Privacy Policy

1. Who we are

Vapus is run by Shoonya Origins, Pune, India. For the purposes of India's Digital Personal Data Protection Act, 2023, we are the party that decides why and how your personal data is processed. You can reach us at contact@shoonyaorigins.com.

2. What we collect

Information you give us:

• your name and email address, and your password (which is handled by our sign-in provider and never visible to us in readable form);
• health information you choose to record: symptom entries, severity, tags, medicines, and the documents and notes you upload;
• information about who you give access to: the email address of anyone you invite, and their access level;
• share links you create, their label and expiry, and your credit balance.

Information created when you use Vapus: sign-in and security records, and basic technical data such as IP address, browser type and time of requests, which our infrastructure providers keep for security and reliability.

On our public website only: analytics data about how pages are used (see Cookies and analytics).

3. Why we use it, and on what basis

We process your information to run Vapus: to create your account, store and show you your record, let you give access and share, keep the Service secure, and contact you about it. For health information you enter, we rely on your consent, which you give by choosing to record it. You can withdraw consent by deleting the information or closing your account.

We do not use your health records for advertising. We do not sell your personal data.

We do not currently use or share anyone's health record for research. If we ever offer an aggregated, anonymised research programme, it will be strictly opt-in, and we will ask for your separate consent first.

4. Who handles your data

We use trusted providers to run Vapus. They process data on our behalf:

• Supabase: sign-in, database and file storage;
• Render: hosts the Vapus API;
• GitHub Pages: hosts our public website;
• Google: Google Analytics and Google Fonts on public website pages.

We may also disclose information where the law requires it, or to protect people from serious harm. Otherwise your information is seen only by you and the people you choose to give access to.

5. Sharing that you control

You decide who sees your record. A delegate sees what their access level allows. A person with a share link sees what that link includes, until it expires or you revoke it. Once you share information, we cannot control what the other person does with it.

6. Cookies and analytics

Our public website pages use Google Analytics to understand how the site is used, and load fonts and scripts from third-party services, which can see your IP address when they do. The signed-in vault does not use analytics or advertising trackers.

Vapus stores a sign-in session and your light or dark theme choice in your browser's local storage so that the site works as you expect.

7. Where data is stored, and how it is protected

Your data is stored on cloud infrastructure operated by our providers. It is encrypted in transit (HTTPS) and at rest by those providers, and access is checked on every request. Vapus is not end-to-end encrypted. See our Security page for detail and limits.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

8. How long we keep it, and deleting it

We keep your information for as long as you have an account. You can delete individual timeline entries, documents and medications yourself, and doing so removes them from your vault.

To close your account and have your personal data erased, email contact@shoonyaorigins.com from the address you signed up with. We will remove your data, except where we must keep something to meet a legal obligation. Copies held in backups or by our providers are removed as those systems allow.

9. Your rights

Under Indian law you have the right to:

• get a summary of the personal data we hold about you and how it is used;
• have inaccurate or incomplete data corrected, and have data erased;
• withdraw your consent at any time;
• have a grievance heard, and complain to the Data Protection Board of India if you are not satisfied;
• nominate another person to exercise your rights if you die or become unable to.

To use any of these rights, email contact@shoonyaorigins.com. We may need to confirm it is you before we act.

10. Children

Vapus is intended for adults. We do not knowingly let children create accounts. If you manage a child's health record as a parent or guardian, you are responsible for doing so lawfully. If you believe a child has created an account, contact us and we will act on it.

11. Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, tell you on our website or by email.

12. Contact and grievances

For privacy questions, requests or complaints, write to contact@shoonyaorigins.com with the subject "Vapus privacy request". Shoonya Origins, Pune, India.