What we collect on this website, why we collect it, who touches it, how long we keep it, and what you can ask us to do about it.
Version 1.0 · In effect from 26 September 2026 · Applies to thekinhealth.com
This website is operated by ENGICONNECT SOLUTIONS PRIVATE LIMITED, which builds Kin Health, a prevention-first family health platform. Under the Digital Personal Data Protection Act 2023 ("the DPDP Act"), we are the Data Fiduciary for the personal data described here — meaning we decide why it is collected and we are answerable for it. You are the Data Principal.
This notice covers this website only. Kin Health has not launched. There is no app, there are no accounts, and no health records exist. Everything below concerns the three interest forms on this site and the ordinary running of the site itself. When the app exists it will carry its own notice, written for what it actually does, and you will be asked to agree to that separately — it will not be slipped in under this one.
Most operational obligations under the Digital Personal Data Protection Rules 2025 take effect on 13 May 2027. We are applying them now rather than waiting for the deadline.
Only what the form in front of you asks for. There is no hidden field, and nothing is collected from you before you submit a form except the analytics described in section 5.
| What | Required? |
|---|---|
| Your email address | Yes |
| Your tick on the consent box | Yes |
That is the whole form. We do not ask for your name, your phone number, your age, your city, your family's details or anything about anyone's health.
| What | Required? |
|---|---|
| Your name | Yes |
| Your email address | Yes |
| Your city | Yes |
| Your speciality | Yes |
| Your medical council registration number | No — optional |
| Your tick on the consent box | Yes |
The registration number is optional because it is only useful later, at the point of a real conversation about practising with us. Leaving it blank does not affect anything now. We do not verify it against any register at this stage, and we do not pass it to anyone.
| What | Required? |
|---|---|
| Your centre's name | Yes |
| The contact person's name | Yes |
| Your city | Yes |
| Your email address | Yes |
| Your tick on the consent box | Yes |
| What | Why it exists |
|---|---|
| The exact wording of the consent box you ticked, and its version number | So that if you ever ask what you agreed to, we can show you the words you actually saw rather than a summary of them |
| The date and time you submitted | Evidence of when consent was given |
| Your IP address | Evidence of who gave consent, and to stop the same address submitting the form repeatedly. We are telling you about this rather than storing it silently. It is not used to locate you, to target you, or to build any profile |
| Your browser's user-agent string (the browser and operating system it reports) | The same consent-evidence purpose. It is not a device fingerprint and is not combined with anything else |
Separately from the forms, our server keeps an ordinary log of every request it receives, which includes your IP address whether or not you fill anything in. Every website does this and it is how one is kept running; section 5 describes it and section 7 says how long it is kept.
We do not collect your phone number, your postal address, any government identifier (no Aadhaar, no PAN, no ABHA number), any payment or card detail, or any health information — not yours, and not anyone's in your family. No form on this site asks for them, so there is nothing for us to store.
Each form has one purpose, and the data from it is used for that purpose only.
We also count submissions in aggregate — how many families, doctors and centres have come forward, and from which cities — to decide where to launch first. That counting uses no names and no email addresses.
What we will not do with it. Stated plainly, because a list of permitted purposes is only as good as what it rules out:
The only circumstance in which we would disclose your details to someone outside the companies named in section 6 is a demand we are legally obliged to meet — a court order, or a lawful requirement under Indian law. If that happens we will tell you, unless the law forbids us from telling you.
We process this data on the basis of your consent under section 6 of the DPDP Act, given by ticking the box on the form. Nothing is submitted without that tick — the form will not accept it.
These are the exact words, and they are the words we store alongside your record:
Families: "You can email me about Kin Health's launch and early access. I can withdraw this at any time."
Doctors: "Kin Health can contact me about practising with them. I can withdraw this at any time."
Diagnostic centres: "Kin Health can contact me about partnering with them. I can withdraw this at any time."
To withdraw, email privacy@thekinhealth.com from the address you signed up with, or from any address, telling us which one to remove. That is it. Withdrawing is meant to be as easy as consenting was, which is what section 6(4) of the DPDP Act requires, so there is no form, no login, no survey asking why, and no retention offer. We take you off the list and confirm that we have.
Withdrawing consent does not undo processing that already happened lawfully — an email we already sent cannot be unsent. It stops everything from that point on.
We do not currently run Google Analytics, or any other analytics, on this site. No visit-counting cookie is set today, and nothing about your visit is measured beyond the server logs described at the end of this section. If that changes, it will change under Consent Mode v2 exactly as described below, and this notice will be updated in the same commit that turns it on — not after.
The mechanism below is already built into the site, ready to switch on, so we are describing it now rather than waiting until it is live and asking you to re-read this page. Until it is switched on, none of it does anything.
Nothing would be stored on your device until you accept. Analytics storage would start in a denied state on every page load. A banner would be the only thing that changes that, and only if you press Accept. If you press Decline, or ignore the banner entirely, no analytics cookie would be set — we would receive an anonymous, identifier-free count of the visit and nothing that could be tied back to you or joined up across pages.
If you accepted, two things would be stored in your browser:
| What | Purpose | How long |
|---|---|---|
kin-consent (browser local storage, set by us) |
Remembers your answer so we stop asking. Holds only your choice, the version of the banner wording, and the time you chose | Until you clear your browser storage, or until we change the banner wording and ask again |
Google Analytics cookies (_ga and related) |
Distinguishes one visit from another so a count is a count of visits rather than of page loads | Up to two years, set by Google |
To change your mind, once this exists: a "Cookie preferences" link in the footer of every page reopens the banner and lets you answer differently, at any time — withdrawing has to be as easy as consenting was, which is what section 6(4) of the DPDP Act requires. You would also be able to block analytics entirely with your browser's tracking protection or an extension; the site would work exactly the same either way. Nothing on this site requires a cookie to function.
We set no advertising cookies. There are no social media pixels, no chat widgets, no embedded videos, and no session-recording or heatmap tools on this site. The emails we send you are plain text, so they carry no tracking pixel and we cannot tell whether you opened one.
Declining the banner stops analytics. It does not stop these, so we would rather name them than let you assume otherwise:
fonts.googleapis.com and
fonts.gstatic.com as the page loads, which means Google sees your IP
address and which page requested a font — on every page, before you answer the
banner and regardless of how you answer it. Google states it does not use Google
Fonts requests to build advertising profiles, and no cookie is set by these
requests. We are still telling you, because "third-party request you cannot decline"
is exactly the sort of thing a privacy notice should not quietly omit. If you would
rather it did not happen, a browser extension that blocks third-party fonts will
stop it, and the site remains entirely readable in your system font.Three companies, each doing one job on our instructions as a Data Processor. They may not use your data for their own purposes, and they are contractually bound to protect it.
| Who | What they do for us | Where |
|---|---|---|
| Microsoft (Microsoft Azure) | Hosts this website and the database holding form submissions | India |
| Microsoft (Azure Communication Services) | Delivers the acknowledgement email to you, and the notification email to our own team | India — the service's data location was fixed to India when it was created and cannot be moved |
| Google (Google Analytics 4) | Not currently active — see section 5. Listed here so this table is complete on the day it is switched on, not after | Google's global infrastructure, which includes servers outside India |
| Google (Google Fonts) | Serves the typefaces this site is set in. Happens on every page load whatever you told the banner — see section 5 | Google's global infrastructure, which includes servers outside India |
The one honest caveat in this notice, so we will not bury it: your form submissions stay in India, but font requests go to Google today, and analytics would too if it is ever switched on — both may be processed outside India. Section 16 of the DPDP Act permits transfers outside India except to countries the Central Government restricts, and none of Google's regions is currently restricted. If you would rather no data of yours left the country at all, a browser extension that blocks third-party fonts stops the one part of this that is active today.
We do not use any customer-relationship or email-marketing platform. Your email address is not uploaded to Mailchimp, HubSpot, Salesforce or anything comparable.
Where. Form submissions are stored in a managed PostgreSQL database running in an Indian Microsoft Azure region, and the emails about them are sent through a service whose data location is India. Copies exist only as the routine encrypted backups of that database, in the same country.
How long. We keep your record while the purpose you consented to is still alive — for families, until the app has launched and you have heard from us; for doctors and centres, while a conversation about working together is still realistic.
| What | Kept for |
|---|---|
| Your form submission and the consent record attached to it | Until you withdraw — then erased. Otherwise reviewed after 24 months with no contact between us, and erased unless you have told us to keep it |
| Technical logs of the submission (including the IP address in them) | One year, which is the minimum the DPDP Rules 2025 require us to hold processing logs for. Then deleted |
| Server logs of ordinary visits, which include IP addresses | One year, for the same reason. Then deleted |
| Email you send to privacy@thekinhealth.com, and our replies | Two years from the day the matter is closed, so that we can show what was asked and what we did about it. Ask us to delete the correspondence sooner and we will, unless it concerns an unresolved complaint |
| The acknowledgement email in your inbox | Yours, not ours. Delete it whenever you like |
"Erased" means the record is deleted from the live database, and works its way out of encrypted backups as those backups age out on their normal cycle. We do not keep a shadow copy of erased records, and we do not keep your email address on a suppression list after you have asked us to delete it.
What follows is what we actually do, not a list of ambitions.
No system is beyond reach, and we will not claim otherwise. What we can say is that this website is not a worthwhile target: it holds contact details and consent records, and it holds no health information at all.
If you believe you have found a security problem, email privacy@thekinhealth.com with the details. We will acknowledge you and we will not pursue anyone who reports a genuine issue to us in good faith and gives us a reasonable chance to fix it.
