Privacy, in plain words.

Last updated 19 October 2026

Who is responsible

Healthly decides why and how the information on this page is used, so under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) Healthly is its Data Fiduciary. The companies listed below handle it on Healthly's behalf. To reach Healthly about anything on this page, use the form at the end.

Health records are also sensitive personal data under the Information Technology Act, 2000 and its 2011 rules. That is why Healthly asks for your consent before it reads them.

What Healthly keeps, why, and for how long

This covers the Healthly iPhone app and Healthly on WhatsApp. The website is covered further down.

Healthly does not ask for your Aadhaar number, bank details or card numbers, and you should not send them in a report or message.

Apple Health

Healthly reads Apple Health only if you allow it on your iPhone, and only the kinds of readings you switch on. Apple Health readings are shown to you and the family members you share with. They are not sent to AI models, so Healthly's explanations and answers never use them, and they are not included in the PDF health report. Under Apple's rules, which Healthly follows, Apple Health data is not used for advertising or data mining and is not sold. Healthly does not write to Apple Health and does not store Apple Health data in iCloud.

Who can see your records

• You, and the family members you invite into your family. They see the people and records that are shared with them.
• Anyone you send a share link to. A link opens only the reports you picked, and only until it expires.
• A small number of people at Healthly, only when needed to fix a problem you reported, to answer a request you made, or to keep the service running safely. When they open a report file, it is logged.
• The companies listed below, on Healthly's behalf.
• Authorities, only when Indian law requires it, for example under a court order, and only what is required.

Companies that work for Healthly

These companies handle information for Healthly so the service can run. They do so under their contracts with Healthly.

• Railway runs Healthly's servers, database and file storage.
• Amazon Web Services reads text from scanned pages and photos, and sends some emails.
• OpenAI provides the AI models that read reports, write the plain explanations, answer questions and turn voice notes into text.
• Sarvam AI, an Indian document reading service, reads some reports when Healthly switches it on.
• Meta carries your WhatsApp messages through the WhatsApp Business Platform. WhatsApp's own terms and privacy policy also apply there.
• MSG91 sends sign-in codes by SMS.
• Expo and Apple deliver notifications to your iPhone. A notification can include a medicine or test name.
• Cloudflare runs this website and stores what is sent through its forms.
• Sentry receives error reports, when error tracking is switched on.

Several of these companies, including OpenAI, Amazon Web Services and Meta, may process your information on servers outside India, for example in the United States. Indian law allows this, except to countries the Government of India restricts, and Healthly will stop any transfer to a restricted country.

Your consents, and how to change them

Each consent is recorded with the time and the version of this note you saw. You can change your mind as easily as you said yes.

Using reports to improve Healthly. Healthly does not use your reports to train or test its systems today. If it wants to, it will ask you first, as a separate choice that stays off unless you turn it on. Removing names and phone numbers from a report does not make it anonymous, so Healthly will ask rather than assume.

Family accounts, children and elders

• The person who sets up the family is the family owner. Their consent covers the records of everyone in the family, so only they can turn it on or off.
• You must be 18 or older to set up a family.
• When you add a child, you confirm that you are their parent or lawful guardian, and you give consent for them, as the DPDP Act requires. Healthly does not track children's behaviour or show them targeted ads.
• When you add an adult, such as a parent, you confirm they are happy for you to keep their records. Better still, invite them so they can see their own records. Any adult can write to us to be removed from a family.
• A child who turns 18 can write to us about their records, for example to have them removed.

Your rights

• See what Healthly keeps. In the app, Settings, Data and privacy, Export my data gives you a copy of your records. You can also ask us for a summary of what Healthly holds about you and which companies it was shared with.
• Correct it. Edit details in the app, or ask us to.
• Delete it. One report, medicine, reminder or person, or your whole account. The account deletion page explains how.
• Withdraw consent. See your consents above.
• Name someone to act for you. Under the DPDP Act you can nominate a person to use these rights for you if you die or cannot act yourself. To do this today, write to us with their name and how to reach them.
• Complain. Write to the Grievance Officer. If you are not satisfied with the answer, you can take your complaint to the Data Protection Board of India.

Before acting on a request, Healthly may ask you to confirm that you own the phone number on the account, for example with a message from that number.

How long things are kept

• Your records stay until you delete them or your account. Healthly does not delete inactive accounts on its own.
• When you delete your account in the app or on WhatsApp, it happens straight away: reports and their files, results, medicines, reminders, family profiles, invites and the WhatsApp message log for your family's phones. Family members you invited lose access and are told.
• Kept for one year, as India's data protection rules require: your consent records (what you agreed to, which version, when, and the network address), a minimised log of activity on the account (the kind of action, when, internal reference numbers and the network address, with no report content, names or file names), and a short record that the deletion happened (when, and how many profiles and reports). One year after the deletion, all of these are deleted too.
• What stays after that: cost records with nothing that says whose they were, and usage counts, if you said yes to them, under their coded ID.
• Your own WhatsApp chat with Healthly stays on your phone until you delete it there.
• If Indian law requires a record to be kept for longer, Healthly keeps only that record, only for as long as required.

This website

• Invite form. Your WhatsApp number and language, and where your visit came from: campaign tags in the link, ad click codes, a referral code, the first page you landed on, the page that sent you, and your country (worked out from your network, not your exact location). The number is used only to send your invite. The rest shows which links bring people to Healthly. It is stored with Cloudflare and may be copied to Healthly's own systems, and the team may get an email about a new request. Healthly's copy is removed once that number joins Healthly, and every copy is deleted after 12 months at the latest. You can ask us to remove it sooner.
• Write to us form. Your name, phone number or email, topic, message and country. To stop abuse, the site also counts messages per day using scrambled (hashed) forms of your contact and network address. Those counts are deleted after a day. Your message is kept for 12 months, so we can answer it and keep a record of your request, and then deleted.
• Page counts. Which page or button was used, the page language and a few fixed labels, added up per day. No ID of any kind, network address, cookie or device details are stored. Daily totals are deleted after about 13 months. Nothing is sent if your browser asks not to be tracked (Do Not Track or Global Privacy Control).
• Cloudflare Web Analytics. When it is switched on, Cloudflare counts page visits without cookies.
• Browser storage. A note of where your visit came from is kept in your browser tab (session storage). It is cleared when you close the tab, and it is sent only if you use the invite form.
• Cookies. This website does not set cookies of its own, so there is no cookie banner. Its fonts load from Google Fonts, which receives your browser's network address when a page loads.

Keeping it safe

Information travels over encrypted connections. Report files are encrypted by Healthly before they are stored. Other information, such as the values read from reports and your messages, is kept in a database that only Healthly's servers and a small number of team members can reach. Sign-in uses a one-time code sent to your phone, and you can lock the app with Face ID. No system is perfectly secure, so Healthly works to keep the risk low and to fix problems quickly.

If a breach affects your information, Healthly will tell you without delay: what happened, what it may mean for you, what Healthly is doing about it and what you can do. Healthly will also report it to the Data Protection Board of India and to CERT-In, as Indian law requires.

What Healthly is not

Healthly explains and organises. It does not diagnose, prescribe or replace a doctor. If something in a report worries you, the right next step is a conversation with a doctor. In an emergency, call 112.

Changes to this note

The date at the top shows the current version, and every consent is recorded with it. If this note changes in a way that matters, Healthly will tell you in the app or on WhatsApp before the change applies. If a change adds a new purpose, Healthly will ask for your consent first.

Grievance Officer and contact

For a question, a request or a complaint about your information, write to Healthly's Grievance Officer with the form below.

Healthly will acknowledge your message and resolve it within 30 days. If you are not satisfied with the answer, you can take your complaint to the Data Protection Board of India.

See also the terms of use and how to delete your account.