Privacy Policy - Nudgely

1. Introduction

Welcome to Nudgely. This Privacy Policy outlines how your personal data is collected, used, shared, and protected. This service is operated by Jigyansu Rout, an individual based in India ("I", "me", "my").

This policy is designed to comply with India's Digital Personal Data Protection Act, 2023 (DPDPA). Under this Act, I am the Data Fiduciary, responsible for processing your data, and you are the Data Principal, the individual to whom the personal data relates.

• Scope of this Policy: This policy applies to all services provided by Nudgely, including the web application and automated voice calls made to users and recipients within India.
• Contact Information (Grievance Officer): For any questions, concerns, or to exercise your rights regarding your data, please contact me at jigyanshu15@gmail.com.
• Policy Updates: I may update this policy to reflect changes in my practices or for legal reasons. I will notify you of any significant changes by posting the new policy on the Nudgely website.

2. Your Consent

By creating an account and using Nudgely, you provide your free, specific, informed, and unambiguous consent to the collection, processing, and storage of your personal data as described in this policy.

You have the right to withdraw your consent at any time. The process to withdraw consent is as simple as the process of giving it. You can do so by deleting your account through the application's "Delete Account" feature or by contacting me at the email provided above. Upon withdrawal, I will cease processing your personal data unless required to retain it by law.

3. Information I Collect (Personal Data)

I collect only the personal data that is necessary for the specific purpose of providing the Nudgely service.

a. Personal and Account Information

• Your Data: When you sign up, I collect your name, email address, and phone number.
• Recipient Data: To use the service, you will provide the names and phone numbers of the individuals you want Nudgely to call ("Recipients").
• Profile Information: You may provide preferences like timezone settings to customize the service.

b. Health and Wellness Information (Sensitive Personal Data)

The information collected during health check-in calls may be considered sensitive. I handle this data with the highest level of care.

• Wellness Responses: I collect answers given in response to automated health check-in questions.
• Medication Information: If you use medication reminders, I collect the information you provide about those medications.

c. Call and Technical Data

• Voice Recordings and Transcripts: With prior consent obtained at the start of each call, I record and transcribe the voice calls to provide and analyze the service.
• Call Metadata: I collect technical details about calls, such as time, duration, and completion status.
• Usage Data: To improve the service, I collect basic interaction data with the web application. Our services are hosted on Amazon Web Services (AWS) servers located within India.

4. How I Use Your Personal Data (Purpose of Processing)

I use your data for the following specific purposes, for which you provide consent:

• To Provide Nudgely Services: To make scheduled voice calls to your designated Recipients, monitor wellness responses, and send reminders as you configure them.
• To Report Call Details to You: A core feature of the service is to provide you, the account holder, with the details of the calls made on your behalf. This includes making call transcripts and summaries available to you through your account dashboard.
• To Communicate With You: To send service notifications (e.g., call status), manage your account, and respond to your support queries.
• For Safety and Legal Compliance: To prevent misuse of the platform and comply with applicable Indian laws and lawful government requests.

5. Data Sharing and Third-Party Processors

I do not sell your personal data. I may share it with trusted third-party service providers ("Data Processors") who are contractually obligated to protect your data and use it only for the purposes I specify.

• Twilio: Used for automating voice calls and sending SMS messages.
• OpenAI: Used for transcribing voice recordings via their API. While OpenAI is a US-based company, the processing is for the specific task of transcription as per our agreement. I take measures to ensure such transfers comply with Indian law.
• Supabase: Used for database hosting and authentication.
• Netlify: Used for hosting the Nudgely website.

I hold valid contracts with these Data Processors to ensure they adhere to data protection standards.

6. Your Rights as a Data Principal

Under the DPDPA, you have the following rights over your personal data:

• Right to Access: You can request a summary of the personal data I process.
• Right to Correction and Erasure: You can update incorrect information through your account dashboard or request correction or erasure of your data by contacting me.
• Right of Grievance Redressal: You have the right to have your grievances addressed. Please contact the Grievance Officer at the email provided.
• Right to Nominate: You can nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

7. Data Security and Retention

• Security Measures: I take reasonable security measures to protect your data, including encryption of data in transit (SSL) and at rest, and implementing access controls on our AWS servers in India.
• Data Breach Notification: In the event of a personal data breach, I will notify the Data Protection Board of India and the affected users as required by law.
• Data Retention and Deletion: I will retain your personal data only for as long as your account is active and the purpose for which it was collected is served. If you choose to delete your account using the "Delete Account" feature in the application, all your personal data will be erased immediately and permanently. I do not retain data from deleted accounts unless specifically required to do so to comply with a legal obligation.

8. Processing of Children's Data

Nudgely is not intended for use by individuals under the age of 18. I do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided me with personal data, please contact me to have it removed.

9. Grievance Redressal

For any complaints or to exercise your rights, please contact the designated Grievance Officer:

• Name: Jigyansu Rout
• Email: jigyanshu15@gmail.com

I will acknowledge and address your complaint in a timely manner. If you are not satisfied with the resolution, you have the right to file a complaint with the Data Protection Board of India.