Data protection, built for Indian families.
KidsHealth360 handles children's health data with the highest standard of care. This page explains how we align our practices with India's Digital Personal Data Protection Act, 2023 (DPDP Act), where your data is stored, and the rights you have as a parent or lawful guardian.
Last updated: 2 August 2026
Your child's data stays in India.
All personal and health data processed through KidsHealth360 is stored in a managed PostgreSQL database hosted in the AWS Asia Pacific (Mumbai) region — ap-south-1. Authentication records, uploaded documents, and school/clinic records all reside on infrastructure physically located on Indian soil.
Primary database
AWS Mumbai (ap-south-1) — PostgreSQL with encryption at rest (AES-256) and in transit (TLS 1.2+).
File & document storage
Object storage in the same Mumbai region. Access is scoped per-user via row-level security.
Global content delivery
Public marketing pages (HTML/CSS/JS only — no personal data) are served through a global CDN with Indian edge locations for speed. All personal data reads/writes go directly to Mumbai.
Backups
Automated daily backups are retained within the same Indian region. No personal data is replicated to servers outside India without explicit consent.
AI insights & cross-border processing.
Some optional AI-driven features (early-care recommendations, growth insights, natural-language summaries) currently rely on third-party language models hosted outside India. Under Section 16 of the DPDP Act, transfer of personal data outside India requires either lawful basis or explicit consent.
How we handle this today:
- AI features are opt-in. Parents must give explicit, revocable consent before any child data is sent to an AI model for processing.
- We de-identify prompts where possible — names, contact details, and government IDs are stripped before the request leaves our servers.
- We are actively migrating AI workloads to India-hosted models (e.g. Sarvam AI, Ola Krutrim, and self-hosted open-source models on AWS Mumbai). Once this migration is complete, AI processing will happen entirely within India and no cross-border consent will be required.
- Parents can disable AI features at any time from Settings → Privacy inside the app. Disabling stops all future cross-border processing for your child's account.
Verifiable parental consent.
The DPDP Act treats every user under 18 as a child and requires verifiable consent from a parent or lawful guardian before processing their personal data. KidsHealth360 is built around this principle:
- A verified parent/guardian account is required to create a child profile.
- Consent is captured in clear, plain language — in English, Hindi, or Punjabi.
- We do not track children for behavioural advertising.
- We do not profile children beyond what is medically necessary.
- Consent is revocable at any time; revocation triggers data deletion within 30 days.
What you can do, any time.
Right to access
Download a full copy of your child's data from Settings → Privacy → Export.
Right to erasure
Request permanent deletion of your child's account. We complete deletion within 30 days and confirm by email.
Right to correction
Update inaccurate information directly in the app, or write to us.
Right to grievance redressal
Contact our Grievance Officer (below). We respond within 7 working days as required by the DPDP Rules.
Reach the right person, fast.
Grievance Officer & Data Protection Contact
KidsHealth360 Privacy Team
Email: privacy@kidshealth360.com
Phone: +91 78145 24624
Address: A-816 Bestech Business Towers, Sector 66, Mohali 160062, Punjab, India
If your concern is not resolved to your satisfaction, you may escalate to the Data Protection Board of India under Section 27 of the DPDP Act, 2023.