Privacy Policy

1. Introduction

This Privacy Policy explains how HealthInTime ("HIT", "we", "us", "our") collects, uses, stores, shares, and protects your information when you use the HIT mobile application. HIT is a patient queue management and doctor appointment booking service operated for users in India.

By downloading, installing, or using HIT, you agree to the practices described in this policy. If you do not agree, please do not use the app.

This policy is designed to comply with Apple's App Store Review Guidelines, Google Play policies, the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, and Apple's App Tracking Transparency framework.

2. Information we collect

2.1 Account information

When you sign up or sign in, we collect:

• Name and age (entered during profile setup)
• Contact details — email address and/or phone number
• Authentication identifiers — obtained when you sign in using Sign in with Apple, Google, or phone OTP

2.2 Location data

HIT uses your device's location for the following purposes:

• Finding nearby clinics and doctors — when you search for healthcare facilities close to you
• Predicting consultation wait times — based on your distance from the clinic
• Automatic check-in on arrival — HIT detects when you arrive at a clinic and marks you as "arrived" in the queue, so you don't have to check in manually at reception
• Geofencing — HIT monitors entry into a small zone around your booked clinic to trigger the auto check-in feature
• Displaying clinic locations on maps — using Google Maps SDK to render interactive maps showing clinic positions, routes, and directions
• Place search and address lookup — using Google Places API and Geocoding API to help you search for clinics by name or address, auto-complete location inputs, and convert addresses to map coordinates

2.3 Bluetooth (BLE) data

HIT uses Bluetooth Low Energy (BLE) beacons as a fallback mechanism for detecting clinic arrival in situations where GPS accuracy is poor (for example, inside buildings or in dense urban areas).

• HIT scans for BLE beacons registered to partner clinics only
• HIT does not scan for, pair with, or identify any other Bluetooth devices
• BLE data is used solely to determine whether you are physically near the clinic you have booked, and is not stored or transmitted to our servers

2.4 Appointment and health-adjacent data

• Appointments you book, including date, time, clinic, and doctor
• Token numbers issued to you and their queue status
• Consultation history (past appointments)
• Any symptoms or health categories you select when searching for a doctor — used solely to route you to an appropriate specialist

HIT does not collect clinical medical records, diagnoses, prescriptions, or lab results at this time.

2.5 Device and diagnostic information

• Device model, OS version, and app version (for troubleshooting)
• Anonymous crash logs and performance metrics via Firebase Crashlytics

2.6 Notification tokens

• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) device tokens, used to send you queue updates, reminders, and appointment confirmations

2.7 Voice AI Booking (Phone Channel)

Patients who call a participating clinic's number may be connected to HIT's automated voice assistant, which books appointments on the clinic's behalf. For this feature:

• The conversation is processed in real time by Google Cloud Vertex AI (Gemini Live) and Google Cloud Speech services.
• Audio is processed in memory and is never stored or recorded.
• Only structured booking details (name, age, doctor, date, time, token) are saved, and these are stored in India (Google Cloud asia-south1).
• The voice audio is processed on Google Cloud infrastructure located outside India (United States / European Union region). This transfer is permitted under Section 16 of the DPDP Act, 2023, and is disclosed to you at the start of every call. You may decline and call back during clinic hours to speak to a human.
• The AI is used solely to book appointments. It does not provide medical advice, diagnosis, or treatment information.

3. How we use your information

We use the information we collect to:

• Facilitate appointment bookings and manage queue tokens
• Provide real-time queue position and wait time estimates
• Send push notifications about your upcoming turn, appointment confirmations, and changes
• Show you nearby clinics and verified doctors
• Automatically check you in at a clinic when you arrive, if you have enabled this feature
• Improve app stability via anonymous crash reporting
• Respond to your support requests

We do not use your data for advertising, profiling, or any purpose unrelated to providing the HIT service.

4. Data sharing and third parties

We do not sell your personal information to anyone.

We share data only in the limited circumstances below:

Google Maps Platform services (Maps SDK, Places API, Geocoding API) are subject to Google's Privacy Policy. When you interact with maps in HIT, Google may collect certain technical data (such as IP address and device identifiers) in accordance with their own policies.

We do not share your data with advertisers, data brokers, or analytics networks.

5. Data security

• All data transmitted between the HIT app and our servers is encrypted in transit using HTTPS/TLS 1.2 or higher
• Stored data is protected by Google Firebase's server-side encryption at rest
• We use Firebase App Check with Apple's DeviceCheck and Google Play Integrity attestation to ensure only legitimate installations of HIT can access our backend
• Authentication tokens are stored securely on your device (iOS Keychain / Android Keystore)

While we take reasonable security measures, no system is completely secure. If a data breach affects your information, we will notify you as required by the DPDP Act.

6. Data retention

7. Your rights

Under the DPDP Act 2023 and platform guidelines, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Delete your account and associated data
• Withdraw consent for optional data processing (e.g., location, notifications) at any time via device settings
• Lodge a complaint with the Data Protection Board of India if you believe your rights have been violated

How to delete your account

You can delete your account in two ways:

1. Inside the app — go to Profile → Settings → Delete Account
2. Via web form — submit a deletion request

Account deletion is permanent and cannot be undone.

8. Children's privacy

HIT is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will take steps to delete the information.

For users between 13 and 18, we recommend that a parent or guardian help create the account and review this policy.

9. International data transfers

Patient booking records and account data are stored in India (Google Cloud asia-south1, Mumbai).

For the automated phone booking assistant only, voice audio is processed in real time on Google Cloud servers located outside India (US/EU region), because the required AI voice service is not yet available in India. This audio is processed in memory and immediately discarded — nothing is stored abroad. We will migrate this processing to India once the service becomes available in the Indian region.

This cross-border processing is permitted under Section 16 of the DPDP Act, 2023 (no country to which we transfer data is on the Government of India's restricted list), and is subject to Google Cloud's Data Processing Terms. By consenting at the start of the call, you agree to this processing.

10. App Tracking Transparency

HIT does not track you across apps and websites owned by other companies. We do not use the iOS Advertising Identifier (IDFA) or Android Advertising ID, and we do not serve third-party advertisements.

11. Third-party services

HIT integrates with the following third-party services, each governed by their own privacy policies:

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or via email before the changes take effect. The "Last Updated" date at the top of this policy indicates when it was most recently revised.

13. Contact us

For formal complaints under the DPDP Act 2023, you may also contact the Data Protection Board of India.