Privacy Policy

Last updated: October 19, 2026

1. Introduction

This Privacy Policy explains how Kiranam ("Kiranam", "we", "us", "our") — operated by Health Care Foundation, having its registered office at P.O. Kattippara, Poonoor, Kozhikode, Kerala 673573, India — collects, uses, discloses, stores, and protects personal information when you use the Kiranam mobile application, this admin panel, and related services (the "Services"). This Policy is published in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000, to the extent applicable. By creating an account or using the Services, you agree to the collection and use of information as described here. If you don't agree, please don't use the Services.

2. Information we collect

Information you give us directly

  • Account details: your full name, phone number, email address, and an optional profile photo. The phone number is also the WhatsApp number we send your one-time login code to.
  • A referral code, if you were invited by a coordinator — either entered by you or recovered automatically from the clipboard once, the first time the app opens after install.
  • Coordinator application details: your motivation, availability, skills, and anything else you submit in that application.
  • Your communication preferences and consent choices (e.g. WhatsApp reminders, push notifications).

Information generated as you use the Services

  • Contribution details: amount, date, campaign, and status of each contribution, processed through our payment partner Razorpay Software Private Limited. We do not collect or store your card number, CVV, UPI PIN, or net-banking credentials — Razorpay collects and secures that information directly under its own privacy and security policies.
  • Coordinator activity records: contributor assignments and status updates recorded within the Services.
  • Device and technical information: device/browser type, OS version, app version, unique identifiers, and IP address. We don't use a crash-reporting or analytics SDK.
  • A push-notification device token (via Firebase Cloud Messaging and Expo's push service) so we can deliver notifications you haven't opted out of.

What we don't collect

We don't access your contacts, photos (other than a profile picture you choose to upload), files, or messages, and we don't use third-party advertising or tracking SDKs.

3. How we use your information

We use your information to: create and manage your account; process and record contributions and issue receipts/acknowledgements; match and match coordinators with contributors; send transactional messages needed to run the Services — including your one-time login code, which we deliver over WhatsApp, and payment confirmations; send contribution reminders, receipts and programme updates via WhatsApp or push/in-app notification — WhatsApp consent is given when you sign up and is required to use the app, because WhatsApp is how we deliver your login code and receipts; detect and prevent fraud, abuse, and security incidents; and comply with applicable law.

4. Who we share it with

We do not sell, rent, or trade your personal data. We share the minimum necessary information with:
  • Supabase, Inc. — our database, authentication, and file storage provider.
  • Razorpay Software Private Limited — payment processing for contributions.
  • Meta Platforms, Inc. (WhatsApp Business Platform) — delivery of your login code (always, since it's how you sign in) and contribution reminders (only if you've opted in).
  • Google LLC (Firebase Cloud Messaging) and Expo — delivery of push notifications.
  • Coordinators and administrators, on a need-to-know basis, where necessary to manage a coordinator-contributor relationship.

We may also disclose information where required by law, court order, or governmental request, or to protect the rights, property, or safety of Kiranam, our users, or the public — and as part of any merger, acquisition, or sale of assets, subject to this Policy or one at least as protective.

5. Cross-border data transfer

Some of our service providers (e.g. Supabase, Meta, Google) may process or store data outside India. Where personal data is transferred outside India, we take reasonable steps to keep it protected consistent with the DPDP Act and this Policy.

6. Data retention

We keep account and profile data for as long as your account is active, plus a reasonable period after deletion to prevent fraud and resolve disputes. Contribution and financial records are retained for the period required under applicable accounting and tax regulations (typically up to 8 years), even after account deletion, because we're legally required to keep them. Coordinator application data is kept for the duration of your coordinator relationship and a reasonable period after. When data is no longer needed, we securely delete, anonymize, or aggregate it.

7. Data security

We use reasonable technical and organizational safeguards appropriate to the sensitivity of the data we process, including encryption in transit (TLS), role-based access controls, and row-level security on our database. No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If we become aware of a personal data breach likely to affect you, we'll notify you and the relevant authorities as required by law.

8. Your rights

Subject to applicable law, including the DPDP Act, you can: review and correct your profile information; withdraw consent for anything consent-based (e.g. push notifications) at any time — withdrawing WhatsApp consent means you can no longer use the app, so you would delete your account instead, without affecting processing that already happened; permanently delete your account and associated data from Profile → Delete Account (in the app), subject to the retention described in Section 6; and nominate another individual to exercise these rights on your behalf in the event of your death or incapacity — contact us to register a nominee. See Section 11 for how to raise a grievance.

9. Children's privacy

The Services are not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn we've inadvertently collected data from a child, we'll delete it promptly — contact us if you believe this has happened.

10. Cookies (admin panel)

This admin panel uses strictly necessary cookies to maintain your authenticated session and, where used, essential functional cookies to remember your preferences. We do not use third-party advertising or cross-site tracking cookies.

11. Third-party links and services

The Services link to or integrate with third parties such as UPI payment apps and WhatsApp. This Policy doesn't apply to, and we're not responsible for, their privacy practices — please review their own policies.

12. Grievance redressal

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, we've appointed a Grievance Officer for concerns about this Policy or our handling of your personal data:

Grievance Officer: Navas
Email: support@kiranam.online
Phone: +91 99466 61059
Address: P.O. Kattippara, Poonoor, Kozhikode, Kerala 673573, India

We'll acknowledge your grievance and aim to resolve it within the timelines prescribed by applicable law. If you're not satisfied with our response, you may approach the Data Protection Board of India or other competent authority.

13. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify you in the app or by email before the changes take effect.

14. Contact us

If you have questions about this policy or your data, contact us at support@kiranam.online or at P.O. Kattippara, Poonoor, Kozhikode, Kerala 673573, India.