Privacy Policy
1. Who We Are
Peakwell Health Services Pvt. Ltd., trading as PeakAge ("we", "us", "our"), provides a health assurance and care coordination service for elderly parents living in India. Our mobile application ("App") is used by family sponsors to monitor their parents' health and schedule care services on their behalf.
For privacy-related queries, contact us at: omanshu@peakage.in
2. Scope of This Policy
This policy applies to:
- The PeakAge app for families, on Android and iPhone
- The PeakCare app for PeakAge care staff, on Android and iPhone
- The PeakAge website at peakage.in
- Any care coordination services delivered through our platform
It covers every person whose data we process:
| Person | Who They Are |
|---|---|
| Sponsor | The adult child who creates and manages the account |
| Beneficiary | The elderly parent being cared for |
| Care Staff | PeakAge employees and partner professionals (including nurses, doctors, companion workers, and physiotherapists) who access the platform to deliver care services |
| Platform Administrators | PeakAge administrative staff who manage the platform, onboard new sponsors, and oversee service quality |
All categories of platform users are subject to this policy. Care staff and platform administrators access personal data only to the extent necessary for their specific role, as described in Section 6.
3. Data We Collect
3.1 Account and Identity Data
| Sponsor's name, email address | Account creation and login |
| Sponsor's phone number | Service communication |
3.2 Beneficiary (Parent) Profile Data
| Full name, age, relation to sponsor | Profile identification |
| Home address, city | Dispatching on-ground care coordinators |
| Primary medical condition (e.g. hypertension, diabetes) | Tailoring care plans |
| Blood group | Emergency reference |
| Emergency contact details (neighbour, local doctor) | Crisis response |
| Caretaker / health buddy name and phone | Care coordination |
3.3 Health and Vitals Data
| Heart rate (bpm) | Real-time health monitoring |
| Blood oxygen saturation (SpO2 %) | Real-time health monitoring |
| Blood pressure (systolic / diastolic mmHg) | Real-time health monitoring |
| Blood sugar (mg/dL, fasting / post-meal flag) | Diabetes management |
| Body temperature (°F) | Illness detection |
| ECG result and wave data | Cardiac monitoring |
| Mood, sleep quality, activity level, medication adherence | Holistic health tracking |
3.4 Body Composition Data (Fitness Vitals)
Collected from third-party smart weighing scales used by our health coordinators during home visits: Weight, BMI, body fat %, skeletal muscle %, visceral fat level, bone mass, lean body mass, body hydration, metabolic age, basal metabolic rate (BMR), and related composition metrics.
3.5 Clinical Health Check Records
During each nurse home visit, our coordinators record a structured clinical summary including: overall health assessment, severity rating, number of vitals checked, medicines reviewed, symptoms assessed, days since the last visit, and the date the next visit is due. These records are authored by our nurses and reviewed by assigned doctors. They constitute clinical assessments and are treated with the same sensitivity as raw vitals data.
3.6 Service and Scheduling Data
| Service type requested (health check, doctor, companion, physiotherapy) | Booking and dispatch |
| Scheduled appointment time and slot | Coordination |
| Provider name assigned to the visit | Tracking and accountability |
3.7 Coordinator and Doctor Updates
Written notes and visit summaries authored by our on-ground coordinators and partner doctors, describing the parent's health, activities, and wellbeing. Coordinators write these notes following home visits; doctors may write post-consultation notes following teleconsultations. These updates are visible to the Sponsor in their App dashboard.
3.8 Consent Records
When a Sponsor gives consent to data collection, we record: the consent version accepted, whether each consent item was explicitly accepted, the timestamp of consent, and a device hint (device type and OS version at the time of consent). This record is retained to demonstrate lawful consent under the DPDPA 2023.
3.9 Technical Data
| Device type, OS version | Compatibility and bug resolution |
| App session logs | Diagnosing crashes and errors |
| Authentication tokens (JWT, refresh token, expiry) | Secure session management |
| Push notification token (a code for your phone or browser) | Sending you visit, emergency and plan notifications; removed when you sign out or delete your account |
Authentication tokens are stored locally on the device and expire after one hour. They are refreshed automatically and cleared from the device when the user logs out.
