Privacy Policy & Google Play Data Safety Disclosures

1. Overview and Core Privacy Commitment

Ayuhand ("we," "our," or "us"), operated by Ayuhand Health Tech Pvt. Ltd., is built on the foundational guarantee that your health records belong solely to you. Our business model does not rely on advertising, selling patient health insights, or training generative artificial intelligence models on identifiable personal health records.

Ayuhand operates as an offline-first patient vault. All core features (viewing, organizing, categorizing, and exporting records) operate directly on your physical mobile device. Cloud synchronization is strictly an optional backup feature requiring your explicit, informed consent.

2. Google Play Data Safety Disclosures

In compliance with Google Play Store's Data Safety section requirements, the table below provides an exact breakdown of data types collected, purposes, and sharing practices:

3. On-Device Storage & Security Standards

When you save a document in Ayuhand:

• Your documents are stored in application-sandboxed directories protected by Android file-based encryption (FBE).
• Sensitive keys and patient session tokens are secured via Android Keystore and flutter_secure_storage.
• No unencrypted plain-text copies are placed in publicly indexable media folders.

4. Cloud Backup (Optional) & Sync Principles

Cloud backup is disabled by default until you explicitly toggle or approve cloud sync. If you enable cloud backup:

• Data in transit is encrypted using TLS 1.3 with forward secrecy.
• Data at rest in our cloud vault is encrypted with AES-256.
• Syncing is idempotent and strictly partitioned by tenant ID (X-Tenant-ID: ayuhand).
• Declining cloud backup never restricts or disables any local document capture, viewing, filtering, or PDF export features.

5. Patient-Controlled Clinician Sharing (Doctor QR Pass)

Ayuhand provides a selective Doctor QR Pass to assist hospital consultations:

• A QR code alone is never permanent authorization.
• Scanning the QR code triggers an ephemeral, read-only session that expires automatically after 30 minutes.
• Clinicians cannot download, edit, or overwrite your original records unless you explicitly authorize a PDF export.
• Every scan generates an immutable local access entry in your device audit log.

6. Mandatory Account Deletion & Data Erasure Rights

In compliance with the Google Play Store Account Deletion policy, every user possesses an absolute right to permanently delete their account and associated data:

• In-App Deletion: Tap Profile > Settings > Delete Account to permanently wipe your on-device SQLite database and secure credentials immediately.
• Web Deletion Portal: If you have uninstalled the application, you can submit an instant deletion request on our public portal at ayuhand.org/delete-account. All cloud backups, phone identifiers, and family namespaces are completely purged within 48 hours.

7. Permissions Justification (Android OS)

• Camera (android.permission.CAMERA): Required solely to take live photos of paper OPD books, clinic slips, and lab reports during batch scanning. Camera streams are processed entirely on-device and never streamed to remote servers.
• Read External Storage / Media Picker: Required solely when you choose to import an existing lab report image or PDF from your device storage.
• Internet (android.permission.INTERNET): Used exclusively to authenticate via phone OTP and synchronize encrypted backups if opted in.

8. Grievance Redressal & Contact Officer

If you have any questions, complaints, or privacy requests regarding your health records under the Nepal Personal Privacy Act or Google Play policies, please contact our Grievance Redressal Officer: