Legal
Data collection and retention policy
Exactly what AEVONA stores, where it lives, how long each category is kept, and what happens — technically — when you ask us to erase it.
Last updated 13 August 2026 · AEVONA Healthcare Pvt. Ltd.
In plain language
We collect only what the diary and the booking service need, and we say here how long each kind of record is kept.
Your entries are stored twice: on your own phone, so the app works offline, and on our servers in India. Deleting the app removes the local copy; asking for erasure removes ours.
Erasure is not a flag in a database. We destroy the encryption key that belongs to your account, which makes your stored records permanently unreadable — by us as well as by anyone else.
A few things survive erasure because the law requires it, and we list them below rather than leaving it vague.
This summary is for orientation only. Where it and the formal text below differ, the formal text applies.
1.The principles we hold ourselves to
- Collect the minimum. If a field is not needed to make the diary or a booking work, we do not ask for it. Age, gender, and city are optional.
- Purpose limitation. Data collected to arrange a booking is not repurposed for anything else.
- No secondary use. We do not sell personal data, do not use it for advertising, and do not build profiles for marketing.
- Storage limitation. Every category below has a stated retention period, not an indefinite one.
- Deletable by design. Field-level encryption under a per-user key is what makes genuine erasure possible.
- Data stays in India. Storage and processing are in an India region, per the product's residency requirement.
2.Where your data lives
AEVONA is offline-first, so your records exist in two places by design.
| Location | What is held there | How it is removed |
|---|---|---|
| Your device | A local copy of your entries, your emergency contacts, the diet and care guides, and scheduled medication reminders. This is what makes the app work with no connection. | Uninstalling the app removes it. Note that entries not yet synced are lost with it. |
| Our servers (India) | The synced copy of your records, your profile, caregiver links, bookings, and consent records. Sensitive fields are encrypted individually. | Erasure, as described below. |
| AEVONA operations systems | Booking rows needed to work the confirmation queue. | Removed on the retention schedule below, or on erasure where they are no longer required. |
Because reminders are scheduled by your device and entries are stored on it, anyone with access to your unlocked phone can see your diary. Use your device's own screen lock.
3.Retention schedule
Unless you ask for erasure sooner, we keep each category for the period shown. Where a period is stated as “life of the account”, the data is deleted when the account is erased or closed.
| Category | Retained for | Then |
|---|---|---|
| Health records — weight, blood pressure, fluid, medication logs, lab results | Life of the account. Your history is the point of the product, so we do not thin it out behind your back. | Erased with the account. |
| Profile — mobile number, name, and any optional details | Life of the account. | Erased with the account. |
| Emergency contacts | Life of the account. | Erased with the account. |
| Caregiver links | Life of the link, plus a record that it existed and when it ended, for as long as the account exists. | Erased with the account. |
| Bookings and their status history | Life of the account, and at least 3 years from the session date where needed for accounting and dispute resolution. | Reduced to a financial record with identifying fields removed, then deleted. |
| Consent records | As long as we rely on the consent, plus 3 years, so we can evidence the lawful basis. | Deleted. |
| One-time passwords | Minutes. They expire shortly after being issued. | Deleted automatically. |
| Session and refresh tokens | Up to 30 days for a refresh token; access tokens are short-lived. | Expire automatically. Signing out or erasure invalidates them. |
| Technical and security logs | Up to 90 days. | Deleted automatically. |
| Usage records — which screens you opened, which actions you completed, app version and device model | 90 days. Turn the setting off and we stop collecting them; the ones already collected age out on the same 90-day clock. | Deleted automatically, partition by partition. |
| Anonymous usage totals calculated from the above — for example how many people opened the app on a given day | Indefinitely. They are counts, with no identifier of any kind in them. | Kept. There is nothing in them to erase. |
| Website enquiries — contact and clinic-certification forms | Up to 24 months from your last contact with us about the matter. | Deleted. |
| Centre records and audit scores | Life of the commercial relationship, plus 3 years. This is business data about a centre, not personal data about you. | Deactivated, then deleted. |
4.What erasure actually does
You can request erasure from within the app. When you do, three things happen:
- Your records are deleted from our operational database — profile, trackers, emergency contacts, caregiver links, and bookings not held for a legal reason.
- The data-encryption key belonging to your account is destroyed. Any remaining copy of your encrypted fields, including copies inside backups taken before the request, becomes permanently undecryptable. This is sometimes called crypto-shredding.
- Your sessions are invalidated, so the account can no longer be used or re-authenticated.
Because the key is destroyed rather than merely rotated, erasure is irreversible. We cannot restore your history afterwards, even at your request. Export your data first if you want to keep it.
The local copy on your own device is removed by uninstalling the app. We cannot reach into your phone to delete it.
5.What survives an erasure request
A small set of records outlives erasure because we are legally required to keep them, or because they are no longer about you. Nothing here can be used to reconstruct your health diary.
- Financial and tax records relating to a completed booking, kept for the statutory period with identifying fields removed where possible.
- The fact that an erasure request was made and when, so we can demonstrate we honoured it.
- Aggregate, non-identifying counts — for example how many bookings a city received in a month, or how many people opened the app on a given day.
- Usage records within their remaining 90 days, permanently detached from your account. We remove the link between those records and you rather than deleting the rows, so what is left cannot be attributed to any person — including by us.
- Security logs already written, until their 90-day period expires.
- Encrypted fragments inside backups whose retention period has not yet elapsed. These are unreadable, because the key has been destroyed.
6.Backups
We take encrypted backups so that a failure does not lose your history. Backups are held in the same India region and are kept on a rolling schedule of no more than 35 days, after which they are destroyed. Erasure is not applied retroactively to a backup file; instead, destroying your key renders your data in those files unreadable for the remainder of their life.
7.Getting a copy of your data
You can export a complete, machine-readable copy of everything in your account from inside the app — profile, every tracker, emergency contacts, caregiver links, and bookings. The export is generated on request and covers all data slices, so you are never given a partial file without being told.
8.Making a request to us directly
Most requests are faster in the app. If you cannot use it — because you have lost access to your mobile number, for example — write to our privacy contact on the contact page. We will verify who you are before acting, since acting on an unverified request would itself be a breach, and we aim to respond within thirty days.
9.Changes to this policy
Retention periods may change as the service grows or as the law develops. The date at the top of this page shows when this policy last changed, and we will not extend a retention period for data already collected without telling you.
Questions about this document
Write to us and we will answer in Hindi, Gujarati, or English. Requests about your own data are handled under the data collection and retention policy.