The short version
We keep your health records so that you — and any doctor you choose to show them to — can see them. We do not sell your data, we do not advertise to you, and there are no third-party trackers on this site. Scan photographs and recordings stay on our own servers. Some text (for example, the words used to explain a result or draft a prescription) is processed by third-party AI providers who may be located outside India — that is set out in full under Who we share it with.
Who we are
InstaDataHelp AI Services Private Limited ("InstaDataHelp", "we") operates InstaPraxis. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the information described here, and you are the Data Principal.
| Registered office | D-9/132, Chitrakoot, Vaishalinagar, Jaipur 302021, Rajasthan, India |
|---|---|
| CIN | U62020RJ2025PTC106526 |
| GSTIN | 08AAICI4276P1Z |
| info@instadatahelp.com | |
| Telephone | +91 73383 27447 · +91 99037 26517 (Mon–Fri, 09:30–18:30 IST) |
| Grievance Officer | Sampa Pal, Director — sampa@instadatahelp.com (how to complain) |
What we collect
Information you give us
- Account details — name, email address, mobile number and a password (stored only as a one-way hash; we never see or store it in readable form).
- Profile details — date of birth, sex, and anything you choose to add such as height, weight, allergies, chronic conditions or current medicines.
- Scan inputs — depending on the scan: a photograph (skin, eye, X-ray), a short audio recording (cough or voice), or the measurements derived from a face video.
- Documents you upload to your health record, and what you type into a consultation or the health assistant.
Information produced by the service
- Scan results and reports, including scores, bands and the explanatory text.
- Consultation records — appointments, prescriptions, notes written by your doctor.
- Activity records — a security log of significant actions (sign-in, scan run, report downloaded, password changed) with the time and the originating IP address.
About the face video and the scan photograph
For Vital Scan and Skin & Glow the video itself never leaves your device. Colour and texture are measured in your browser, frame by frame, and only those numbers are sent to us. One still photograph is taken part-way through the scan and saved with your report as proof of who was scanned — you can switch that off before the scan, and download or ask us to delete the photograph afterwards.
For DermaScan, ChestScan, AnemiaScan, JaundiceScan and Eye Check the photograph you take is uploaded, because the photograph is what is analysed. For BreathScan and MindScan the audio recording is uploaded for the same reason.
Why we use it, and on what basis
| Purpose | Lawful basis (DPDP Act) |
|---|---|
| Running the screening you asked for and storing the result in your record | Your consent, given at registration and each time you start a scan |
| Showing your record to a doctor you book, or to a clinic that registered you | Your consent |
| Keeping prescriptions and consultation notes | Your consent, and the record-keeping obligations that apply to the prescribing doctor |
| Security, fraud prevention, and the activity log | Legitimate use — keeping the service and your account secure |
| Fixing faults, and improving accuracy using aggregated, de-identified statistics | Your consent; you may withdraw it without losing access to the service |
We do not use your health information for advertising, and we do not profile you for marketing.
Who we share it with
- Doctors and clinics you choose. A doctor sees your record when you book them, or when a clinic creates your account at its front desk. A doctor who has never had an appointment with you cannot open your record.
- Third-party AI providers — text only. Features that write in sentences (explaining a result, drafting a prescription for the doctor to review, answering a health question, summarising a report) send text to external large-language-model providers. Those providers may process it on servers outside India. We do not send them your name, email, mobile number, photographs or recordings. If you would rather not use those features, the scans themselves still work without them.
- Speech-to-text during a consultation. This runs on our own servers in the consultation flow; the audio is not sent to a third party.
- Service providers for email delivery and, where you pay for a consultation, the payment gateway. They receive only what is needed to perform that task.
- Nobody else. We do not sell, rent or trade personal data. We disclose information to an authority only where the law obliges us to, and we keep a record of any such disclosure.
We do not claim that your data is stored only in India, and we do not claim the service is end-to-end encrypted. Being accurate about this matters more to us than the marketing value of saying otherwise.
How long we keep it
| What | Kept for |
|---|---|
| Scan results and reports | While your account is open, so you can compare over time. Deleted on request. |
| Scan photographs and recordings | With the report they belong to. You can ask for the photograph alone to be deleted. |
| Prescriptions and consultation notes | At least three years from the consultation, in line with medical record-keeping practice, even if you close your account. |
| First-login credential slips printed on a prescription | Deleted as soon as the password is changed or reissued, and in any case within 120 days. |
| Security and activity log | Up to 24 months. |
Your rights
Under the DPDP Act you may:
- Get a copy of the personal data we hold about you, and a summary of how it is being processed.
- Correct or complete anything inaccurate — you can edit your profile directly, or write to us.
- Erase your data, except what we must keep as described above.
- Withdraw consent at any time; the features that depend on it will stop, and we will not use the data for those purposes again.
- Nominate another person to exercise these rights if you are unable to.
- Complain — first to our Grievance Officer, and afterwards to the Data Protection Board of India if you are not satisfied.
To exercise any of these, write to info@instadatahelp.com or use the grievance page. We respond within 30 days.
Children
Accounts are for adults aged 18 and over. A parent or legal guardian may create a profile for a child within their own account and use the service on the child's behalf — in that case the parent or guardian is the one giving consent, and is responsible for the child's use of it. We do not run behavioural advertising and we do not track children.
Where a scan is explicitly designed with infants in mind (JaundiceScan has a newborn mode), it remains a screening aid: newborn jaundice can become serious quickly, and a baby who looks yellow needs to be seen by a doctor, whatever any app reports.
How we protect it
- Traffic between your device and us is encrypted in transit (HTTPS/TLS).
- Passwords are stored as bcrypt hashes; session tokens are held in cookies that JavaScript cannot read.
- The AI engines run on loopback interfaces of our own servers and are not reachable from the internet.
- Access is role-based: a doctor reaches a record only through a booking, and every significant action is written to an activity log.
- Credential slips are stored encrypted (AES-256-GCM) and purged as described above.
No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.
Changes
If we change this policy in a way that affects how your data is used, we will show a notice in the app and ask for fresh consent where the law requires it. Older versions are available on request.