1. Information We Collect

We collect only what we need to operate the service. Because JaiCare handles health data, we are transparent about what we collect and why.

Personal data

• Your phone number (from WhatsApp) — used as your account identifier.
• Your name, preferred language, and time zone — provided during registration.
• Subscription and payment information when you subscribe to a paid plan.

Health data (sensitive data)

• Conditions, allergies, and dietary restrictions you share with us.
• Medications (name, dosage, timing, dietary interactions) that you tell us about or that we extract from documents.
• Medical reports you upload (lab results, prescriptions, discharge reports, specialist reports, radiology images, vaccination records).
• Lab values extracted from your reports, with trend comparisons against your previous results.
• Food diary entries automatically extracted from your messages.
• Your doctors (name, speciality, clinic, phone).

Messages and voice notes

• All text and voice messages you send via WhatsApp or LINE. Voice messages are converted to text and processed in the same way.
• Conversation history is retained to provide continuity of care.

Caregiver and family data

When linking family members or caregivers, we store their names, identifiers, and messages within the shared family conversation. JaiCare supports three roles: primary caregiver (full access), patient, and sibling (read-only via a secure link).

Technical data

• Timestamps, error logs, and basic usage metrics — for service maintenance and quality improvement.

2. How We Use Your Information

We use your information exclusively to:

• Provide personalised health and nutrition advice based on your conditions, medications, and needs.
• Track your food and alert you to items that may conflict with your conditions or medications.
• Read, store, and track trends in your medical reports and lab results.
• Manage your medication list and send reminders on schedule.
• Relay messages between you, your caregivers, and the bot within the family conversation.
• Manage subscription, billing, and technical support.
• Maintain security, prevent misuse, and improve quality.

We do not sell, rent, or share your data with third parties for marketing purposes. We do not use your health data to train AI models. We do not show you advertisements based on your health information.

3. Consent for Sensitive Data

Health data is classified as sensitive personal data under the PDPA. We process it based on your explicit consent — given when you begin using the service and at each major collection point (sharing a condition, uploading a report, telling us about a medication). The bot always asks for your confirmation before saving any health information. You may withdraw your consent at any time; doing so may restrict or end the service, as health data is essential for providing personalised advice.

4. Data Storage and Security

Encryption in transit

All data is transmitted over HTTPS/TLS, and insecure connections are rejected.

Encryption at rest

All user data is stored in a database encrypted with SQLCipher (AES-256). The encryption key is stored separately and does not appear in application logs.

User data isolation

Each user's data is indexed by a unique identifier and processed independently. We do not mix data across accounts.

Access control

Server and database access is restricted to authorised operators via SSH key only. The admin dashboard is protected by a secret token.

Backups

Encrypted backups are maintained with a limited retention period to ensure service continuity.

5. Service Providers (Third Parties)

To operate the service, we work with carefully selected third parties, each of which processes your data under its standard commercial terms:

Data sent to providers outside your country is subject to each provider's terms, which include data protection commitments and standard contractual clauses where applicable.

6. Your Rights

• Access the personal data we hold about you.
• Correct any inaccurate data.
• Delete all your data — type "delete my data" in the bot at any time; you will be asked to confirm, and it will be permanently erased.
• Withdraw consent for processing at any time (this may end the service).
• Obtain a copy of your data in a machine-readable format upon request.

To exercise any of these rights, contact us at [data protection officer email]. We respond within 30 days.

7. Data Retention Period

8. Data Breach Notification

In the event of a breach affecting your personal data, we will notify the relevant regulatory authority within the legally required timeframe, notify affected users without unreasonable delay if the breach could cause serious harm, and take immediate steps to contain it.

9. Children's Data

JaiCare is designed for adults and caregivers and is not intended for anyone under 18 years of age. We do not knowingly collect data from children. If you believe a minor has used the service, contact us and we will delete the data.

10. Medical Disclaimer

11. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via the bot before they take effect, and continued use after notification constitutes acceptance.

12. Contact

Data Protection Officer: [Name] — Email: [privacy email] — Address: [registered address].