The DPDP Act gives you the following rights over your personal data. They cost nothing to use and you do not need a reason.
| Right | What it means here |
|---|---|
| Access section 11 |
Ask us for a copy of everything we hold about you, a summary of how it is being processed, and who we have shared it with. For most people that is a single row and a short answer |
| Correction and completion section 12 |
Tell us something is wrong or out of date — a misspelled name, a changed email, a new city — and we will fix it |
| Erasure section 12 |
Ask us to delete your record. We will, unless a law requires us to keep something specific, in which case we will tell you exactly what and why |
| Withdraw consent section 6(4) |
See section 4 above. One email, no questions |
| Nominate someone section 14 |
Name another person to exercise these rights for you if you die or become unable to act. Email us the nominee's name and contact details and we will record it |
| Grievance redressal section 13 |
Complain to us about how we have handled your data, and get an answer. See section 12 |
How to use any of them: email privacy@thekinhealth.com and say what you want. Writing from the address you gave us is the quickest route, because it is how we know it is you. If you write from a different address we may need to ask one or two questions to confirm you are the right person — we would rather do that than hand your details to someone who is not you.
How long we take: we aim to complete any request within 30 days, and we will acknowledge you well before that. Where a request is unusually complicated we may take longer, and if so we will tell you why and when to expect an answer. The outer limit under the DPDP Rules 2025 is 90 days, and we treat it as a ceiling, not a target.
Under section 15 of the DPDP Act you also have duties of your own — principally not to impersonate someone else when you give us data, and not to file a false or frivolous complaint.
This website is addressed to adults — parents, adult children looking after ageing parents, doctors and business owners. The forms are for adults, and we do not knowingly collect personal data from anyone under 18 through this site.
If you are under 18, please do not submit a form. If you are a parent or guardian and believe your child has submitted one, email privacy@thekinhealth.com and we will delete it — without asking you to prove anything beyond what we need to find the record.
Kin Health is a family product, so children's data will matter a great deal once the app exists. Two commitments hold now and will hold then, both of them requirements of section 9 of the DPDP Act rather than preferences of ours: a child's data will only ever be processed with verifiable consent from a parent or lawful guardian, and we will never track a child's behaviour, profile a child, or direct advertising at a child. There is nothing on this website that could do any of those things today.
If personal data we hold is breached — exposed, altered or lost — this is what happens, and it is not discretionary:
We will not wait until we understand everything before telling you. You will hear from us with what we know at the time, and again when we know more.
If you are unhappy with how we have handled your personal data, or with how we answered a request, complain to us first — it is the fastest way to get it fixed, and it is your right under section 13 of the DPDP Act.
Grievance Officer, Kin Health
ENGICONNECT SOLUTIONS PRIVATE LIMITED
Email: privacy@thekinhealth.com
This mailbox is monitored, and it is the same address for every request in this notice. Put "Grievance" in the subject line and we will treat it as one. We will acknowledge you within 72 hours and resolve it within 30 days wherever we can — the statutory ceiling is 90 days.
This is also the address to use if you simply have a question about anything on this page. You do not need to have a complaint to write to us.
If we do not resolve it. You can escalate to the Data Protection Board of India, the statutory body set up under the DPDP Act to hear exactly these complaints. Escalating costs you nothing, you do not need our permission, and you do not need to go through us first — though in practice the Board will expect you to have tried. Nothing in this notice limits your right to go to the Board or to any other legal remedy available to you.
This is version 1.0, in effect from 26 September 2026. When it changes, the version number and the date at the top change with it, and the previous version is available on request.
If a change affects what you agreed to — a new purpose, a new recipient, a new field on a form — we will ask you again rather than treating your original tick as covering it. Continuing to use the website is not how you agree to a new version of this notice, and we will not write a clause here that pretends it is.
Corrections of the "we clarified some wording" kind will not be announced. Anything that changes what we do with your data will be.
It is not medical advice, and nothing on this website is. Kin Health is being built to support the care you and your doctor decide on. It does not diagnose, treat or cure anything, and it is not a substitute for a qualified doctor.
It is not a description of a product you can use today. Kin Health has not launched. This notice describes a website that tells you about what we are building and lets you ask to be told when it is ready — nothing more.
This notice, and anything we do with the personal data described in it, is governed by the law of India. The Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 are the main instruments, and the Information Technology Act 2000 with its Reasonable Security Practices Rules 2011 continues to apply alongside them. Indian courts have jurisdiction over any dispute about it. We are not subject to HIPAA, the GDPR or SOC 2, and you will not find those named anywhere on this site — claiming a regime that does not govern us would be worse than claiming nothing.
Where this notice and the law differ, the law wins, and we would like to know about it — privacy@thekinhealth.com.