3.10 Care Team Applications (PeakCare app and peakage.in/apply)
Anyone can apply to join the PeakAge care team, on peakage.in/apply or by signing up in the PeakCare app with Google, Apple or an email and password. When you apply we collect:
| Name, email, mobile (WhatsApp) number, how you signed up | Your account, and contacting you about your application |
| City and locality | Sending your application to the right city coordinator |
| Date of birth, gender, occupation, highest qualification, languages | Checking you are old enough and suited to the families near you |
| Two-wheeler, experience with elderly people, days and hours free, why you want to join, how you heard of us | Deciding whether to take your application forward and matching you with families |
| The role you apply for, and when you accepted our Terms and this Privacy Policy | Recording your application and your consent |
Only the coordinator for your city and PeakAge administrators can read your application. We do not share it with anyone outside PeakAge. Until a coordinator approves you, a PeakCare applicant account can see only its own application's status. You can delete your account and your application at any time in the PeakCare app ("Delete my account") or at peakage.in/delete-account; the account closes at once and everything is deleted within 7 days.
Care staff location (PeakCare app): when a nurse, doctor or companion raises an SOS in PeakCare, the app reads their phone's location once and shares it with their city coordinators so help can reach them. A staff member can also save their base location on the Me tab, which reads the phone's location once at that moment. PeakCare does not read or track location at any other time.
We do not collect: camera or microphone input · contacts from your device's address book · any data from children under 18.
4. Legal Basis for Processing
Consent: We obtain explicit, versioned consent from the Sponsor before adding a Beneficiary profile and before collecting any health data. Consent is recorded with a version number; if we materially update our data practices, we will seek fresh consent before continuing to process data under the new terms. Consent can be withdrawn at any time (see Section 9).
Contractual necessity: Processing is required to deliver the care assurance service the Sponsor has subscribed to.
Vital interests: In a medical emergency, we may use contact and location data to dispatch assistance even without an in-moment consent interaction, where we believe it is necessary to protect the Beneficiary's life or safety.
Legal obligation: We retain certain records to comply with applicable Indian law, including the Information Technology Act 2000, the SPDI Rules 2011, and the Digital Personal Data Protection Act 2023 (DPDPA).
5. How We Use Your Data
- Deliver the service: display health dashboards, route care coordinator visits, track medication schedules.
- Coordinate care: share relevant health information with the assigned care team (nurses, doctors, companion workers, and physiotherapists) to the extent required to deliver the service booked.
- Record and update health data: our nurses and doctors may record new health status entries, clinical health check records, and post-consultation notes in the course of delivering care visits and consultations.
- Send alerts: notify the Sponsor of significant changes in vitals, missed medications, or overdue health checks.
- Manage the platform: platform administrators use account and service data to onboard new sponsors, manage staff assignments, and ensure service quality. Administrators may also update Beneficiary records, service request data, and quota usage in the course of platform operations.
- Improve our service: aggregate, anonymised analytics to identify patterns in care quality. No individual's data is used for advertising or sold to third parties.
- Comply with law: respond to lawful government or court requests.
6. Who We Share Data With
| Recipient | What They Receive | Why |
|---|---|---|
| On-ground nurses (PeakAge employees) | Beneficiary profile, health vitals, clinical health check records (read and write access around a visit they are assigned to) | Recording and updating health status during visits |
| Partner doctors | Vitals, health history, clinical records, appointment data (read and write access around a consultation they are assigned to) | Teleconsultation, post-consultation notes, and health record updates |
| Partner physiotherapists | Appointment details and relevant condition | Session delivery |
| Companion workers | The parent's name, address and contact details, and booking details, around a visit they are assigned to | Service delivery and slot management |
| City coordinators (PeakAge staff) | Family, beneficiary and booking data for families in their city | Assigning visits, emergencies, and care coordination |
| PeakAge platform administrators (super-users) | All family, beneficiary, and health data across the platform | Platform management, sponsor onboarding, staff assignment, beneficiary record management, and quality oversight |
| Supabase (infrastructure provider) | Encrypted data stored on their servers | Database hosting |
| Razorpay (payment processor) | Amount, your name, email and phone, and the payment method you choose (card, UPI or bank details are entered with Razorpay, not stored by us) | Taking payments and autopay |
| Ola Maps (maps provider) | The address you search for and the map pin you place | Address search and showing the map |
| Google Firebase, Apple Push Notification service and Expo (notification delivery) | Your device's notification token and the text of the notification | Delivering notifications to your phone (Firebase on Android, Apple on iPhone) |
| Google and Apple (sign-in) | Only if you choose to sign in with them: they confirm your identity and share your name and email with us | Signing in |
| Discord (internal staff alerts) | Sponsor name, phone and city, and what was requested | Alerting our team to new requests, payments and account changes |
| No advertising networks | N/A | We do not run ads |
| No data brokers | N/A | We do not sell data |
All internal staff and third-party service providers are bound by confidentiality obligations and data processing agreements that prohibit them from using your data for any purpose other than delivering services to PeakAge.
