Skip to main content
MyFloww

Legal

Privacy policy

Last updated 7 August 2026

Draft — not yet reviewed by legal counsel. This document is a working draft prepared for MyFloww and must be reviewed by a qualified Indian legal practitioner before it is relied upon. Questions to connect@myfloww.in.

This policy explains what personal data MyFloww collects, why we collect it, how we look after it, and what you can ask us to do with it. It is written against the principles of India’s Digital Personal Data Protection Act 2023 (the “DPDP Act”).

1. Who we are

MyFloww operates the website at myfloww.in and the Kinetiq and Kinetiq Enterprise. Our address is Vinayaka Complex, 2nd Floor, Vasanthapura, Uttarahalli Road, off ISRO Layout, Sharada Nagar, Bengaluru — 560062, India. You can reach us at connect@myfloww.in or on +91 96206 89860.

For the purposes of the DPDP Act, MyFloww is the Data Fiduciary in respect of data we collect about you directly — for example when you use this website or subscribe to our services.

2. Two different relationships

It matters which of these describes you, because our role is different in each.

You are a visitor to this website, or you contact us
We are the Data Fiduciary. This policy describes what we do with your data.
You are a practitioner or clinic using MyFloww
We are the Data Fiduciary for your account data, and a Data Processor acting on your instructions for the patient data you put into the system. Your patients’ data belongs to you and your patients, not to us.
You are a patient of a clinic that uses MyFloww
Your relationship is with your clinic. They decide what is recorded about you and why. We hold that data on their behalf and act on their instructions. Please direct requests about your records to your clinic in the first instance.

3. What we collect

When you use this website

  • Anything you type into a form: your name, email address, phone number, practice name and your message.
  • Standard technical information your browser sends to any web server, such as your IP address and browser type, recorded in server logs.

This website does not set analytics or advertising cookies. If we add analytics in future, this policy will be updated before it goes live.

When you subscribe to MyFloww

  • Account details: your name, email address, phone number and practice details.
  • The logins you create for your therapists and assistants.
  • Billing information necessary to take payment for your subscription.
  • The clinical and operational data you enter — patient records, case sheets, prescriptions, treatment plans and payment records.

4. Why we collect it, and on what basis

We process personal data for specified, lawful purposes, and only for as long as those purposes require. Specifically:

  • To provide the service you asked for. Running your account, storing your records, taking payment for your subscription.
  • To reply to you. If you send us a message, we use your contact details to answer it.
  • To keep the service secure and working. Detecting abuse, diagnosing faults, maintaining backups.
  • To meet legal obligations. Where the law requires us to keep or produce records.

We do not sell personal data. We do not use your patient data to train machine-learning models. We do not send marketing to people who have not asked for it.

5. Who we share it with

We share personal data only with service providers who need it to deliver the service — for example hosting and infrastructure providers, payment processors and email delivery services — and only to the extent necessary for them to perform that function. They are bound to protect it and may not use it for their own purposes.

We will disclose data where we are legally required to do so, and we will tell you when we are permitted to.

6. Where it is stored, and how it is protected

Patient data on MyFloww is hosted in India, encrypted in transit and at rest, and access is controlled by role so that staff accounts can only reach what their role requires.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss and misuse. No system can be guaranteed absolutely secure, and we would rather say that plainly than imply otherwise.

MyFloww does not currently hold HIPAA, ISO 27001 or SOC 2 certification, and does not claim to. HIPAA is a United States healthcare regulation and does not apply to an Indian practice.

7. How long we keep it

  • Enquiries: kept for as long as needed to deal with the enquiry and a reasonable period afterwards.
  • Account and clinical data: kept for as long as your subscription is active. On closure, we will return or delete it in accordance with your instructions and any legal retention requirement that applies to clinical records.
  • Financial records: kept for the period Indian law requires.

8. Your rights under the DPDP Act

As a Data Principal under the DPDP Act 2023, you have the right to:

  • Access a summary of the personal data we hold about you and how it is being processed.
  • Correct or complete data that is inaccurate or out of date, and to have it updated.
  • Erasure of your personal data, where we are not required by law to keep it.
  • Grievance redressal — to complain to us and receive a response, and to escalate to the Data Protection Board of India if you are not satisfied.
  • Nominate another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these, write to connect@myfloww.in. We will respond within a reasonable period. If you are a patient of a clinic that uses MyFloww, please contact your clinic first, as they control your record.

9. Grievance officer

Complaints about how we handle personal data should be sent to connect@myfloww.in, marked for the attention of the Grievance Officer, or by post to Vinayaka Complex, 2nd Floor, Vasanthapura, Uttarahalli Road, off ISRO Layout, Sharada Nagar, Bengaluru — 560062, India.

10. Children

This website is not directed at children. Where a clinic records data about a patient under eighteen in MyFloww, the clinic is responsible for obtaining verifiable consent from a parent or lawful guardian, as the DPDP Act requires.

11. Changes to this policy

If we change this policy we will update the date at the top of the page. Where a change materially affects how we use your data, we will tell you directly rather than rely on you noticing.

12. Governing law

This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka.