- We collect very little: technical data when you visit, anything you choose to email us, and, only if you play our game and submit a score, the nickname you enter.
- We do not want patient health records on this website or by email. Please do not send them to us.
- We do not sell personal data. We run no advertising and no cross-site tracking, and we set no cookies of our own. The only counter on the site is a simple visit total (see section 3).
- Hospitals that use the Vitaloop platform are responsible for their own patients’ data; see Patient data and the Vitaloop platform.
- Questions or complaints: Nihar Bholane, Data Protection Officer and Grievance Officer, shobhit@vitaloop.in.
1. Who we are and which laws apply
This website (vitaloop.in) is operated by VITALOOP LLP (LLPIN ADC-3019), registered office: Flat No. 7, Bldg B4, Sarita Nagari Phase-II, S.P. College, Sinhgad Road Police Station, Pune City, Pune – 411030, Maharashtra, India (“Vitaloop”, “we”, “us”). For the personal data described in this policy, Vitaloop decides why and how the data is used, so Vitaloop is the “data fiduciary” (the data controller).
Today we handle personal data in line with section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are being phased in, with most duties applying from May 2027. This policy is already written to the notice standard those Rules set: itemised data, specific purposes, and clear ways to withdraw consent, exercise your rights and complain.
We are building Vitaloop to work within India’s Ayushman Bharat Digital Mission (ABDM). In line with the ABDM Health Data Management Policy, we publish this privacy policy, a privacy-by-design policy, our grievance officer’s details and our breach-management procedure on this website.
2. What we collect, why, and on what basis
We collect data in two ways: automatically, when your browser loads our pages, and from you, when you email us or play the game. Nothing here is collected from children knowingly (see Children).
| What | When | Why we use it | Basis |
|---|---|---|---|
| Technical dataIP address, browser and device type, pages requested, date and time | Every visit, automatically | To deliver the site, keep it secure and diagnose faults | Needed to serve the pages you asked for and to keep the service secure |
| Your enquiryYour name, email address, organisation and anything you write | When you email nihar@vitaloop.in (for example to ask about Vitaloop) | To reply and follow up on your request | You provide it for that purpose; you can withdraw at any time |
| Game dataA nickname (up to 12 characters) and a score | Only if you play the medivac game and submit a score | To show a public leaderboard | Your consent, given when you press “Submit score” |
| Settings in your browserVisit count, best score, nickname, a local copy of the leaderboard | Stored on your own device | To make the site work as you left it | Stays on your device; see the browser storage table below |
We do not collect financial information, government identifiers, health records, precise location or biometric data through this website, and we do not ask for them.
3. Who else receives data
We use a small number of outside services. Each receives the data a web server ordinarily receives (your IP address and browser details) when your browser contacts it, plus whatever is noted below. These providers act under their own terms; we do not control their practices, and we keep the list short on purpose.
| Provider | What it receives | Why | Where to learn more |
|---|---|---|---|
| Cloudflare, Inc.Hosting (Cloudflare Pages), DNS and content delivery | Visitor request data (including IP address and browser details) for every page | Hosting, content delivery, DNS and protection against abuse | cloudflare.com/privacypolicy |
| Google Fontsfonts.googleapis.com and fonts.gstatic.com | Your IP address and browser details when the home page or the “something is cooking” page loads, so that the Inter typeface can be delivered | Displaying the site’s typeface | policies.google.com/privacy |
| Abacus visit counterabacus.jasoncameron.dev, operated by Jason Cameron | Your IP address and browser details when the home page loads; it returns a visit total. We receive a number, not your details | The “site visits” counter on the home page | We could not find a published privacy policy; contact: abacus@jasoncameron.dev |
| ntfy.shPublic notification service | If you play the game and reach the leaderboard: your IP address and browser details when the leaderboard is read; your nickname and score if you submit | The public game leaderboard | docs.ntfy.sh/privacy |
| Our email provider | Emails you send us, with your name, address and content | Receiving and answering your messages | Ask us; we will name the provider on request |
This page, and the other legal pages linked from the footer, load nothing from third parties: no outside fonts, scripts or trackers. The home page and the “something is cooking” page load the Inter typeface from Google Fonts. The home page also contacts the visit counter, and the game contacts the leaderboard service, as listed above.
We may also share personal data with professional advisers under a duty of confidence, and with a court, regulator or other authority where the law requires. We do not sell personal data.
