Privacy Policy — Zamnaik Healthcare

Legal review notice: this policy is drafted to accurately describe the actual technical systems Zamnaik Healthcare operates — what's collected, where it's stored, who processes it, and what rights you have. It is a strong starting draft, not a substitute for review by a qualified lawyer familiar with India's DPDP Act 2023 before this is treated as final and binding. Update this notice once that review is complete.

1. Who we are

Zamnaik Healthcare Pvt. Ltd. ("Zamnaik," "we," "us") operates Zamnaik Path Lab, Sai Medical Clinic, the Zamnaik Diagnostic Center in Nerwa, and the Smart Report tool, all under zamnaik.com. This policy covers data collected through the website, the patient portal, and Smart Report.

2. What we collect

Identity data: full name, phone number, date of birth, gender — collected at signup.
Health data: lab reports you upload, biomarker values and reference ranges extracted from them, AI-generated interpretations, and appointment history.
Payment data: handled directly by Razorpay — we store the transaction ID and status, never your card or bank details.
Technical data: a session cookie that keeps you signed in (see Section 6), and aggregate, non-cookie-based analytics via Cloudflare Web Analytics.

3. How Smart Report uses your data

Before any report content is sent for AI interpretation, we strip your name, phone number, and date of birth from the payload — the AI model only ever sees an anonymous internal report ID and the biomarker values themselves. Interpretation is generated by OpenAI's API (GPT-4o-mini) and grounded in ICMR/WHO reference range data we maintain. Smart Report explains what a value indicates; it does not diagnose, and every interpretation is intended to be discussed with a doctor, not acted on alone.

4. Who we share data with

We use the following processors, each solely to provide the service described: Supabase (database hosting, Singapore region), Backblaze B2 (encrypted file storage for uploaded reports), MSG91 (SMS/WhatsApp delivery for OTP login and appointment confirmations), Razorpay (payment processing), OpenAI (anonymized AI interpretation), and Railway/Cloudflare (application hosting and content delivery). We do not sell your data to anyone, for any reason.

5. Your rights under the DPDP Act, 2023

You have the right to access the personal data we hold about you, correct it if inaccurate, withdraw consent for AI interpretation at any time (Section 3), and request complete erasure of your account and associated data. You can exercise the access and consent-withdrawal rights directly from Privacy & Consent in your account. Full account deletion is available on the same page and is permanent.

6. Cookies and sessions

We use two httpOnly cookies to keep you signed in — an access token and a refresh token. These cannot be read by JavaScript (including on this page or any other), which is a deliberate security choice to reduce exposure if a browser extension or script were ever compromised. We do not use tracking or advertising cookies. Cloudflare Web Analytics, used to measure site usage, does not use cookies at all.

7. Data retention

We retain your account and health records for as long as your account is active, so your report history and biomarker trends remain useful over time. If you delete your account, associated reports, biomarkers, and appointment history are permanently deleted along with it.

8. Contact

Questions about this policy or a data request: hello@zamnaik.com or +91 98163 44552.