ReportSense

Privacy Policy

Effective date: 21 September 2026

ReportSense ("we", "our", "us") is committed to protecting your personal and health data. This Privacy Policy explains what data we collect, how we use it, and your rights under India's Digital Personal Data Protection (DPDP) Act 2023.

By using ReportSense, you agree to the practices described in this policy. If you do not agree, please do not use our services.

1. Data we collect

Account data

  • Email address or phone number (via Supabase Auth)
  • Phone numbers used for OTP (one-time password) login are sent to our SMS provider to deliver the verification code
  • If you refer someone, the phone number you share is processed to manage referral rewards
  • Family profile details: name, date of birth, gender, relationship

Health data

  • Lab report PDFs you upload
  • Extracted parameter values and AI-generated explanations
  • Historical report data for trend tracking

Usage data

  • Device type, browser, and general location (country/state)
  • Pages visited and features used - for improving the product
  • Error logs via Sentry (anonymised where possible)
  • If you submit a testimonial, we store the IP address and browser user agent of that submission, used only to prevent spam and abuse

Testimonial submissions

  • If you submit a testimonial through our "Share your experience" form, we store the name, written experience, and rating you enter, plus the city and state if you choose to add them
  • The form does not ask for an email address or any other contact detail. Separately, as noted above, we store the IP address and browser user agent of the submission for spam prevention
  • All of it - name, written experience, rating, city and state - is published on our site only if you tick the consent checkbox on that form, and only after we review the submission

2. How we use your data

  • To provide the ReportSense service and generate lab report explanations
  • To send you emails about your account, and, unless you opt out, occasional product updates and offers (see below)
  • To improve accuracy of parameter extraction and AI explanations
  • To process payments (Razorpay) for Pro subscriptions
  • To publish testimonials on our site, with your consent, from what you submit through our testimonial form
  • To comply with applicable laws and regulations

We will never sell your data to third parties, insurers, employers, or advertisers.

Emails we send

There are two kinds, and they are treated differently:

  • Account emails - a welcome message when you sign up, payment receipts, and notices about your account. These are part of the service and cannot be switched off while your account exists. They never contain offers.
  • Updates and offers - occasional emails about new features, requests for your feedback, and offers. You can stop these at any time, either with the unsubscribe link at the bottom of any such email or from the Settings screen in the app. Stopping them does not affect your account emails or your access to ReportSense.

We record whether an email was delivered, bounced, or was reported as spam, so that we stop emailing an address that does not work and stop emailing anyone who tells us to. We do not use tracking pixels and we do not track whether you open an email or click a link in it. Your email address is never shared with advertisers, and we never put your lab results, parameter names, or any health detail in an email.

3. Data storage and security

Your data is stored on Supabase (PostgreSQL), hosted on AWS infrastructure in the ap-south-1 (Mumbai) region. All data is encrypted at rest and in transit (TLS 1.2+). Row-level security is enforced - you can only access your own data.

Lab report PDFs are stored in Supabase Storage with access restricted to your account only.

4. Third-party services

We use the following third-party services to operate ReportSense:

  • Supabase - database, authentication, and file storage
  • Railway - backend/API hosting (where lab report data is processed)
  • Anthropic (Claude) - AI processing of lab report content
  • Razorpay - payment processing (we store a recurring payment mandate token, not your card or bank details)
  • Fast2SMS - SMS delivery for OTP login (receives your phone number only)
  • Resend - email delivery (receives your email address and the content of the emails we send you, which never includes health data)
  • Sentry - error monitoring
  • Vercel - website hosting
  • Google Analytics - anonymous usage analytics on our public marketing pages only (not inside the app)
  • Microsoft Clarity - anonymous usage analytics and heatmaps on our public marketing pages only (not inside the app)
  • Meta Pixel - advertising and audience analytics on our public marketing pages only (not inside the app)

Each of these providers has their own privacy policy and data processing terms. Your health data is shared with Anthropic solely for the purpose of generating explanations - it is not used to train their models. For text-based reports we remove identifying details (name, phone, date of birth, ID numbers, address, and your doctor's name) before the content is sent for analysis. Some scanned or photo-based reports can only be read as an image; in that case the page image is sent to Anthropic, which does not store or train on it.

5. Your rights under DPDP Act 2023

As a data principal under India's DPDP Act 2023, you have the right to:

  • Access - request a copy of the personal data we hold about you
  • Correction - request correction of inaccurate or incomplete data
  • Erasure - request deletion of your account and all associated data
  • Grievance redressal - raise a complaint with us or the Data Protection Board
  • Withdraw consent - opt out of data processing at any time (may affect service availability), including stopping our update and offer emails from Settings or the unsubscribe link in any such email

To exercise any of these rights, email us at support@reportsense.in. We will respond within 72 hours.

6. Data retention

Account and health data is retained as long as your account is active. Upon account deletion, all personal data and uploaded reports are permanently deleted within 30 days.

The only exception is minimal financial transaction records (such as payment amount, date, and transaction ID) that we are legally required to retain for tax and accounting purposes. These records contain billing data, not your health reports, and are kept only for as long as the law requires.

A testimonial submission is not tied to an account, so the deletion process above does not apply to it. We retain testimonial submissions, published or not, for as long as needed for moderation and site display. To have a testimonial removed, email us at support@reportsense.in and we will delete it.

7. Children's privacy

ReportSense is not intended for children under 18 as the primary account holder. Family profiles for minors may be created and managed by a parent or guardian.

8. Changes to this policy

We may update this policy as the product evolves. Material changes will be notified via email. Continued use after notification constitutes acceptance.

9. Contact us

For privacy-related questions, data requests, or complaints: