Privacy Policy
Last updated: TODO(legal) — Effective date — set to the date Legal signs this document off. Until then this page is a DRAFT and must not be presented as in force. Owner: Legal.
Draft — not yet in force. This document is awaiting legal sign-off. Sections still to be drafted are marked below.
This policy explains what personal information Uyirtham collects, why we collect it, who it is shared with, and the choices you have. It applies to the Uyirtham website and the Uyirtham customer, kitchen (vendor) and delivery-rider apps.
1. Who we are
TODO(content) — Identify the data fiduciary: registered legal entity name, registered office address and CIN/GST. Required by the DPDP Act and checked at payment-gateway onboarding. Owner: Founders / Legal.
2. Information we collect
Account details: your mobile number, which we use to sign you in with a one-time password, and your name. Delivery details: the addresses you save, including the pincode we use to work out which kitchens can serve you. Health and dietary details: if you complete the optional health questionnaire, we collect the age range, dietary preference, allergies, health goals and medical conditions you tell us about, so we can recommend suitable meal packs and hide packs that contain something you cannot eat. Order details: what you ordered, from which kitchen, when it was delivered, and any rating or support message you send us. Payment details: we do not store your card, UPI or bank details — those go directly to our payment gateway, and we keep only the transaction reference and its status. Delivery riders’ location: while an order is out for delivery we collect the location of the rider carrying it — not yours — which is what the live map in your app shows. See “Delivery riders’ location” below.
3. Your health information
The health questionnaire is optional and you can skip it, use the app without it, or change your answers at any time from your account. We use these answers for one purpose: matching you to meal packs, and filtering out packs that conflict with your stated allergies or diet. We do not sell them, and we do not share them with kitchens — a kitchen sees only what it needs to prepare and deliver your order. Uyirtham is not a medical service and nothing in the product is medical advice.
4. Delivery riders’ location
This clause is about the people who deliver your order. If you use the Uyirtham rider app, it is about you. What we collect: the rider’s device location — latitude, longitude, accuracy, and where the device reports them, heading and speed. When: only while the rider has an order that is out for delivery, and only in that window. Collection continues while the app is in the background or the screen is off, because a rider on a scooter is not looking at a phone; the app shows a permanent notification whenever it is doing so. Our servers enforce the same window — a position sent outside an active delivery is discarded, not stored. Why: so that the customer waiting for that order, the kitchen that is preparing it, and our operations desk can see where the delivery has reached. Who can see it: the customer of that delivery, only while it is out for delivery; the kitchen that sent it; and our operations team. Nobody else, and never after the delivery is closed. What we do not do: we do not use a rider’s location for advertising, we do not sell it, and we do not use it to score or rank riders. How long we keep it: the live position is a single record that is overwritten by the next update, so no history builds up from it. Separately, a reduced record of the route — a point at most every minute — is kept so that a delivery dispute can be answered, and the system deletes it after seven days. Choice: a rider can decline the location permission, or stop sharing at any time from the app, and can still receive and complete deliveries — the delivery is confirmed by the one-time code the customer gives at the door, never by location.
5. How we use your information
To create and secure your account; to show you kitchens that deliver to your area; to recommend meal packs; to take, prepare, deliver and settle your orders; to send you order updates by push notification, SMS, WhatsApp or email; and to answer your support requests.
7. Service providers
TODO(content) — Publish the processor list with each provider named, its purpose and its processing location: cloud/database host, payment gateway, SMS provider, WhatsApp provider, email provider, push-notification provider. The engineering list is known; Legal must confirm it is complete and that a DPA exists with each before it is published. Owner: Legal + Engineering.
8. How long we keep it
TODO(legal) — Retention periods per data category (account, health questionnaire, orders, payment records, support threads), and what happens on account deletion. Must reconcile the DPDP minimisation duty with the statutory retention of financial records. Owner: Legal + Finance.
9. Your rights
TODO(legal) — Access, correction, erasure, withdrawal of consent and grievance-redressal rights as they apply under the DPDP Act 2023, plus the exact mechanism and timeline for each request. Owner: Legal.
10. How we protect your information
Access to your data is enforced at the database layer: each account can read only its own records, and each kitchen only the orders placed with it. Traffic between your device and our servers is encrypted in transit. Payment credentials never reach our systems.
11. Children
TODO(legal) — Minimum age for an account and the treatment of a child’s data (the DPDP Act requires verifiable parental consent under 18). Interacts with the health questionnaire. Owner: Legal.
12. Grievance Officer
TODO(content) — Grievance Officer name, designation, email address and postal address, as required of an intermediary under the IT Rules and checked at payment-gateway onboarding. Owner: Legal / Founders.
13. Changes to this policy
TODO(legal) — How changes are notified and when they take effect. Owner: Legal.