zero Ads & Zero Data Brokers
Our revenue is purely honest software memberships. We strictly NEVER sell, broker, or syndicate patient health telemetry.
Google API User Data Policy & Limited Use Disclosure
When you authenticate with Google on SYVORA Health, we request access to your primary profile identity (name, email address, and profile picture) exclusively for authentication and account verification.
Google Drive AppData Scope (drive.appdata) Usage:
- SYVORA Health does NOT access, read, scan, or modify any personal documents, images, or files stored in your general Google Drive storage.
- Our application strictly operates within an isolated, application-specific sandbox (the hidden appDataFolder). It is used solely to store and restore your client-side encrypted backup snapshot (syvora_vault_backup.json.enc).
- No SYVORA employee, administrator, or centralized server can read this file. It is mathematically encrypted using your device credentials and never transferred to external databases.
Mandatory Google API Services Disclosure:
“SYVORA Health's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.”
On-Device Architecture & Indian DPDP Act 2023 Compliance
Under India’s Digital Personal Data Protection Act (DPDP Act 2023), citizens possess sovereign rights over their digital personal health telemetry. SYVORA Health is architected from day one under strict Data Minimization and Privacy-by-Design mandates:
Local IndexedDB Sandbox
Patient profiles, vitals timelines, lab reports, and alarms reside strictly inside the sandboxed IndexedDB storage of your device.
Zero-Cloud Offline Immunity
Even without internet connectivity, medication alarms, trend analytics, and medical files remain instantly accessible.
Stateless AI Prescription Scanner & Voice Assistant Policy
When you scan a prescription or pathology report, SYVORA utilizes a stateless inference pipeline designed with zero persistent retention:
- In-Memory Volatile Processing: Uploaded report images exist in volatile memory only for the duration of the OCR execution (~1-2 seconds) and are permanently purged upon response dispatch.
- Zero AI Model Training Guarantee: Patient documents, handwriting samples, dosages, and physician identities are NEVER indexed, stored in training corpora, or used to fine-tune AI models.
- Voice Assistant Privacy: Text-to-speech requests process clinical instructions statelessly and discard all audio streams once delivered to the client.
Payment Processing & Financial Security (Razorpay)
Paid subscriptions for SYVORA Health (Pro Individual at ₹99/month and Pro Family Hub at ₹199/month) are transacted exclusively via Razorpay Software Private Limited:
- SYVORA Health NEVER stores, collects, or logs payment card numbers, CVVs, expiry dates, net banking passwords, or UPI PINs.
- All monetary transactions adhere to Reserve Bank of India (RBI) tokenization guidelines and PCI-DSS Level 1 security standards.
- Our servers retain only non-sensitive transactional verification metadata (Subscription ID, Payment ID, Plan Tier, and Status).
Device Hardware Permissions (Camera, Microphone & Alarms)
Requested on-demand solely when taking an optical photo of a paper prescription or pathology sheet. Never active in the background.
Engaged solely during live Voice Vitals dictation sessions. Audio streams terminate instantly when the session completes.
Used to trigger precise on-time medication chimes and refill alerts directly on your device without server-side tracking.
Right to Complete Erasure & Data Portability
You possess uninterrupted, unconditional authority to export or wipe your complete clinical profile at any time:
Instant 1-Click JSON/PDF Export
Export your complete longitudinal timeline as a standards-compliant JSON package or clinical PDF Doctor Summary.
Irreversible Local & Cloud Purge
Executing a vault reset purges all local IndexedDB tables and instantly flushes the Google Drive AppData mirror.
Statutory Grievance Redressal Officer & Legal Contact
In compliance with Rule 5(9) of the Information Technology (Intermediaries Guidelines) Rules, 2011 and India’s Digital Personal Data Protection Act (DPDPA 2023), our designated Grievance Redressal Officer may be contacted directly:
Officer Designation
Grievance & Privacy Officer
SYVORA Health Legal & Compliance
Statutory Response Window
Acknowledgment within 48 Hours
Full Resolution within 30 Days
For general technical inquiries, subscription management, or cloud restore requests, you may also reach our dedicated team at support@syvorahealth.com.
© 2026 SYVORA Health. All rights reserved.