Your privacy, our responsibility

We collect only what is needed to provide and improve the service. Here is what that includes:

What we do NOT collect

• Payment card numbers or banking information (payments processed by third-party gateways)
• Biometric identifiers like fingerprints or facial geometry
• Location data beyond city/state you voluntarily provide
• Social media profiles or browsing history outside Pushpa

Every piece of data we collect has a specific, limited purpose:

• Provide the core service — reading reports, tracking medicines, answering health questions
• Power AI analysis — extracting structured health data from your documents using vision AI
• Send timely reminders — medicine alerts, follow-up notifications, daily health briefs
• Support family health management — linking records across family members you add
• Enable doctor review — when you request a doctor's review of your health summary and reports
• Improve service quality — aggregated, anonymised usage data to make Pushpa more accurate
• Authenticate and secure your account — OTP verification, JWT session management
• Communicate essential service updates — changes to terms, critical security notices

We will never use your health data to:

• Sell or rent your information to third parties, advertisers, or data brokers
• Train AI models on your personal health data without your explicit written consent
• Target you with advertising, whether inside or outside Pushpa
• Share information with insurance companies, employers, or government agencies (unless legally required)

Pushpa uses trusted AI platforms to analyse documents and power conversations. When you send a health document, relevant content is transmitted to these processors in an encrypted request. We do not attach your phone number, account login, or other account identifiers to these requests — only the document content and the medical context needed to read it. A document is sent as it appears, so where a patient name is printed on the report it forms part of what is read; this is how Pushpa can tell whose report it is.

In the mobile app, we ask for your explicit consent before your first AI conversation or document upload. Your companion messages, uploaded health documents — and, during live sessions, your voice and anything you show on camera — are processed by the AI platforms below to generate responses. This can include health details you choose to share. It is used only to answer you — never for advertising, and never to train or fine-tune any AI model. You can decline and continue using the rest of the app.

Our third-party processors

Each processor is bound by a Data Processing Agreement (DPA) and their own published privacy policies. Data submitted through these APIs is never used to train or fine-tune any AI model.

The mobile app also loads static decorative images and 3D visuals from content delivery networks (Pexels, icons8, unpkg/Spline). These requests contain no personal or health data.

Analytics & diagnostics

To keep the app stable and understand how it is used, we use PostHog for product analytics and session replay, and Google Firebase for crash reporting, performance monitoring, and push notification delivery. In session replays, text inputs and images are masked so recordings do not capture readable medical data, names, or document contents. These services receive usage events, a device push token, and diagnostic data — not your health documents — and process it in the United States. You can turn analytics off at any time in the mobile app under Profile → Privacy → Share usage analytics.

On our mobile app you can optionally connect Apple Health (iOS) or Google Health Connect (Android) so Pushpa can show your activity trends alongside your health summary. We access this data only after you explicitly grant permission, and you can use the rest of the app without ever connecting it.

What we read

• Steps — to display your daily activity and trends
• Distance — to display your daily activity and trends
• Active and total calories burned — to display your daily activity and trends
• Heart rate — to show heart-rate trends alongside your health summary

How we handle it

• We read this data only after you grant permission through Apple Health or Health Connect, and you can revoke that access at any time in your device settings
• Your readings stay on your device — Pushpa reads them from Apple Health or Health Connect and works out your daily totals and trends on the phone itself. We do not upload them to our servers, and we do not send them to any third party, including our analytics provider or our AI processor
• This data is used only to provide these in-app features — it is never used for advertising, sold, or shared with third parties
• Apple Health and Health Connect readings are never used to train or fine-tune any AI model
• Our use complies with the Apple HealthKit terms and the Google Health Connect permissions policy, including their restrictions on the use of health and fitness data

Pushpa is built for families. When you add a family member, you become their health manager within the platform. Here is how access and privacy work:

• The person who adds a family member can view, update, and manage their health records
• Family members with their own accounts can control which records are visible to caregivers
• Caregiver observations (private notes about a patient) are never shown to the patient — this is a dignity protection built into the system
• Doctors, when invited to review your case, can see only the relevant conversation and health context — not your full record
• You can remove a family member's data from your account at any time via account settings

Your responsibility as a health manager

By adding a family member, you confirm you have their consent to upload and manage their health data on Pushpa. You are responsible for ensuring the accuracy of the information you provide on their behalf.

