Data Policy
Last updated: 1 April 2025 · DPDP Act 2023 · GDPR · HIPAA · UAE PDPL · Singapore PDPA · Thailand PDPA · Oman PDPL
1. Data Controller
FertilityConnect India Private Limited is the Data Controller / Data Fiduciary for personal data processed through this Platform.
Where FertilityConnect processes personal data on behalf of clinics (e.g. appointment data passed to a clinic), we act as a Data Processor under GDPR / DPDP Act, and the clinic is the Data Controller / Data Fiduciary for that data. A Data Processing Agreement (DPA) governs this relationship.
2. Data We Collect
We collect the minimum data necessary for our services (data minimisation principle — GDPR Art. 5(1)(c), DPDP S.6).
| Category | Examples | Legal Basis | Retention |
|---|---|---|---|
| Identity Data | Name, email address, phone number, date of birth | Consent (Art. 6(1)(a) GDPR / DPDP S.5) | 3 years from last login or account deletion |
| Health & Fertility DataSensitive | Assessment responses, medical history, diagnosis, treatment history, AMH levels, menstrual data, sperm parameters | Explicit consent (Art. 9(2)(a) GDPR / DPDP S.9 / HIPAA authorisation) | 3 years from collection or consent withdrawal |
| Location Data | City, state, country, approximate GPS (for clinic distance matching) | Consent / Legitimate interest (clinic matching) | Duration of session; city/state stored with account |
| Usage & Technical Data | IP address (pseudonymised), browser type, pages visited, session duration | Legitimate interest (security, analytics) / Consent for non-essential analytics | 13 months (analytics); 90 days (security logs) |
| Booking & Transaction Data | Appointment dates, clinic selected, payment reference (no card data stored) | Contract performance | 7 years (financial records per Companies Act) |
| Communications | Support emails, chat transcripts, feedback submitted | Legitimate interest / Contract performance | 2 years |
3. Health Data — Special Category Processing
Health data receives the highest level of protection under all applicable laws.
🇮🇳 DPDP Act 2023 (India): Sensitive personal data — processed only under explicit consent; special obligations on Data Fiduciary
🇪🇺 GDPR (EU/UK) Art. 9: Special category data — requires explicit consent under Art. 9(2)(a); additional safeguards mandatory
🇺🇸 HIPAA (US): Protected Health Information (PHI) equivalent — HIPAA-standard encryption, access controls, audit trails
🇦🇪 UAE PDPL 2021: Sensitive data — processing requires express consent; health data of residents protected
🇸🇬 Singapore PDPA: Deemed sensitive — enhanced security and access controls required
🇹🇭 Thailand PDPA 2019: Sensitive personal data — explicit consent required; Data Protection Impact Assessment mandatory
Your health data from the fertility assessment is used solely for: (a) generating personalised clinic recommendations; (b) facilitating clinic bookings you initiate; and (c) improving our matching algorithm in anonymised/aggregated form only. We never sell health data. We never share identifiable health data with third parties for advertising purposes.
Pseudonymisation: IP addresses are hashed (SHA-256) before storage. Assessment data is linked to a pseudonymous user ID rather than directly to your name or email.
Consent withdrawal: You may withdraw your consent to health data processing at any time by deleting your account or emailing privacy@fertilityconnect.in. Withdrawal does not affect the lawfulness of processing before withdrawal.
4. How We Use Your Data
We process your data for the following specific, explicit, and legitimate purposes:
- Clinic matching: Match your assessment profile against verified clinics using our scoring engine. Health data is the primary input.(Explicit consent)
- Appointment facilitation: Pass booking details to your selected clinic.(Contract performance)
- Platform communications: Send appointment confirmations, assessment results, and essential service communications.(Contract performance)
- Safety and fraud prevention: Detect and prevent fraudulent activity, abuse, and security incidents.(Legitimate interest)
- Legal compliance: Respond to court orders, regulatory requests, or legal obligations.(Legal obligation)
- Service improvement: Analyse anonymised/aggregated usage patterns to improve matching accuracy.(Legitimate interest)
- Marketing (optional): Send fertility education content and platform updates — only with your separate opt-in consent, which you can withdraw at any time.(Consent (withdrawable))
We do not: sell personal data; use health data for advertising targeting; share identifiable health data with employers, insurers, or government agencies except where legally required; or use data for purposes materially different from those above without renewed consent.
