Legal information

Privacy Policy

This policy explains how Swastha 360° handles information when you visit our website, create an account, use Google Sign-In, or use patient and care-related features.

Effective:: August 16, 2026
Last updated:: October 28, 2026

1. Who we are and when this policy applies

Swastha 360° operates the website and application available at myswastha360.com. In this policy, “Swastha 360°”, “we”, “us”, and “our” refer to the operator of that service.

This policy applies to information handled through the public website, account authentication, patient portal, appointment and clinical workflows, notifications, and related support and security operations. It does not replace the privacy notices or professional duties of an independent clinician or healthcare facility.

2. Information we handle

Account and identity information

This may include your name, email address, authentication identifiers, account role, profile image, and account status. Passwords and authentication sessions are managed through Supabase Auth rather than stored in application page code.

Patient profile information

Depending on what you provide, this may include phone number, date of birth, gender, address, blood group, allergies, medical history, chronic conditions, current medicines, dosha information, and emergency-contact details.

Appointments and care information

We handle appointment dates, times, assigned clinicians, booking reasons, status and cancellation information. First Visit Forms may contain identification and contact details, health measurements, reason for visit, medical conditions, medicines, allergies, prior Ayurveda treatment, and consent acknowledgements.

Symptoms, consultation, and treatment information

Patient features may contain symptom descriptions and reports, severity and timing, possible-condition outputs, clinician review information, consultation notes, diagnosis, treatment plans, prescriptions, lifestyle or dietary recommendations, and follow-up dates.

Notifications and preferences

We store in-app notification content, delivery and read status, links to related records, and notification or email preferences.

Charges and payment records

Where billing features are used, records may include an appointment charge, currency, payment status, amount recorded, payment-method category, receipt reference, and the authorized staff account that recorded a transaction. This policy does not imply that every payment method or online payment facility is available.

Technical and security information

Use of the service may generate IP address, browser or device information, request and authentication timestamps, diagnostic events, and security or operational logs. The application also uses browser storage for authentication sessions and theme preferences.

3. Google Sign-In data

Patients and administrator-approved Therapists may optionally use Google Sign-In through Supabase for authentication and account setup. Signing in with Google does not by itself grant access to staff functions or other patients’ records. Under the current sign-in scopes, Swastha 360° may receive basic Google identity and profile information such as your Google account identifier, name, email address, email verification status, and profile image when Google provides it.

We use this information to authenticate you, create or connect your Swastha 360° account, display basic account information, prevent abuse, and support account access. Google Sign-In does not give Swastha 360° access to your Gmail messages, Google Drive files, Google Calendar, contacts, or other Google service content. The application does not request those permissions.

Google authentication is processed by Google and Supabase under their respective terms and privacy practices. You may review or revoke connected access in your Google Account connections. Removing Google access does not by itself delete records already held in your Swastha 360° account; contact us if you also want to request account or data deletion.

Google data storage, sharing, and deletion

Google identity information is stored in Supabase Auth and the account or profile records needed to operate your account. Authentication sessions are also maintained in your browser’s storage. Supabase processes identity and session information to provide authentication; authorized staff may access account details as needed for account support and permitted hospital operations. We do not sell Google user data or use it for personalized advertising.

We retain Google identity information while needed to provide and secure your account. To request deletion of your account and associated Google identity data, email myswastha360@gmail.com. We may verify your identity before acting. Clinical, payment, security, or other records may need to be retained as explained in section 6, even after account access is closed. Revoking Google access stops future authorization but does not automatically erase information already stored by Swastha 360°.

4. Why we use information

To create, authenticate, secure, and support user accounts.
To provide patient profiles, appointments, intake forms, and care workflows.
To allow authorized clinicians to review information connected to their patients and appointments.
To provide consultation information, prescriptions, follow-up information, and patient-visible records.
To send service, appointment, account, and security communications according to available preferences.
To operate billing records where those functions are enabled.
To diagnose errors, protect the service, prevent misuse, and maintain operational records.

Information is made available according to application roles and care relationships. Patients can access their own permitted records. Verified clinicians can access limited patient information when an authorized appointment or clinical relationship exists. Authorized administrative or operational access is limited to functions made available for operating the service.

We use service providers to operate specific parts of Swastha 360°:

Supabase provides authentication, database, storage, and backend services.
Google provides optional Patient Google Sign-In and hosted web-font resources used by the interface.
Resend processes email addresses and message content needed to deliver transactional emails.
Vercel hosts and delivers the web application.
Cloudflare supports domain, DNS, and related network or security services.

These providers receive information only as needed for the services they perform. They may maintain their own operational and security logs under their terms and privacy notices. We may also disclose information when required by applicable law or to protect users, the service, or others from harm or misuse.

6. Retention

We retain information for as long as reasonably needed to operate accounts and care workflows, maintain appropriate clinical and transaction records, address security or support matters, resolve disputes, and meet applicable obligations. Retention periods can vary by the type of record and why it is held. A deletion request may not require removal of records that must be retained or that are needed to protect legitimate rights.

7. Security

Swastha 360° uses measures such as managed authentication, role-based access checks, database access policies, restricted privileged operations, and service-provider safeguards. No internet service or storage system can be guaranteed completely secure. Protect your password, use a secure device, and notify us if you believe your account has been accessed without permission.

8. Your choices and requests

Available profile and notification controls let you review or update certain information. You may also ask to access, correct, or delete information associated with your account, or ask questions about how it is handled. Requests may require identity verification and remain subject to applicable record-retention, security, and legal requirements.

9. International processing

Swastha 360° relies on service providers that operate infrastructure in multiple countries. Information may therefore be processed or transferred outside the country where you are located, subject to the providers’ arrangements and applicable safeguards. We do not represent that all information is stored only in Sri Lanka.

10. Changes to this policy

We may update this policy as the service, providers, or data practices change. The date above will be updated when a revised policy is published. Material changes may also be communicated through the service or another appropriate channel.

11. Contact us

For privacy questions or requests, email myswastha360@gmail.com. Please do not include passwords or unnecessary health details in an email. You can also return to the Swastha 360° contact section for current public contact information.