Privacy Policy

1. Who we are

KiloCare is a clinical weight management technology platform operated by Continuum Protocols Private Limited, Bangalore, Karnataka, India (“KiloCare,” “we,” “us,” “our”). We connect eligible patients with independent registered physicians (holding an MD in Medicine or a qualification in Endocrinology, and registered with the National Medical Commission or a State Medical Council) for supervised weight management. What a physician prescribes, if anything, is their clinical decision. We are a technology intermediary, not a hospital, clinic, or healthcare provider.

This policy applies to kilocare.in and all associated services. It is written in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Telemedicine Practice Guidelines, 2020.

2. Data we collect

2.1 Personal data you provide

• Identity: Name, phone number, email address.
• Demographic: Age, date of birth, gender.
• Location and delivery details: City and state, and the PIN code or delivery address you provide for medication delivery.
• Sensitive Personal Data (SPDI): Height, weight, BMI, medical history, current medications, allergies, lab results, and clinical assessment responses you provide during screening. This is classified as Sensitive Personal Data or Information under Indian law and is subject to enhanced protections throughout this policy.
• Consultation data: Notes created by your physician, e-prescriptions and prescription documents you provide, medication instructions, assigned care-plan and education items, follow-up tasks, and video recordings and transcripts of consultations, together with the consultation schedule and your recorded consents, all kept as part of your medical record. You consent to recording on the screen shown before your first consultation, and you may withdraw that consent for future consultations at any time (see Sections 6 and 10).
• Saved protein-tracker days: If you press Save in the protein tracker on a buying guide, we keep that day: your age group, activity level, weight, height, the foods you logged and the result. It is kept in your account, apart from your medical record, and is used to fill in your weight and height the next time you use the tracker. You can delete your saved days from the tracker at any time, and they are deleted if you ask us to erase your data.
• Payment data: Transaction records only. We do not store card numbers. Payments are processed by PCI-DSS compliant third-party processors using tokenisation.

2.2 Data collected automatically

• Usage data: Aggregate traffic and request-performance information at our Cloudflare network edge. Cloudflare processes connection information such as an IP address to serve and protect the site, but we use its aggregate reports rather than a browser analytics beacon.
• Analytics data: A small set of explicit funnel events collected via PostHog only after you grant cookie consent. Masked interaction replay may run on four general public pages, but is stopped before intake, pharmacy, account, consultation, prescription, payment, or patient pages. We disable automatic click events, automatic page tracking, IP capture, and user profiles; all input values are masked.No user-provided health answers, clinical records, or form contents are shared with PostHog. We do not run any advertising pixel on this website. See Section 9, which also explains the separate advertising measurement we do from our own servers.
• Advertising attribution: Campaign source, medium, and name from advertising links, stored in your browser and used for internal analytics only; and a record of the campaign or link through which you first reached the website, captured before any personal details are provided and not linked to your identity. After an intake completion or payment, we also keep a short-lived delivery record linking the generic conversion status to your account so failed server-side measurement can be retried as described in Section 9.2. It contains no health or treatment information.
• Service communications log: Records of the service communications sent to you, such as appointment reminders, confirmations, and assigned education, including delivery status. If you contact us on WhatsApp, this also includes your messages, our replies, and records of staff handling the conversation. We also keep registers needed to honour communication opt-outs.

3. Legal basis for processing

• Explicit consent: Analytics cookies (granted via the cookie banner on your first visit); video recording of consultations (granted before your first consultation, withdrawable for future consultations); marketing emails (a separate, optional opt-in you can withdraw at any time).
• Contractual necessity: Processing required to deliver the clinical services you have enrolled in.
• Legal obligation: Retention of medical records for the period Indian medical regulations require.
• Legitimate interest: Fraud prevention, platform security, and service improvement — balanced against your privacy rights.
• Outside the Act: De-identified information is not personal data, so the research and software work in Section 4.1 sits outside the DPDP Act once identifiers are removed. Anything that could still identify you stays inside it, and we would ask you before using it that way.

4. How we use your data

• So a registered physician can screen you clinically and hold your consultation.
• To coordinate prescription fulfilment through licensed pharmacy partners.
• To provide care coordination: follow-up check-ins, care guidance, and nutrition support.
• To communicate with you via WhatsApp or email, for purposes you have consented to.
• To measure advertising effectiveness — via analytics cookies where you have consented, and via the server-side measurement described in Section 9.2, which uses a one-way encrypted form of your email address and phone number and no health data.
• To comply with Indian laws, regulations, and lawful legal processes.
• To improve platform safety, our clinical protocols, and the software our own clinicians use, through de-identified analysis of what happens in care. See Section 4.1.