6. Storage, Security & Technical Measures
We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure:
256-bit AES encryption at rest
All health data encrypted in database
TLS 1.3 in transit
All data in transit encrypted end-to-end
SHA-256 pseudonymisation
IP addresses hashed before any storage
Role-based access control
Only authorised staff can access identifiable data
Audit logging
All access to health data is logged (HIPAA § 164.312)
Vulnerability scanning
Regular penetration testing and security audits
Data minimisation
Only minimum necessary data collected per GDPR Art. 5
Incident response plan
Breach notification within 72h (GDPR) / 60 days (DPDP)
Data breach notification: In the event of a personal data breach, we will notify affected users and relevant supervisory authorities within the timeframes required by applicable law: 72 hours under GDPR/UK GDPR; as soon as practicable under DPDP Act 2023; 60 days under HIPAA Breach Notification Rule; 72 hours under UAE PDPL.
7. International Data Transfers
Your data is primarily stored in India. Where data is transferred to or accessed from outside India, we ensure appropriate safeguards are in place:
- EU/UK transfers: Standard Contractual Clauses (SCCs) under GDPR Art. 46 / UK International Data Transfer Agreements
- India outbound: Compliant with DPDP Act 2023 and any cross-border data transfer restrictions notified by the Indian government
- HIPAA transfers: Business Associate Agreements (BAAs) in place with all US-related processors
- UAE: Data relating to UAE residents is not transferred to jurisdictions lacking adequate protection under UAE PDPL 2021
We do not transfer personal data to countries or territories that have been designated as inadequate or restricted by applicable regulatory authorities in your jurisdiction.
8. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. When retention periods expire, data is securely deleted or irreversibly anonymised.
Key retention periods: Health assessment data — 3 years from collection or consent withdrawal. Account data — 3 years from last active use. Booking records — 7 years (statutory financial records). Security logs — 90 days. Marketing consent records — Until withdrawal plus 3 years (legal proof).
Right to erasure: You may request earlier deletion at any time. We will erase your data within 30 days except where retention is legally required (e.g. fraud investigation records, tax records, HIPAA 6-year retention requirement).
9. Your Rights by Jurisdiction
Depending on your jurisdiction, you have the following rights regarding your personal data. To exercise any of these rights, contact privacy@fertilityconnect.in:
| Law | Rights | Response Deadline |
|---|---|---|
| GDPR (EU/UK) | Access, Rectification, Erasure, Restriction, Portability, Object, Not subject to automated decisions | 30 days |
| DPDP Act 2023 (India) | Access (S.11), Correction & Erasure (S.12), Grievance redressal (S.13), Nomination (S.14), Withdraw consent | 30 days |
| HIPAA (US) | Access, Amendment, Accounting of disclosures, Restriction requests, Confidential communications | 30–60 days |
| UAE PDPL (2021) | Access, Rectification, Erasure, Object to processing | 30 days |
| Singapore PDPA (2012) | Access, Correction | 30 days |
| Thailand PDPA (2019) | Access, Data portability, Erasure, Object, Restrict processing, Withdraw consent | 30 days |
| Oman PDPL (2022) | Access, Rectification, Erasure, Object | 30 days |
10. Children's Data
FertilityConnect is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18.
DPDP Act 2023 (India) S.9: Processing of personal data of children (under 18) requires verifiable parental consent. We implement age-gating mechanisms to prevent minor registration.
GDPR (EU/UK): We do not process personal data of children under 13 (or 16 in some Member States) without verifiable parental consent.
COPPA (US): We do not knowingly collect personal information from children under 13.
If we become aware that we have inadvertently collected personal data from a minor, we will delete it immediately. Parents or guardians who believe their child's data has been collected should contact privacy@fertilityconnect.in.
11. Automated Decision-Making
The FertilityConnect clinic matching engine uses automated processing to generate clinic recommendations from your assessment data. Under GDPR Art. 22, you have the right to request human review of any automated decision that significantly affects you.
The matching score is an informational recommendation only — it does not make or influence medical decisions, deny you access to care, or produce legal effects. You are free to disregard the recommendation and contact any clinic directly.
Under the DPDP Act 2023, we ensure that automated processing of sensitive personal data does not result in unjust outcomes, and we provide a mechanism for users to raise concerns about automated recommendations.
12. Contact Our Data Protection Officer
Raise a Data Request or Complaint
DPO Email: privacy@fertilityconnect.in
Grievance Officer (India — DPDP S.13): grievance@fertilityconnect.in
Response time: 30 days for all requests; 7 days for urgent security matters
EU/UK users may also complain to their national supervisory authority (e.g. ICO in the UK: ico.org.uk)