How we handle your personal data

1. Who we are and which laws apply

This website (vitaloop.in) is operated by VITALOOP LLP (LLPIN ADC-3019), registered office: Flat No. 7, Bldg B4, Sarita Nagari Phase-II, S.P. College, Sinhgad Road Police Station, Pune City, Pune – 411030, Maharashtra, India (“Vitaloop”, “we”, “us”). For the personal data described in this policy, Vitaloop decides why and how the data is used, so Vitaloop is the “data fiduciary” (the data controller).

Today we handle personal data in line with section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are being phased in, with most duties applying from May 2027. This policy is already written to the notice standard those Rules set: itemised data, specific purposes, and clear ways to withdraw consent, exercise your rights and complain.

We are building Vitaloop to work within India’s Ayushman Bharat Digital Mission (ABDM). In line with the ABDM Health Data Management Policy, we publish this privacy policy, a privacy-by-design policy, our grievance officer’s details and our breach-management procedure on this website.

2. What we collect, why, and on what basis

We collect data in two ways: automatically, when your browser loads our pages, and from you, when you email us or play the game. Nothing here is collected from children knowingly (see Children).

We do not collect financial information, government identifiers, health records, precise location or biometric data through this website, and we do not ask for them.

3. Who else receives data

We use a small number of outside services. Each receives the data a web server ordinarily receives (your IP address and browser details) when your browser contacts it, plus whatever is noted below. These providers act under their own terms; we do not control their practices, and we keep the list short on purpose.

This page, and the other legal pages linked from the footer, load nothing from third parties: no outside fonts, scripts or trackers. The home page and the “something is cooking” page load the Inter typeface from Google Fonts. The home page also contacts the visit counter, and the game contacts the leaderboard service, as listed above.

We may also share personal data with professional advisers under a duty of confidence, and with a court, regulator or other authority where the law requires. We do not sell personal data.

4. Cookies, local storage and similar technologies

We do not set cookies of our own, and we do not use advertising or cross-site tracking; the only analytics is the simple visit counter described in section 3. We do use your browser’s own storage for the items below. It stays on your device, and you can clear it at any time in your browser settings.

5. The public game leaderboard

If you play “Vitaloop Medivac” and press “Submit score”, the nickname you typed (up to 12 characters) and your score are posted to a public leaderboard hosted on the ntfy.sh service. Anyone can read that leaderboard, and anyone who learns its address could post to it.

Please use a nickname, not your real name, and do not type contact details. The service holds messages for a short period (its published default is 12 hours), and we keep no separate copy. To have an entry removed sooner, write to the Grievance Officer; we will replace the leaderboard without it.

6. How long we keep data

When a retention period ends, we delete or irreversibly anonymise the data, unless a law or a legal claim requires us to keep it.

7. Patient data and the Vitaloop platform

Vitaloop is building a hospital information system (HMIS/EHR). It has no live hospital deployments at present. This policy does not describe hospital patient data.

When the platform is in use, each hospital or clinic decides why and how its patients’ data is used, so the hospital is the data fiduciary. Vitaloop acts as a data processor: it handles that data only on the hospital’s written instructions, under a written agreement. Hospitals give their patients their own privacy notice, and are the first port of call for patients’ requests and complaints.

If a patient writes to us instead, we will pass the request to the hospital promptly and support it. We will not answer on the hospital’s behalf unless it instructs us to. We do not sell identifiable patient data, and we do not use it for advertising.

Where Vitaloop is a data fiduciary in its own right, for example for the login details of hospital staff who use the platform, and for prospect data, this policy applies. The Privacy-by-Design Policy describes how the platform is designed to protect patient data.

8. Where data is processed

This website is served through Cloudflare and the other providers listed in section 3. Their servers may be outside India, and Cloudflare operates a global network, so a request from India may be handled on servers abroad. The personal data involved is limited to what section 2 describes.

The Vitaloop hospital platform is designed to store and process patient data in India. See the Privacy-by-Design Policy.

9. How we protect data

• Our pages are served over HTTPS.
• We keep this website simple: it has no contact forms and no database of visitors. Emails sit with our email provider, not on the site.
• Access to our hosting, code and email accounts is limited to the small number of people who need it.
• We follow the breach-management procedure if something goes wrong.

No system is perfectly secure. If you find a security problem, please tell us using the details on the breach procedure page.

10. Children

This website is meant for adults and healthcare professionals. We do not knowingly collect personal data from anyone under 18, and we do not track, profile or advertise to children. If you believe a child has given us data, for example a nickname in the game, write to the Grievance Officer and we will delete it.

11. Your rights and how to use them

You can ask us to:

• tell you what personal data of yours we hold and how we use it;
• correct or complete data that is wrong;
• erase data we no longer need (where a law requires us to keep it, we will tell you which law);
• stop using data on the basis of your consent, by withdrawing that consent. This is as easy as giving it: for example, stop emailing us or ask us to remove a leaderboard entry. Withdrawal does not affect anything we lawfully did before it;
• act on your behalf through a person you nominate, if you die or cannot exercise these rights yourself.

To use any of these rights, email the Grievance Officer at shobhit@vitaloop.in with the subject “Privacy request”, or use the format on the grievance page. We may need to check who you are, and we will ask for no more than we need. We acknowledge every request within 3 working days and respond within 30 days.

If you are not satisfied with our response, you can escalate as described on the grievance page: to the ABDM grievance portal and, as the DPDP Act comes into force, to the Data Protection Board of India.

12. Changes to this policy

We date and number each version of this policy. If we change it in a way that matters, for example by collecting new data or using it for a new purpose, we will update this page and, where the law requires, ask for your consent again before the change applies to you. We keep earlier versions and will send you one on request.

13. Contact and complaints

General enquiries: nihar@vitaloop.in. The full process, and how to escalate, is on the grievance page.