7. Data Storage and Security
Where data is stored: Supabase-managed PostgreSQL databases hosted on cloud infrastructure.
Security measures in place:
- All data in transit is encrypted using TLS 1.2 or higher
- All API calls require a valid JWT access token; tokens expire after one hour and are refreshed automatically
- Free-text fields are sanitised before storage (HTML/script injection prevention)
- Role-Based Access Control (RBAC) enforced through Row-Level Security (RLS) policies in Supabase: sponsors can only access their own family's data; nurses, doctors and companions can access a family's data only around a visit they are assigned to; city coordinators can access families in their own city; platform administrators access data only for operational purposes
- All platform users (sponsors, nurses, doctors, companion workers, administrators) are authenticated individually and their access is logged
- Local device cache stores data only for the currently logged-in account; logging in as a different user clears the previous user's locally cached data from the device
Retention:
| Data Category | Retention Period |
|---|---|
| Active account and profile data | Duration of subscription plus 12 months |
| Health vitals and body composition data | Duration of subscription plus 12 months, then anonymised within 30 days of account deletion |
| Clinical health check records | Duration of subscription plus 12 months, then anonymised within 30 days of account deletion |
| Service and booking history | Duration of subscription plus 12 months, then deleted within 30 days of account deletion |
| Coordinator and doctor update notes | Duration of subscription plus 12 months, then anonymised within 30 days of account deletion |
| Consent records | 5 years from date of consent (legal compliance) |
| Identifiable profile data (name, address, contact) | Deleted within 7 days of confirmed account deletion request |
| Anonymised, aggregated data | May be retained indefinitely for service improvement |
8. Your Rights (DPDPA 2023 and SPDI Rules 2011)
As a data principal under Indian law, you have the right to:
| Right | How to Exercise It |
|---|---|
| Access: obtain a summary of personal data we hold about you | Email omanshu@peakage.in |
| Correction: correct inaccurate or incomplete data | Edit directly in the App, or email us |
| Erasure: request deletion of your account and data | In the App: Profile, then Delete account. Or see peakage.in/delete-account. Your login is closed at once and your data deleted within 7 days; payment records are kept, without your name, as tax law requires |
| Grievance redressal: raise a complaint with our Data Protection Officer | See Section 11 |
| Nominate: designate someone to exercise your rights in the event of death or incapacity | Email omanshu@peakage.in |
| Withdraw consent: stop data collection at any time | This will result in account deactivation as the service cannot be delivered without the data |
We will respond to all verifiable requests within 30 days.
9. Withdrawing Consent
You may withdraw consent at any time by:
- Emailing omanshu@peakage.in with the subject line "Withdraw Consent"
- Contacting us at the number or address in Section 11
Withdrawal of consent means we can no longer provide the health monitoring or care coordination service. It does not affect the lawfulness of processing carried out before the withdrawal.
If we make a material change to this policy or to our data practices, we will notify you at least 14 days in advance and ask for fresh consent before the change takes effect. Continuing to use the App after the effective date without withdrawing consent constitutes acceptance of the updated terms.
10. Children's Data
Our service is designed for adult Sponsors (18+) managing care for elderly Beneficiaries (typically 55+). We do not knowingly collect data from anyone under 18. If you believe a minor's data has been submitted in error, please contact us immediately at omanshu@peakage.in.
11. Contact and Grievance Officer
We are required under the DPDPA to acknowledge your grievance within 48 hours and resolve it within 30 days.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDPA 2023.
12. Changes to This Policy
We will notify active users via the App and via email at least 14 days before any material change to this policy takes effect. Where the change affects how we use health or sensitive personal data, we will seek fresh consent before the change applies to your data.
Minor clarifications (correcting typos, adding examples) will be posted without advance notice; the "Last updated" date at the top of this document will always reflect the current version.
13. Governing Law
This policy is governed by the laws of India, including the Information Technology Act 2000, the SPDI Rules 2011, and the Digital Personal Data Protection Act 2023. Any disputes shall be subject to the jurisdiction of courts in India.