We take the security of health data seriously. Here is what we do to protect your information:

• All data is transmitted over HTTPS/TLS — no unencrypted connections
• Files are stored on AWS S3 with server-side encryption and accessed only via time-limited presigned URLs
• Passwords are hashed using bcrypt with 12 salt rounds — we never store plaintext passwords
• Sessions are authenticated with signed JWTs; tokens expire and cannot be reused after logout
• WhatsApp webhooks use HMAC-SHA256 signature verification to reject forged requests
• Logs are structured and searchable, but sensitive headers (like Authorization tokens) are automatically redacted
• Database access is scoped to each user's data — no query can accidentally return another user's records

What you can do

• Use a strong, unique password if you use email/password login
• Do not share your WhatsApp OTP with anyone — Pushpa staff will never ask for it
• Log out from shared devices
• Contact us immediately at system@dayzero.ai if you suspect unauthorised access

Under India's Digital Personal Data Protection Act 2023, you have the following rights with respect to your personal data:

• Right to Access — request a copy of the personal data we hold about you
• Right to Correction — ask us to correct inaccurate or incomplete data
• Right to Erasure — request deletion of your account and all associated data
• Right to Withdraw Consent — withdraw consent at any time, as easily as it was given. In the mobile app: Profile → Privacy → AI processing stops your documents and messages being sent for AI processing, and Profile → Privacy → Share usage analytics stops all analytics. Device permissions (camera, microphone, photos) and Apple Health / Health Connect access are revoked from your device settings. Your AI processing choice is also cleared whenever you sign out, so the next person to use the device is asked for their own consent
• Right to Grievance Redressal — raise a complaint and receive a response within 30 days
• Right to Nominate — nominate someone to exercise these rights on your behalf

How to exercise your rights

Email system@dayzero.ai with your registered phone number and the specific right you wish to exercise. We will respond within 7 business days and fulfill all requests within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is constituted.

Pushpa operates primarily over WhatsApp. When you message us on WhatsApp, your messages are received through the Meta WhatsApp Cloud API. Meta processes these messages in accordance with their own Privacy Policy.

• Reminders, health nudges, and daily summaries are sent only if you have opted in
• You can stop all WhatsApp messages at any time by sending the word STOP to our number
• OTPs sent via SMS are single-use, expire in 10 minutes, and are never logged after verification
• We do not use WhatsApp message metadata (read receipts, last seen) to build profiles

Managing your preferences

You can adjust your notification preferences, WhatsApp opt-in status, and reminder schedules from your Pushpa profile settings at any time.

We retain your data for as long as your account is active or as needed to provide the service.

• Active accounts — all health records, documents, and conversation history retained
• Deleted accounts — data is purged within 30 days of account deletion request
• AI conversation logs — retained for 12 months, then anonymised or deleted
• Push notification tokens — deleted immediately upon opt-out or account deletion
• Backup copies — fully purged within 90 days of account deletion

Legal holds

In rare cases, we may be required by Indian law to retain certain records for up to 7 years (e.g., financial transaction records). In such cases, we retain only what the law requires and restrict all other processing.

Pushpa requires users to be 18 years or older to create an account. We do not knowingly collect personal data directly from anyone under 18.

Children may be added as family members by a parent or legal guardian. In such cases, it is the parent's responsibility to ensure the child's health data is managed appropriately and with the child's best interests in mind.

If you believe a child under 13 has provided us personal data without parental consent, please contact system@dayzero.ai and we will promptly delete it.

How we notify you of changes

If we make material changes to this Privacy Policy, we will notify you via WhatsApp message or email at least 7 days before the changes take effect. Continued use of Pushpa after the effective date constitutes acceptance of the updated policy.

Contact our Privacy Officer

• Email: system@dayzero.ai
• Response time: 2 business days for general queries, 7 business days for rights requests
• Grievances resolved within 30 days as required by DPDP Act 2023

Registered address

Day Zero
New Delhi, India
dayzero.ai