Privacy policy

This policy explains how ProHeal Tech ("we", "us"), which operates Labloom at labloom.co.in, collects, uses and protects your personal data, including health data, in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and other applicable law. Under the DPDP Act we are the Data Fiduciary for the data described here.

1. Data we collect

• Account data: name, email address, password (stored hashed by our authentication provider), age and gender.
• Profile data you choose to add: phone number, city, a short bio and your health goals.
• Health data: lab reports you upload, the values extracted from them, results from tests booked through Labloom, and data from wearables you connect (for example sleep, recovery and heart rate).
• Booking data: collection address, location coordinates, phone number and time slot, needed to book a home sample collection.
• Payment data: payments are processed by Razorpay. We receive the payment status and transaction IDs; we never see or store your full card, UPI or bank details.
• Usage data: if you allow analytics cookies, Google Analytics collects pages visited, device and browser type and approximate location.
• Communications: messages you send us and questions you ask the AI assistant.

2. Why we use it

We process your personal data only for the purposes below, on the basis of your consent or for legitimate uses permitted by the DPDP Act:

• to create and run your account and membership;
• to read your lab reports, show your results and trends, and generate explanations and suggestions;
• to book and manage sample collections with our partner laboratory;
• to take payments, issue refunds and keep the records required by law;
• to answer your questions and send service messages (for example a result is ready);
• with your consent, to understand site usage and improve Labloom.

We do not sell your data, and we never use your health data for advertising.

3. Who we share it with

We share only what each provider needs to deliver the service, under contracts that require them to protect it:

• Supabase: database, file storage and sign-in.
• Redcliffe Labs (our partner laboratory): your name, contact details, address and selected tests when you book a collection.
• Razorpay: payment processing.
• OpenAI: when you use the AI assistant, your question and the relevant results are sent to generate an answer. They are not used to train OpenAI's models.
• Our report-reading service (hosted on Render): the PDF you upload, to extract the values.
• Resend: sending emails.
• Google Analytics: only if you accept analytics cookies.
• WHOOP and other wearables: only if you connect them.

We may also disclose data where required by law or by a court or government authority.

Some of these providers process data outside India. We transfer data abroad only to countries not restricted by the Government of India under the DPDP Act.

4. How long we keep it

We keep your data while your account is active. If you delete your account or withdraw consent, we delete your personal data within 30 days, except records we must keep by law (for example payment and tax records), which are kept only for the period the law requires.

5. Your rights

Under the DPDP Act you can:

• access a summary of the personal data we hold and how we process it;
• correct, complete or update your data (most of it directly in Settings);
• erase your data (Settings → Data & Storage, or by writing to us);
• withdraw consent at any time, as easily as you gave it. Processing done before withdrawal remains lawful;
• nominate another person to exercise your rights if you die or become incapacitated;
• raise a grievance with us, and if you're not satisfied, complain to the Data Protection Board of India.

To exercise any right, email hello@labloom.co.in. We will respond within the time required by law.

6. Children

Labloom is for adults aged 18 and over. We do not knowingly process data of children without verifiable consent from a parent or lawful guardian.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider, and access is restricted so that each user can only read their own records. No system is completely secure; if a breach affects your data we will inform you and the Data Protection Board as the law requires.

8. Cookies

We use essential cookies and local storage to keep you signed in and remember preferences such as dark mode. Analytics cookies (Google Analytics) are set only if you accept them. You can change your choice at any time from "Cookie settings" in the footer.

9. Grievance Officer and contact

Grievance Officer, ProHeal Tech
#749, BTM Layout, 14th Main, 2nd Stage, Bengaluru, Karnataka 560076, India
Email: hello@labloom.co.in

10. Changes

If we change this policy we will update the date above and, for significant changes, notify you by email or in the app before they take effect.