Privacy Policy

1. Introduction & DPDP Compliance

The Mavanta platform (operating under the brand "Māvanta") is owned and operated by sole proprietor Madhavan C ("the Owner"). We are committed to protecting personal and clinical data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

Under the DPDP Act 2023 framework:
• Your Practice / Business is the Data Fiduciary.
• Māvanta is the Data Processor processing data solely under your instruction.

2. Data Security & Encryption

We implement technical and organizational safeguards to ensure strict multi-tenant data isolation:

• Encryption in Transit: All API and browser data is protected using TLS 1.3 / SSL encryption.
• Encryption at Rest: Vault databases and client records are encrypted using industry-standard AES-256 encryption.
• Data Residency: All production data resides on AWS cloud servers located within Indian Territory (Mumbai/Hyderabad).

3. Data Collection & Usage Purpose

We collect and process data strictly for internal practice administrative operations:

• Account Credentials: Owner/Staff names, professional email, phone number, and tax/billing profiles.
• Practice Operations Data: Appointment calendars, staff attendance logs, and financial transaction ledgers.
• Client Data: Client profiles, milestone evaluations, and session tracking logged by the Data Fiduciary.

4. Statutory Rights under DPDP Act 2023

As a user or Data Principal under Indian law, you possess statutory rights including:

• Right to Correction: Request updates to inaccurate or incomplete registration data.
• Right to Erasure: Request deletion of personal data once the administrative purpose is fulfilled.
• Right to Data Portability: Export complete vault records in structured CSV or JSON format.

5. Data Retention & Vault Ownership

Your practice owns 100% of its data vault. Account owners can download a complete backup of their practice vault data directly via Settings → Compliance & Safety → DPDP Data Privacy. Upon account termination, we provide a 30-day grace period during which a full data export may be requested, after which vault databases are permanently purged.