SleepSet Privacy Policy

1. Who This Policy Covers

This policy applies to everyone who uses SleepSet, in whichever role:

• Patients and visitors: people who browse the site, take the sleep assessment, book consultations, sleep tests or wellness programmes, or buy products.
• Doctors and hospitals: registered medical practitioners and hospital partners, and the staff who use their logins.
• Sleep laboratories: labs, technicians and scorers who carry out and report sleep studies.
• Distributors: sellers of sleep-therapy equipment and their sales and service staff.
• Wellness coaches: sleep-wellness consultants who list consultations and programmes.

2. Information We Collect

We collect only the information needed to run SleepSet and deliver the service you ask for.

Information you give us

• Account and identity: name, email address, mobile number, age or date of birth, gender, city, and your password (stored in salted, hashed form). We verify your email or mobile number with a one-time code.
• Health information: your answers to the sleep assessment, symptoms and medical history you choose to share, consultation notes, prescriptions, sleep-study recordings and reports, diagnostic results, therapy-device details, and medical documents you upload.
• Location data:When you choose "Use my location" on doctor or sleep test search, we request coordinates to sort nearby clinics by proximity. This permission is explicit, consent-based under DPDPA, and stored locally in your browser unless saved to your user profile.
• Bookings and orders: appointments, sleep tests, wellness programmes, products purchased, delivery address, and any customer support requests you raise.
• Payment details: amount, payment mode, transaction status and reference ID. Card, UPI and net-banking credentials are processed directly through certified RBI-authorized payment gateways; we do not store full card numbers, CVVs or UPI PINs.
• Professional and business details (partners only): qualifications, medical council registration numbers, licences, PAN, GSTIN, bank details for settlements, and staff contact credentials.
• Communications: messages you send to our support team, feedback, reviews, and your communication preferences.

Information collected automatically

When you use SleepSet we record your IP address, device and browser type, operating system, pages viewed, referring page, and the date and time of each visit. We use this to keep the service secure, fix technical faults and understand platform performance.

Information from care partners and third parties

• A doctor, hospital, lab or distributor you deal with may add information to your record, such as a prescription, a sleep report or an order.
• A healthcare partner may invite you to SleepSet using contact details you gave them.
• Our payment gateway confirms whether a payment transaction succeeded.

Consent records

Each time you give or withdraw consent, we record the version of the text you were shown, the date and time, and your IP address, so that either of us can later verify what was agreed in accordance with DPDPA 2023 requirements.

3. How We Use Your Information

We use personal data only for the purposes below, on the basis of your consent or another ground the law permits, such as meeting a legal obligation or responding to a medical emergency:

• Running your account: creating and securing your account, and signing you in.
• Arranging care and services: suggesting suitable specialist specialties from assessment answers, and booking consultations, sleep tests, wellness programmes, and product orders.
• Care coordination: passing the clinical details a chosen doctor, hospital, lab, coach or distributor needs to serve you.
• Payments and records: processing payments, refunds, invoices, partner payouts, and tax accounting.
• Service messages: sending one-time codes, booking confirmations, reminders, and report-ready alerts by SMS, email or in-app notice, and WhatsApp where you opted in.
• Verifying partners: vetting the credentials and medical licences of doctors, hospitals, labs and distributors before listing.
• Support and safety: answering queries, maintaining audit logs, and detecting fraud or security incidents.
• Improving SleepSet: analyzing platform performance using aggregated or de-identified data wherever possible.
• Marketing (strictly opt-in): sending educational updates or news only if you explicitly opted in. Saying no never affects your service access.
• Legal compliance: meeting obligations under applicable Indian laws and responding to lawful statutory requests.

4. Health Information and Consent

Your health information is used solely to deliver the care and services you request, and never for third-party advertising.

• Separate, specific consent: Required and optional consents are displayed distinctly. No consent box is pre-ticked, and optional consents are never a prerequisite for creating an account.
• You decide provider visibility: A doctor or hospital can view your SleepSet assessments and sleep reports only when you explicitly share them for a specific booking.
• Teleconsultations: We maintain the digital identity and consent logs required under the Telemedicine Practice Guidelines, 2020.
• Withdrawing consent: You may withdraw consent at any time, as easily as it was given. We will then cease related processing. Withdrawal does not invalidate processing prior to withdrawal or records required by healthcare laws.

5. Sharing and Disclosure

We never sell your personal data to data brokers, and we never share clinical records with advertisers. Data is shared strictly to deliver requested healthcare services:

• Care providers you choose: Selected doctors, hospitals, sleep labs, and wellness coaches receive patient intake records for your appointments.
• Distributors: Product orders or CPAP rental requests share shipping name, address, and equipment details to fulfill setup and calibration.
• Infrastructure service providers: Certified cloud hosting, SMS/WhatsApp gateways, video telehealth providers, and analytics tools under strict data processing agreements.
• Legal and regulatory requests: Law enforcement and regulatory authorities where required under Indian law.
• Emergency & Platform protection: In situations involving threats to human life or health, or to prevent platform fraud.
• Corporate restructuring: In the event of a merger or acquisition, personal data transfers to the successor entity bound by this policy.

6. Cookies and Similar Technologies

SleepSet uses a minimal set of cookies to operate reliably. We never use cookies to build advertising profiles from your health information.

You can block or delete cookies via your browser settings. Note that disabling essential session cookies will prevent login, consultation booking, and store checkout.

7. Storage, Retention and Transfers

SleepSet's primary databases, medical attachments, and daily backups are securely hosted on servers located within India.

• Data localization: All personal and health data resides in Indian data centers. Global messaging routing (SMS/email) is restricted strictly to non-restricted jurisdictions under robust safeguards.
• Medical records retention: Consultation notes, prescriptions, and sleep study reports are preserved in accordance with Indian medical record retention statutes.
• Financial and tax logs: Retained for statutory periods mandated under Indian tax and corporate laws.
• Consent logs: Maintained for the duration of the account and as required to evidence compliance under DPDPA 2023.

8. Security Safeguards

We protect personal and clinical data using industry-leading technical and organizational safeguards:

9. Your Rights and Choices

Under the Digital Personal Data Protection Act, 2023, you have guaranteed rights regarding your personal data:

• Right to Access: Request a clear summary of personal data held about you and processing activities.
• Right to Correction: Update or correct inaccurate or incomplete personal information.
• Right to Erasure: Request deletion of your personal data when no longer legally required.
• Right to Withdraw Consent: Revoke consent at any time via your profile settings or by email.
• Right of Nomination: Designate an individual to manage data rights in the event of incapacitation or death.
• Grievance Redressal: Raise inquiries or concerns directly with our designated Grievance Officer.

To exercise your rights, visit your Account Settings or email us at privacy@sleepset.in. Requests are processed within statutory timelines (30 days).

10. Children's Privacy

SleepSet accounts are designed for individuals aged 18 and older. Any pediatric consultation or sleep assessment for minors must be booked and consented to by a parent or legal guardian. We do not track or profile children or deliver behavioral advertising.

11. Third-Party Links and Services

Our platform may link to external payment gateways, telehealth video services, or courier tracking tools. Their independent privacy terms apply, and we encourage you to review their policies.

12. Changes to This Policy

We may update this policy periodically to reflect evolving clinical workflows or regulatory changes. The latest version and effective date will always appear on this page. Significant modifications will be communicated via in-app banner or email.