Varolyn Healthcare ("Varolyn", "we", "us") provides home-healthcare services across Bangalore, with select support elsewhere in India. We respect your privacy and handle your personal and health information with care. This policy explains what we collect, why, how we protect it, and your rights. We collect the minimum we need, keep it in India, encrypt it, and delete it when its purpose is over.
1 Information we collect
| When | What | Why |
|---|---|---|
| Enquiry / Contact form | Name, phone, email (optional), city, service needed, message | To call you back & arrange care |
| Phone (OTP) verification | Mobile number & one‑time code | To confirm it's really you |
| Appointment booking | Name, phone, date/time, service | To schedule a visit (via Zoho) |
| Career application | Name, contact, role, résumé, experience | Recruitment |
| Live chat | What you type, basic device info | To answer your questions |
| BMI calculator | Age, gender, height, weight | Shown on screen only — never sent to us |
| Every visit (automatic) | IP address, browser, pages viewed | Security & basic analytics |
2 What we do not collect
- No card, bank or UPI details on this website — payments go through a secure gateway; we do not store full card numbers on this website; payments are handled through a secure third-party payment gateway.
- No medical records, prescriptions or diagnoses through the public site.
- No Your BMI inputs (age, gender, height, weight) are calculated on your device and are not sent to or stored on our servers; they are shown on screen only.
- No We do not sell or rent your personal data to advertisers. If our practices ever change, we will update this policy and seek your consent where the law requires it.
- No hidden tracking beyond what's needed for security and basic analytics.
3 How we use your information
Only for the purpose you gave it: to respond to enquiries, schedule and deliver home‑healthcare services, verify your phone, process job applications, support you over chat, and keep the site secure. We We store your information using appropriate technical and organisational safeguards within our protected systems and CRM. so our care team can follow up and serve you. We do not use your data for unrelated purposes without asking you first.
4 How we protect it
In transit & at rest
All connections use HTTPS/TLS encryption. Your data is stored with encryption at rest in our secured systems and CRM, hosted on Indian infrastructure. Passwords and one‑time codes are hashed, never stored in plain text; codes expire within minutes.
Hardened systems
- Our servers sit behind a security layer (Cloudflare) that hides the server and blocks attacks; no public ports are left open.
- Input validation on every field and a strict content‑security policy block the kind of injection that compromises websites.
- Rate‑limiting on forms (and especially OTP) stops spam and abuse; uploaded résumés are type/size‑checked and never executed.
Access control
Only authorised Varolyn staff can access your data, behind strong login + multi‑factor authentication, on a need‑to‑know basis, with activity logs.
5 Who we share it with
We never sell your data. We share it only with trusted service providers who help us run the service, under confidentiality obligations:
- Cloud hosting & database (Indian region) — to store data securely.
- Our CRM — so our care team can follow up with you.
- SMS/OTP provider — to send your verification code (sees your number).
- Zoho — forms & appointment booking.
- Live‑chat provider — to power chat support.
- Cloudflare — security & delivery (sees IP/metadata).
- Google (speech‑to‑text) — only if you agree to a transcript in a verification video session, and only in Chrome or Edge. Your browser sends the audio directly; we never receive it. This processing takes place outside India.
- Our video relay (India) — carries encrypted call data when a direct connection between the two devices is not possible. It cannot read what it carries.
We may also disclose information if required by law or a valid legal/court order.
6 How long we keep it
- Enquiry/contact leads: up to 12 months after last contact, then deleted.
- Appointment & service records: as needed to provide care and meet legal requirements.
- Career applications: 6 months (unless you're hired or agree we keep them on file).
- OTP codes: minutes (auto‑expire). Security logs: 30–90 days. BMI inputs: not retained.
7 Verification video sessions (verify.varolyn.com)
Before you confirm a booking, we can arrange a short video session so you can see and speak with the caregiver assigned to you, and view their verified qualifications. This runs on a separate system at verify.varolyn.com.
You are asked to agree to each purpose separately, and three of them are optional. Declining an optional one does not affect your consultation in any way.
| Purpose | Required? | What it means |
|---|---|---|
| Running your consultation | Required | Without it there is no session |
| Showing the caregiver's qualifications | Required | The point of the session |
| Sending you your session link and reminders | Required | How you receive the link |
| Recording how you use the session | Optional | Which buttons you open, how long you stay |
| Recording your precise location | Optional | Your browser will also ask separately; you can refuse either |
| Making a written transcript | Optional | Both you and the caregiver must agree, and either can stop it at any time |
The video and audio of your consultation are never recorded. They travel directly between your device and the caregiver's, encrypted. Where a direct connection is not possible — common on mobile networks — the encrypted data passes through a relay server we operate in India. That relay forwards the data without being able to read it.
The caregiver's personal contact details are never shown to you, and yours are never shown to them. Communication stays within this system.
If you agree to a written transcript, please read this
The speech‑to‑text is performed by your own web browser, not by us.
- In Google Chrome and Microsoft Edge, your browser sends your microphone audio to Google's speech service to convert it into text. This means your voice leaves your device and is processed outside India. Varolyn never receives or stores the audio itself — only the text your browser returns to us.
- In Safari, speech is processed on your device and no audio is sent anywhere.
- Firefox cannot do this at all, so no spoken transcript will be made.
Protecting the caregiver's certificates
While you view a caregiver's qualifications, the system watches for signs that the screen is being photographed and will cover the certificate if it sees them. This is done entirely on your own device — no image, photograph or video frame of you is ever sent to us or stored. Your call is not interrupted, and you can ask for the certificate to be shown again.
How long we keep session information
| Information | Kept for |
|---|---|
| Written transcripts | 90 days, then the text is deleted |
| Precise location, if you shared it | 90 days |
| How you used the session | 12 months |
| Device and network details (including IP address) | 12 months |
| Session records (who met whom, when) | 24 months, then anonymised |
| Consent records | For the length of our relationship, plus 7 years |
| Security audit records | 7 years, with your identity removed if you ask us to erase your data |
8 Your rights
Under the DPDP Act, 2023 you can ask us to:
- Access the personal data we hold about you;
- Correct or update it;
- Erase it (where we're not legally required to keep it);
- Withdraw consent at any time;
- Nominate someone to act on your behalf;
- Raise a grievance about how we handle your data.
- Ask for a copy of everything we hold about you from a verification session, including any transcript you took part in.
To exercise any right, email us at [email protected] and we will respond within the timeframe required by applicable law and as soon as reasonably practicable.
9 Cookies
We use a few essential cookies to keep the site working and secure. Non‑essential cookies (basic analytics) are used only if you accept them in our cookie banner. You can decline non‑essential cookies and still use the site fully.
10 Children
Our website is intended for adults arranging care. We do not knowingly collect data from children without verifiable parental/guardian consent. If a guardian arranges care for a dependent, they are responsible for the consent to share that information with us.
11 Contact & grievances
For any privacy question, request, or grievance, contact our Grievance Officer:
Grievance Officer: Varolyn Support Team
Email: [email protected]
Phone: +91 97754 55577
Varolyn Healthcare, Bangalore, India
If you have any concern about how we handle your personal data — including a request to see it, correct it, or have it erased — write to us at the address above. We will respond within 30 days.
You can also raise a complaint directly at verify.varolyn.com/grievance.html, which gives you a reference number and a response date, and tracks it until it is resolved.
12 Changes to this policy
We may update this policy as our services or the law evolve. The "Last updated" date at the top shows the latest version. Significant changes will be highlighted on this page.