We do not sell your personal data to any third party. We do not use your health or clinical data for advertising targeting, audience profiling, or behavioural segmentation.

4.1 Research and improving our clinical software

Weight care in India is poorly studied, and what happens in your care is the evidence that is missing. We analyse it in de-identified form: your measurements, your consultations, and what your doctor decided, with your name, contact details and anything else that identifies you removed. We use that to improve our protocols and to build and test the software our own clinicians use.

We may also publish findings from that work, or share de-identified information and the conclusions drawn from it with research partners, universities, and companies that develop treatments in this field. That is not a plan we have acted on, and nothing about it changes the sentence above: de-identified information is not your personal data, and we do not sell your personal data.

If we ever want to share information that could identify you, we will ask you first, and you can say no without it affecting your care. Refusing has no effect on your treatment, your plan, or how your doctor sees you.

5. Data sharing

We share your data only with the following categories of recipients, and only to the extent necessary:

5.1 Your clinical team

• Prescribing physician: Independent registered physician (MD Medicine or Endocrinology) who needs your medical history to provide care.
• Clinical nutritionist and care coordinator: Limited to information required for their specific role. They do not have access to your full medical record.

5.2 Service providers (data processors)

We require every third-party processor to enter into a written Data Processing Agreement obliging them to protect your data to at least the standard set out in this policy. We do not enable a processor for clinical or identifying data until that agreement is in place.

5.3 Law enforcement

We disclose data to law enforcement or regulatory authorities only when required by a valid court order or applicable Indian law. We will notify you of such requests to the extent legally permitted.

6. How long we keep it

You can delete your data yourself, from your privacy settings. We stop all marketing immediately and delete everything we are not required by law to keep. Your account stays open, so you keep your login and your access to the record we must retain. Two kinds of record we must keep: your medical record and our payment records, both under your name — a medical record your doctor cannot match to you is not the one the law requires them to keep. Copies held by the companies that run our video calls and our payments stay with them for the same reasons; the company that sends our email removes its copies on its own schedule, so those are not gone the moment your deletion is confirmed.

7. Cross-border data transfers

Your clinical and personal data is stored in India (Supabase ap-south-1, Mumbai region). One exception applies to video consultations: the live call is carried by our video provider (Daily.co), whose infrastructure may route the live audio and video internationally, and recordings of consultations are currently stored with that provider outside India while we complete a migration to India-resident storage. We do not otherwise transfer your clinical data outside India without your explicit consent.

When you accept analytics cookies, limited pseudonymous funnel events are processed by PostHog on its US cloud servers. On four general public pages, PostHog may also receive a masked interaction replay. Input values are masked, URL queries and fragments are removed, and recording stops before intake, pharmacy, account, consultation, prescription, payment, or patient pages. PostHog does not receive your name, contact details, user-provided health answers, clinical records, or form contents. By accepting analytics cookies, you consent to this limited cross-border transfer of pseudonymous data.

Declining analytics cookies stops the PostHog transfer. Two transfers are not controlled by the banner: the server-side advertising measurement described in Section 9.2, and the video routing and recording storage described above.

8. Data security

• Encryption in transit: TLS 1.2+ on all connections.
• Encryption at rest: AES-256 for all stored data.
• Access controls: Role-based access. Your health data is accessible only to your assigned care team and is segregated from marketing and analytics systems.
• Audit logging: Consultation transcripts, and recordings accessed through our platform, cannot be read without recording who read them, when, and why — the read path is the logging path.
• Vulnerability management: Automated dependency, secret and static-analysis scanning runs on every change to our systems.

8.1 Breach notification

In the event of a personal data breach affecting your data:

• We will notify affected users within 72 hours of discovery via email and in-app notification.
• The notification will include: nature of the breach, categories and approximate number of individuals affected, likely consequences, steps we have taken or propose to take, and what you can do to protect yourself.
• We will report material breaches to the relevant Indian regulatory authority as required by the DPDP Act.

9. Cookies and tracking

9.1 Essential cookies

Required for the platform to function (session management, authentication, security). These cannot be opted out of while using the service.

