Privacy Policy
Effective date: 21 October 2026
1. Who we are
Evarya Health Private Limited, 20/38, 2nd Cross Road, Ramakrishna Nagar, JP Nagar 6th Phase, Bengaluru 560076 (“Evarya”, “we”) runs TheER, a clinical triage service for families in India, through our Android app, web app and website.
TheER asks about your symptoms and uses fixed, doctor-written clinical rules to suggest how urgently you should seek care (red, yellow or green). It is not a diagnosis and does not replace a doctor. Cases can be reviewed by our doctors and advisors.
This policy explains what personal data we collect, why, who we share it with, and your rights under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). For the DPDP Act, Evarya is the Data Fiduciary for your data.
2. Information we collect
We collect only what TheER needs to triage your symptoms and run your account.
| Type | What it includes | Where it comes from |
|---|---|---|
| Account | Mobile number, email, password (stored only as a secure hash), name | You, at sign-up or login |
| Google sign-in | Your Google account name, email address and a Google account ID | Google, only if you choose “Continue with Google” |
| Health profile | Date of birth, age, gender, blood group, allergies, ABHA ID (optional), menstrual/pregnancy details where relevant | You, during onboarding or triage |
| Triage information | Symptoms you describe in your own words, your answers to follow-up questions, and the urgency result | You, during each triage |
| Documents | Medical reports and files you upload to your vault | You |
| Consultations | Messages, voice and video calls with our doctors or advisors | You and our clinical team |
| Payments | Payment status and transaction reference. We do not receive or store your card, UPI or bank details | Razorpay, our payment processor |
| Waitlist | Your name and email, if you join the waitlist on our website | You |
| Technical | Device and app information, IP address, log records with a request ID (never your symptoms) | Your device, automatically |
We ask for your consent before collecting health information, and you can use TheER without an ABHA ID.
3. How we use your information
We process your personal data on the basis of your consent, which you give at sign-up and can withdraw at any time (section 6). We use it to:
- Create and secure your account, and verify your phone number with a one-time code.
- Triage your symptoms and show you an urgency result and next steps.
- Let our doctors and advisors review your case, and contact you about it.
- Escalate urgent cases to an on-call advisor.
- Run consultations, payments and your document vault.
- Send you service messages (OTP, case updates, receipts) by SMS, WhatsApp or email.
- Keep the service safe, fix problems, and improve our clinical rules, using records reviewed by our clinical team.
- Meet legal and regulatory obligations.
We do not sell your data, and we do not use it for advertising. We use no third-party advertising or analytics trackers in the app.
Website analytics: on our website only, and only if you tap “Accept” on the cookie banner, we use Google Analytics and PostHog to count visits and see which pages are used. Google’s advertising features are switched off. If you tap “Decline”, no analytics is loaded. Nothing you enter in the symptom check is sent to them.
About AI: urgency results come from fixed, doctor-written rules, never from AI. Where enabled, we use Google’s Gemini AI service only to (a) suggest which symptom area your description matches, as a check alongside our rules, and (b) read documents you upload to your vault and describe them in plain language. AI output never sets your urgency level.
4. Who we share it with
We share your data only with our own clinical team and with service providers (Data Processors) who handle it for us under contract, only for the purposes below.
| Recipient | Why | What they receive |
|---|---|---|
| Evarya doctors and advisors | Review your case, consult with you | Your profile, triage information, documents you share |
| Google (Firebase Authentication) | Phone OTP verification and Google sign-in | Phone number, Google account details |
| Google (Gemini AI) | Symptom-area suggestion; reading vault documents | Your symptom description; the document you upload |
| Razorpay | Process payments | Payment amount and order details. You enter card/UPI details directly with Razorpay |
| MSG91, Twilio, Meta (WhatsApp) | SMS, WhatsApp messages, in-app chat and calls | Phone number, message content |
| Resend, Google (Gmail) | Email address, message content | |
| Cloudflare | Host our website and waitlist; store your uploaded documents (R2) | Waitlist name and email; your documents |
| Railway | Host our servers and database | All data the service stores |
| Google Analytics, PostHog | Website visit statistics, only after you accept the cookie banner | Pages visited, device and browser type, approximate location from IP |
We may also disclose data when required by law, a court order or a government authority, or to protect someone’s life in an emergency. [TO CONFIRM: final list of processors and where each stores data; some may store data outside India.]
5. Storage, security and retention
We protect your data with reasonable security safeguards, as the DPDP Act requires:
- Data travels over encrypted connections (HTTPS).
- Clinical text such as symptom descriptions is encrypted in our database.
- Passwords are stored only as secure hashes; your login token is kept in your phone’s secure storage.
- Access to patient records is limited to authorised staff and logged.
- Our logs record a request ID, never your symptoms or answers.
Retention: we keep your account data while your account is active. If you delete your account, we remove your personal identifiers (name, email, date of birth, gender, blood group, allergies, ABHA ID) within 7 days and close the account. We keep de-identified triage and consultation records for 7 years, because Indian law requires medical records to be kept and they are needed for clinical audit. If your account holds no medical records, we delete all of its data within 7 days.
If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
6. Your rights
Under the DPDP Act you can:
- Access a summary of your personal data and how we process it.
- Correct or update your details, at any time from your profile in the app.
- Erase your data by deleting your account in the app, or by writing to us (section 8).
- Withdraw consent at any time. Withdrawal stops future processing; it does not undo processing already done, and some features will stop working.
- Nominate someone to exercise these rights for you if you die or become unable to.
- Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.
To use any right, email [email protected] from your registered email, or contact the grievance officer. We will respond within 30 days.
If you signed in with Google, you can also remove TheER’s access from your Google Account settings.
7. Children, emergencies and changes
Children: an account holder must be 18 or older. A parent or guardian may use TheER for a child in their family; by doing so they give verifiable consent for the child’s data, as the DPDP Act requires. We do not track children’s behaviour or target ads at them.
Emergencies: TheER is not an emergency service. If you think someone’s life is at risk, call 112 or go to the nearest emergency department immediately.
Changes: we may update this policy. We will show the new effective date here and tell you in the app or by email before significant changes take effect.
8. Contact and grievance officer
For questions about this policy or your data, contact our grievance officer:
- Name: Adithya Ananthy
- Email: [email protected]
- Address: Evarya Health Private Limited, 20/38, 2nd Cross Road, Ramakrishna Nagar, JP Nagar 6th Phase, Bengaluru 560076
We will acknowledge your grievance within 48 hours and resolve it within 30 days.