4. Cookies, local storage and similar technologies
We do not set cookies of our own, and we do not use advertising or cross-site tracking; the only analytics is the simple visit counter described in section 3. We do use your browser’s own storage for the items below. It stays on your device, and you can clear it at any time in your browser settings.
| Item | Kind | Purpose | Lasts |
|---|---|---|---|
vlVisits | Local storage | A fallback visit count if the counter service cannot be reached | Until you clear it |
vlHeliBest | Local storage | Your best score in the medivac game | Until you clear it |
vlHeliName | Local storage | The nickname you last used in the game | Until you clear it |
vlHeliBoard | Local storage | A local copy of the leaderboard for when the online one is unavailable | Until you clear it |
5. The public game leaderboard
If you play “Vitaloop Medivac” and press “Submit score”, the nickname you typed (up to 12 characters) and your score are posted to a public leaderboard hosted on the ntfy.sh service. Anyone can read that leaderboard, and anyone who learns its address could post to it.
Please use a nickname, not your real name, and do not type contact details. The service holds messages for a short period (its published default is 12 hours), and we keep no separate copy. To have an entry removed sooner, write to the Grievance Officer; we will replace the leaderboard without it.
6. How long we keep data
| Data | How long |
|---|---|
| Hosting and delivery logs | For the period the hosting provider keeps them. We do not use them for any purpose other than running and securing the site. |
| Emails and enquiries | While we deal with your request, and for up to 24 months after our last contact. If a contract follows, we keep records for as long as the contract and the law require. |
| Leaderboard entries | Until the service drops them (its published default is 12 hours), until pushed out of the top ten, or until you ask us to remove them. |
| Data in your browser | Until you clear it. |
When a retention period ends, we delete or irreversibly anonymise the data, unless a law or a legal claim requires us to keep it.
7. Patient data and the Vitaloop platform
Vitaloop is building a hospital information system (HMIS/EHR). It has no live hospital deployments at present. This policy does not describe hospital patient data.
When the platform is in use, each hospital or clinic decides why and how its patients’ data is used, so the hospital is the data fiduciary. Vitaloop acts as a data processor: it handles that data only on the hospital’s written instructions, under a written agreement. Hospitals give their patients their own privacy notice, and are the first port of call for patients’ requests and complaints.
If a patient writes to us instead, we will pass the request to the hospital promptly and support it. We will not answer on the hospital’s behalf unless it instructs us to. We do not sell identifiable patient data, and we do not use it for advertising.
Where Vitaloop is a data fiduciary in its own right, for example for the login details of hospital staff who use the platform, and for prospect data, this policy applies. The Privacy-by-Design Policy describes how the platform is designed to protect patient data.
8. Where data is processed
This website is served through Cloudflare and the other providers listed in section 3. Their servers may be outside India, and Cloudflare operates a global network, so a request from India may be handled on servers abroad. The personal data involved is limited to what section 2 describes.
The Vitaloop hospital platform is designed to store and process patient data in India. See the Privacy-by-Design Policy.
9. How we protect data
- Our pages are served over HTTPS.
- We keep this website simple: it has no contact forms and no database of visitors. Emails sit with our email provider, not on the site.
- Access to our hosting, code and email accounts is limited to the small number of people who need it.
- We follow the breach-management procedure if something goes wrong.
No system is perfectly secure. If you find a security problem, please tell us using the details on the breach procedure page.
10. Children
This website is meant for adults and healthcare professionals. We do not knowingly collect personal data from anyone under 18, and we do not track, profile or advertise to children. If you believe a child has given us data, for example a nickname in the game, write to the Grievance Officer and we will delete it.
11. Your rights and how to use them
You can ask us to:
- tell you what personal data of yours we hold and how we use it;
- correct or complete data that is wrong;
- erase data we no longer need (where a law requires us to keep it, we will tell you which law);
- stop using data on the basis of your consent, by withdrawing that consent. This is as easy as giving it: for example, stop emailing us or ask us to remove a leaderboard entry. Withdrawal does not affect anything we lawfully did before it;
- act on your behalf through a person you nominate, if you die or cannot exercise these rights yourself.
To use any of these rights, email the Grievance Officer at shobhit@vitaloop.in with the subject “Privacy request”, or use the format on the grievance page. We may need to check who you are, and we will ask for no more than we need. We acknowledge every request within 3 working days and respond within 30 days.
If you are not satisfied with our response, you can escalate as described on the grievance page: to the ABDM grievance portal and, as the DPDP Act comes into force, to the Data Protection Board of India.
12. Changes to this policy
We date and number each version of this policy. If we change it in a way that matters, for example by collecting new data or using it for a new purpose, we will update this page and, where the law requires, ask for your consent again before the change applies to you. We keep earlier versions and will send you one on request.
13. Contact and complaints
VITALOOP LLP, Flat No. 7, Bldg B4, Sarita Nagari Phase-II, S.P. College, Sinhgad Road Police Station, Pune City, Pune – 411030, Maharashtra, India
We acknowledge within 3 working days and respond within 30 days.
General enquiries: nihar@vitaloop.in. The full process, and how to escalate, is on the grievance page.