9.2 Analytics cookies and advertising measurement

We use the following tools. Product analytics is activated only after you accept cookies via the consent banner on your first visit; the advertising measurement is server-side and is not controlled by cookies:

• Advertising measurement, from our servers — when you complete the creation of a verified profile, complete the intake form, confirm a consultation payment, or activate a membership, we send a one-way hashed form of your email address and phone number to the advertising platforms we buy from (Meta, Reddit, LinkedIn and X), so they can tell us that an advert worked. We never send your name, your health information, or anything about your treatment, and the platforms cannot read the address or number from what we send. This happens on our servers rather than in your browser, so it is not controlled by the cookie banner. To object to it, email our Data Protection Officer.
• PostHog — captures explicit funnel events such as which numbered onboarding step is reached. With consent, it also records masked interaction replay on four general public pages, stopping before every intake, pharmacy, account, consultation, prescription, payment, and patient page. Input values, query strings, and URL fragments are excluded. Automatic page and click events, IP capture, and identified user profiles are disabled. Your name, contact details, date of birth, health answers, record identifiers, and other form fields are never transmitted to PostHog. Data is processed by PostHog, Inc. on US cloud servers (app.posthog.com). You can opt out at any time by declining or withdrawing cookie consent (see below).

To withdraw or change cookie consent: Use the button below and choose “Decline”. This stops replay and future PostHog collection immediately. You may also email privacy@kilocare.in.

10. Your rights under the DPDP Act, 2023

You have the right to:

• Access: The categories of personal data we hold are set out in Section 2, and you can download your own copy of the data itself from your privacy settings. The file contains what you told us at sign-up, your health information, your consultations and appointments, your prescriptions, your membership, and the choices you have made. Four things are not in it: your physician's own consultation notes, consult recordings and transcripts, lab report files you uploaded, and your pharmacy orders. Email us for any of those.
• Correction: Correct your details and your health information yourself from your dashboard at any time. If something a clinician wrote is wrong, tell us and we will add a correction to the record.
• Erasure: Delete your data yourself, from your privacy settings. We stop all marketing immediately and remove everything we are not required to keep. Your account stays open, so you keep your login and your access to the record we must retain. Two kinds of record are retained rather than deleted, because the law requires them: your medical record, and our payment records. We will tell you which ones and why. See Section 6.
• Withdraw consent: Turn off marketing emails from your privacy settings. To withdraw your consent to consultation recording, email our Data Protection Officer. It applies to future consultations, and because recording is part of how your care is delivered we will talk with you about how that care continues. Analytics cookies are withdrawn as described in Section 9.2. Withdrawal does not affect the lawfulness of processing that already happened — in particular, it does not remove a recording already made.
  Unsubscribing from an email is not the same act as turning marketing off in your settings, and we treat it as the stronger one. It is recorded against the email address rather than the account, and turning the setting back on does not undo it — someone who unsubscribed from their inbox should not be re-subscribed by a toggle. Email us from that address and we will lift it.
• Grievance redressal: File a complaint with our Data Protection Officer (below). If not resolved to your satisfaction, you may escalate to the Data Protection Board of India.
• Nominee designation: Designate a nominee to exercise your data rights in the event of your death or incapacity, as provided under the DPDP Act.

Most of this you can do yourself from your privacy settings. For anything else, email our DPO at privacy@kilocare.in with the subject line “Data Rights Request.” That covers a full copy of your data, a deletion request, a correction to clinical notes, or a complaint.

11. Children's privacy

KiloCare is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor without verifiable parental consent, we will delete it promptly.

12. Changes to this policy

Material changes will be communicated via this website with an updated effective date. Active users are also notified directly, by email, at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance of the updated policy.

13. Data Protection Officer and Grievance Officer

Data Protection Officer (data-protection queries and DPDP rights requests)
KiloCare (operated by Continuum Protocols Private Limited)
Registered office:
No. 58-B, Dhanapal Layout, 2nd Floor,
Shettihalli, Jalahalli West, Bangalore North,
Bangalore 560015, Karnataka, India
Email: privacy@kilocare.in
Response time: within 30 days of receipt

Grievance Officer (complaints under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021)
KiloCare (operated by Continuum Protocols Private Limited)
Registered office:
No. 58-B, Dhanapal Layout, 2nd Floor,
Shettihalli, Jalahalli West, Bangalore North,
Bangalore 560015, Karnataka, India
Email: grievances@kilocare.in
We acknowledge grievances within 24 hours and resolve them within 15 days.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDP Act, 2023.