Privacy Policy

This Privacy Policy describes how Snehamverse Private Limited (“Snehamverse”, “we”, “us”, or “our”), a company incorporated under the Companies Act, 2013 with registered office in Siddipet, Telangana, India, and operating the SnehAmverse AI brand, collects, uses, discloses, stores, and otherwise processes personal data. This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000, together with the rules made thereunder.

It covers: (a) visitors to our website at https://snehamverseai.com (the “Site”); (b) patients and customers who message, on WhatsApp, a hospital, clinic, or other business that uses the SnehAmverse AI platform (the “Platform”); and (c) staff of those businesses who sign in to the SnehAmverse AI dashboard.

For messages between a business and its customers, the business decides why their personal data is used, and we process it on the business's behalf under our agreement with them. Each business is responsible for having the right to contact its customers, including their consent where the law requires it.

Website. We collect only: (a) contact information you provide voluntarily when you write to us at snehamverse917@gmail.com; (b) standard technical Site usage data (IP address, browser type, referring URL, timestamps) logged by our infrastructure providers to deliver the Site and prevent abuse; and (c) strictly-necessary cookies set by the underlying hosting infrastructure. We do not knowingly collect any sensitive personal data or information through the Site.

Platform. When a person messages a business that uses the Platform, we process: (a) their WhatsApp phone number and profile name, received from WhatsApp (Meta); (b) the text of messages to and from the business, and when they were sent; (c) message status from WhatsApp (sent, delivered, read, or failed); (d) appointment details, such as the patient's name, chosen doctor, date and time, and the reason for the visit; (e) payment status and amount from our payment provider (we never see card or bank details); (f) reports, such as lab or scan results, that a hospital chooses to send; (g) campaign contact lists uploaded by a business, containing names and phone numbers of customers who agreed to hear from it; and (h) the name, email address, and sign-in activity of the business's staff who use the dashboard.

Some Platform data, such as symptoms and medical reports, is health information. We treat it with extra care and use it only to provide the service the hospital has asked for.

On the Platform, we use personal data only to provide the service each business has asked for: to reply to messages and answer common questions; to book, confirm, and remind people about appointments, and to take payment where the business requires it; to send reports and updates the business chooses to share; to send campaign messages that the business has approved, only to contacts who agreed to receive them, and to show the business who received and read them; to show conversations to the business's authorised staff; and to keep the service secure, fix problems, and prevent misuse.

On the Site, we use personal data only to respond to enquiries you initiate, to provide and improve the Site, to comply with legal and regulatory obligations, and to protect our rights and the safety of our users.

We do not sell personal data, use it for our own advertising, or contact a business's customers for our own purposes.

For Platform data, the business relies on the consent of its customers, or on another lawful ground under the DPDP Act, and we process the data on the business's behalf.

For Site visitors and people who write to us, we process personal data under Section 4 of the DPDP Act on the basis of the consent you provide when you contact us or interact with the Site, and, where applicable, on the basis of “legitimate uses” under Section 7 of the DPDP Act, including responding to communications you have initiated and complying with law.

We do not sell, rent, or trade personal data. We share it only with service providers that make the Site and Platform work, and only what each needs: Meta Platforms (the WhatsApp Business Platform), to send and receive WhatsApp messages and delivery notices; Supabase, Railway, Vercel, and Upstash, to host the Site and Platform and store their data; Anthropic and OpenAI, to understand messages and write helpful replies, processing message text for that purpose only; Razorpay, to collect appointment payments where a business uses it; and Clerk, to manage secure dashboard sign-ins. These providers are bound by their published terms and data-protection commitments.

We may also disclose personal data to legal or regulatory authorities when required by law, and, in the event of a merger, acquisition, or reorganisation, as part of that transaction with appropriate safeguards.

Platform. Messages, appointment records, reports, and campaign lists and results are kept while the business uses the Platform, unless the business asks us to delete them sooner. When a business stops using the Platform, we delete its data within ninety (90) days, unless a longer retention is required by law. Dashboard accounts are kept while the business uses the Platform.

Website. Email correspondence is retained for two (2) years from last contact, unless a longer retention is required by law. Server logs are retained for a maximum of ninety (90) days.

Under the DPDP Act, you have the right to access a summary of your personal data and related processing, to request correction or erasure, to withdraw consent, to nominate another individual in the event of death or incapacity, and to grievance redressal.

If you received a campaign message through the Platform, you can stop further promotional messages at any time by replying STOP, by asking the business directly, or by blocking the number in WhatsApp. For other Platform data, you may contact the business you messaged, or our Grievance Officer at the email listed in Section 11, and we will help or pass your request to that business.

We implement reasonable technical, physical, and organisational safeguards, including TLS encryption in transit, access controls, separation of each business's data so that a business can see only its own information, secure sign-in for dashboard users, and periodic reviews of our security posture. No method of transmission over the internet is entirely secure.

The Platform's main database is hosted in Mumbai, India. The Site, our application servers, WhatsApp, and our AI and other service providers may process data on servers located outside India. Any transfer of personal data outside India is undertaken in accordance with the DPDP Act.

The Site and the Platform are not directed at children under 18. Where a hospital arranges care for a child, a parent or lawful guardian provides the child's information. If we become aware that we have inadvertently collected personal data from a child without verifiable parental or lawful guardian consent, we will delete it promptly.

Venkatesh Potti, Founder and Managing Director, Snehamverse Private Limited. Email: snehamverse917@gmail.com. Address: IT Tower, Second Floor, Siddipet, Telangana, India. The Grievance Officer will acknowledge complaints within 48 hours and endeavour to resolve them within the timelines specified under applicable law.

We may update this Policy from time to time. The current version will always be posted at this URL, with the effective date updated accordingly. For material changes, we will take reasonable steps to notify you, and we will inform the businesses that use the Platform.

For any questions about this Policy or our processing of personal data, write to us at snehamverse917@gmail.com.