Privacy notice
Draft for pre-release review · last updated 10 October 2026. This notice describes how the GaitAI Care application handles information. It has not yet been reviewed by a lawyer and is not a statement of legal compliance.
What you store
Your account email and a salted hash of your password; the health profiles you create (for yourself or family members you are authorised to manage); medical reports and images you upload; medicines, supplements, hospital stays, vaccinations, illnesses and notes you enter; and the text the app extracts from your uploads.
How it is protected
- Every record belongs to one profile, and every profile to one account. Other accounts cannot see it unless you invite them as a viewer or editor, and you can revoke that access.
- Uploaded originals, extracted text and clinical free text are encrypted by the application before storage. Files are kept in a private storage bucket and are never served from a public URL; downloads go through your signed-in session or a short-lived, single-use link.
- Sign-in uses expiring session tokens. New accounts must confirm their email address before any record can be created or read.
- Changes to records are written to an audit trail visible in Settings.
Where it is processed
| Service | Purpose | What it receives |
|---|---|---|
| Google Firebase Hosting | Delivers the web application's static files | Ordinary web requests; no health records |
| Render (API server) | Runs the GaitAI Care application server, including text extraction from your uploads | Your requests and uploads while they are processed |
| Supabase (database and private file storage) | Stores your account and encrypted records and files | Encrypted records and files; account email; dates and identifiers needed to organise records |
| Hostinger mail (sent through a Supabase function) | Sends verification, password-reset, trial-reminder and account emails | Your email address and the message text; never your medical records |
| Razorpay (payments) | Takes subscription payments and recurring mandates on its own secure page | Your payment details, email or phone as you enter them on Razorpay; never your medical records. GaitAI Care receives only the payment status, amount, dates and Razorpay reference numbers |
Text is extracted from documents on GaitAI Care's own server. No document is sent to an external AI provider. If an optional external analysis service is enabled in future, it will be off by default, named before use, and require your consent for each document.
The app uses no advertising, tracking or third-party analytics scripts.
Subscriptions and payments
Every new verified account gets one 14-day free trial; after it, using records needs a paid plan (see the subscription terms). If a trial or subscription ends, your records are kept but locked; exporting and deleting them stay free. To make sure a trial is used once per person, GaitAI Care keeps a keyed fingerprint of your normalised email address with your trial dates, also after the account is deleted. Payment records (amounts, dates, plan, Razorpay references, no card or bank details) are kept after account deletion for as long as tax and accounting law requires, without your health records and without a link to the deleted account.
Children and family members
Create a profile for another person only if you are their parent, guardian or otherwise authorised to manage their health information. Children do not need their own accounts.
Your choices
- Export: Settings offers a doctor summary and a complete archive of your records and original files. The complete archive stays available without a subscription.
- Delete: deleting your account cancels any subscription (no further charges) and removes your live account, its profiles, records and stored files. Copies you downloaded or shared are outside the app's control.
- Correct: you can edit or remove records at any time; earlier values are kept in the audit trail.
Contact
Questions or requests about your information: support@gaitai.in. General enquiries: contact@gaitai.in.
India's Digital Personal Data Protection Act, 2023 and Rules, 2025 apply in phases. A qualified review of obligations, consent, retention and cross-border processing is required before public launch; this draft does not claim compliance.