Privacy Policy — PetAasha Blood Connect

Effective date: 15 July 2026

PetAasha Blood Connect ("PetAasha", "we", "us", "our") is operated by Adarsh Dubey and Shreyash Pandey, the individuals jointly responsible for the platform. This policy explains what personal data we collect, why, how we use and share it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules").

It applies to https://petaasha.in and to any registration flow reached through a veterinary clinic's QR code.

1. Who we are

PetAasha is a platform that helps pet owners register their pets as potential blood donors, and helps verified veterinary clinics find compatible donors for animals that need emergency blood transfusions. For the purposes of the DPDP Act, the operators named above are the Data Fiduciary responsible for your personal data. You can reach us using the details in Section 13.

2. The data we collect

If you register as a pet owner, we collect:

  • Your name, mobile phone number, and general location (area and city)
  • Your account email address (and a securely hashed password — we never store your password in readable form)
  • Details about your pet(s): species, breed, age, weight, vaccination status, tick-fever history, and last blood-donation date
  • If you registered via a clinic QR code, the identifier of the referring clinic

If you register as a veterinary clinic or clinic staff member, we collect:

  • Clinic name, your name, and your role at the clinic
  • Clinic licence number
  • Contact phone number and email address
  • Your account email (and a securely hashed password)

Automatically, when you use the site:

  • Basic usage and analytics data (pages visited, actions taken, approximate device and browser information) used to understand and improve the registration experience. See Section 8.

We do not intentionally collect any special or sensitive categories of personal data beyond what is listed above, and we do not collect any payment information.

3. Why we collect it, and our lawful basis

We use your personal data only to:

  • Operate the platform and your account
  • Let verified veterinary clinics find eligible donors near them in an emergency
  • Enable a verified clinic to contact you (the owner) to request a blood donation for an animal in their care
  • Communicate with you about your account (for example, password reset and important service notices)
  • Understand and improve how registration works, in aggregate

We process your personal data on the basis of the consent you give when you register, in line with the DPDP Act. Your consent is specific to the purposes above, and you can withdraw it at any time — as easily as you gave it (Section 10).

4. How your contact details are shared — please read

This is the most important part of this policy.

When you register a pet as a donor, your pet's non-contact details (species, breed, age, weight, and availability) may be shown to verified veterinary clinics searching for a donor.

Your contact details (name and phone number) are never shown in search results. They are revealed to a verified clinic only when that clinic explicitly requests them for a specific donation need, and every such reveal is logged. This means a verified vet can, with the consent you give at registration, obtain your phone number in order to call you about donating blood for an animal in their care.

By registering, you consent to this specific sharing. If you do not want your contact details shared with clinics in this way, please do not register — or delete your account or withdraw consent at any time (Section 10).

5. Who we share data with

We share personal data only with:

  • Verified veterinary clinics — as described in Section 4, limited to what is necessary to arrange a donation.
  • Service providers (Data Processors) who process data on our behalf, under contract and only to run the platform:
    • Application hosting: Vercel
    • Database and authentication: Supabase
    • Product analytics: PostHog
    • Transactional email (account and service notifications): Resend

We do not sell your personal data to anyone, and we do not use it for advertising.

Some of these providers may process or store data outside India. The DPDP Act permits such transfers except to any territory the Central Government may restrict; where a transfer happens, we take reasonable steps to ensure your data remains protected consistent with applicable law.

6. How long we keep it

We keep your personal data for as long as your account is active and you remain registered as a donor or a clinic. If you delete your account or withdraw consent, we delete or irreversibly anonymise your personal data within a reasonable period — except where we are required to retain certain records to comply with law or to establish, exercise, or defend a legal claim.

7. How we protect your data

We apply reasonable technical and organisational safeguards, including database-level access controls (row-level security), encryption of data in transit, hashed passwords, and restricting who can access personal data to what is necessary. No system is perfectly secure, but we work to protect your information and to limit access to it.

8. Analytics

We use basic product analytics to measure how the registration flow performs — for example, how many people who scan a clinic QR code go on to complete registration, and where people drop off. This helps us improve the experience. We keep this data limited, we do not attach your name or phone number to analytics events, and we use it in aggregate wherever possible.

9. Your rights

Under the DPDP Act, you have the right to:

  • Access the personal data we hold about you and a summary of how we process it
  • Correct, complete, or update inaccurate or incomplete data (owners can edit most details from their dashboard)
  • Erase your data and delete your account
  • Withdraw consent at any time — after which we stop the processing that relied on it (this may mean we can no longer keep you registered as a donor)
  • Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity
  • Grievance redressal — raise a complaint with our Grievance Officer (Section 13) about how we handle your data

If you are not satisfied with our response, you may also complain to the Data Protection Board of India.

To exercise any of these rights, contact us using the details in Section 13. We will act on your request within the timelines required under the DPDP Rules.

10. Withdrawing consent and deleting your account

You can withdraw consent, or ask us to delete your account, at any time by contacting us (Section 13). Withdrawing consent to contact-sharing means clinics will no longer be able to see or request your details, and we will generally remove your donor registration. Withdrawal of consent does not affect the lawfulness of any processing we carried out before you withdrew.

11. Personal data breach

If a personal data breach affecting your data occurs, we will notify the Data Protection Board of India and affected users as required by, and within the timelines set out in, the DPDP Rules.

12. Children

PetAasha is intended for adults (18 years and older) registering their own pets, or acting on behalf of a veterinary clinic. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Contact and Grievance Officer

For any question, request, or complaint about your personal data:

  • Email: contact@petaasha.in
  • Grievance Officer: Adarsh Dubey — contact@petaasha.in. We will acknowledge your grievance promptly and work to resolve it within the timelines prescribed under the DPDP Rules.
  • Operated by: Adarsh Dubey and Shreyash Pandey, Chembur, Mumbai, Maharashtra 400071, India

14. Changes to this policy

We may update this policy as the platform evolves or as the law requires. We will post the updated version here with a new effective date, and for material changes affecting how we use your data, we will take reasonable steps to notify registered users.