Legal

Privacy Policy

Last updated: 1 November 2026

Data summary for our apps

This policy applies to the website www.kushalaya.com, the web portals family.kushalaya.com and ops.kushalaya.com, and the Android apps KushAlaya Family (for families) and KushAlaya Ops (for our care staff). The same company, KushAlaya Private Limited, operates all of them. In every one of them:

We do not sell personal data and do not show advertising. If you choose “Sign in with Google”, we receive only your name, email address and profile photo (see section 6). Data is encrypted in transit; access is limited to the staff assigned to you. You can delete your account and data at any time (see How to delete your data) or email contact@kushalaya.com.

1. Who we are

KushAlaya is run by KushAlaya Private Limited (“KushAlaya”, “we”, “us”). We provide home safety assessments, home safety products and installation, and in-home elder care visits for families across India, including families who live abroad and arrange care for parents in India.

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described here.

• Registered office: Uppal, Rangareddy district, Hyderabad, Telangana 500039, India
• Corporate Identity Number (CIN): U88100TS2026PTC224774
• Email: contact@kushalaya.com

This policy covers our website (www.kushalaya.com), the family portal (family.kushalaya.com), the staff portal (ops.kushalaya.com), our Android apps KushAlaya Family and KushAlaya Ops, and our services.

2. Whose data this covers

• Family members who sign up, book or pay for care (often a son or daughter).
• The person receiving care (your parent or relative). A family member usually gives consent on their behalf and records their name and relationship. Please make sure you are entitled to do so, and tell your parent how their data is used.
• Website visitors who send an enquiry or request a call back.

3. What we collect

• Contact details: your name, email and phone number.
• About the person receiving care: name, age, home address, phone and emergency contacts.
• Health and wellbeing (only with consent): health conditions, allergies, mobility, and the checks a caregiver records at each visit.
• Visit records: visit times, caregiver notes, voice notes, photos, and incident or SOS reports.
• Home safety assessment: room photos, the hazards found, recommendations and your KushAlaya Safety Score report.
• Location (only with consent): where the caregiver checked in at the home, and the caregiver’s position while on the way to you.
• Devices (only if you choose wearables or sensors): alerts and readings they send us.
• Payments: wallet top-ups, orders, invoices and receipts. Card, UPI and bank details are entered on Razorpay’s checkout. We do not see or store your full card details.
• Messages you send us through the portal, email, phone or WhatsApp.
• Documents you upload to the family portal.

4. Why we use it

We also use personal data to:

• send you visit updates, reminders, alerts and receipts;
• handle SOS and emergency alerts;
• issue GST invoices and keep the accounts the law requires;
• keep the service secure and keep a record of what was agreed and done.

We never sell your data. If you do not give care delivery consent, we cannot provide the service. To stop, you can ask us to delete your account.

5. AI room checks and previews

During a home safety assessment we may use AI to help spot hazards in room photos and to create a preview of how a room could look with safety products installed.

• Room photos are sent to Google’s Gemini service for analysis. Before sending, we re-save the image to remove hidden details such as GPS location.
• Only the image, our list of hazard types, and product names are sent. We do not send names, addresses or health information.
• If Google is unavailable, a preview image may be created by fal.ai (an AI image service) under the same rule: only the room photo and product names are sent.
• AI results are a starting point only. A KushAlaya care manager reviews them before they appear in your report.

6. Our apps and Google services

We do not access your Google contacts, calendar, Gmail or Drive. The Google services we use are:

• Sign in with Google (optional) on family.kushalaya.com and ops.kushalaya.com. If you choose it, Google shares only your name, email address and profile photo with us (the “openid”, “email” and “profile” permissions). We use them only to sign you in to the KushAlaya account that already has that email address, and to show your name in the portal. We do not ask for any other Google data, we do not use it for advertising, we do not sell it or share it with anyone, and we do not use it to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can stop it at any time by removing KushAlaya from your Google account’s third-party connections; you can still sign in with your email and password.
  How we store and delete Google user data: we keep only your Google email address, name and a link to your profile photo, stored with your KushAlaya account on our secure cloud servers, encrypted in transit and limited to the staff who look after your family. We do not keep Google passwords or access tokens after you are signed in. This data is deleted when you delete your KushAlaya account or ask us to (email contact@kushalaya.com) — within 30 days — and it is never transferred to anyone else.
• Firebase Cloud Messaging (push notifications) in the KushAlaya Family and KushAlaya Ops Android apps. When you allow notifications, the app registers a device token with us so we can send visit updates, SOS alerts and reminders. The token identifies the device, not you by name. Turning notifications off in Android or deleting your account removes it.
• Gemini (AI photo analysis) as described in section 5: room photos only, with location data removed, never names or health information.
• Google Forms, embedded on our Parent Care Check page. What you type into that form is collected by Google Forms into our account under Google’s own privacy policy.

The Android apps also ask for location (caregiver check-in at the home and the on-the-way map, section 3), camera and photos (visit and assessment photos) and microphone (optional voice notes). Each permission is requested when first needed and can be withdrawn in Android settings.

7. Who we share it with

• Our care team: care managers and the caregivers assigned to your family member. Each sees only what they need.
• Service providers who help us run the service, under contract: cloud hosting, Razorpay (payments), SMS, email and WhatsApp messaging, and the AI services named above.
• Installation partners who fit products in the home, with the details needed for the job.
• In an emergency, what is needed with hospitals, ambulance services or the police.
• Authorities, when the law requires it.

Where your data is stored: our servers and database run on Oracle Cloud Infrastructure in the US East (Ashburn) region, with encrypted backups on the same servers. Razorpay processes payments in India. Google (Gemini, Firebase) and fal.ai process the specific items described in this policy on their own infrastructure, which may be outside India. Where data leaves India we rely on the DPDP Act and any rules the Government of India makes on transfers.

8. How long we keep it

• We keep your data while you use the service.
• If you ask us to delete your account, we erase or anonymise your personal data within 30 days.
• Invoices, receipts, credit notes, wallet and payment records are kept for 8 years, because tax and GST law requires it. Names and contact details on them are removed.
• A record of the consent you gave, and of the request itself, is kept as proof, with names removed.
• Backups roll off within 8 weeks.

How to delete your data

• Family portal / KushAlaya Family app: open More → Privacy → Delete my account. We confirm the request and erase or anonymise your data within 30 days.
• By email: write to contact@kushalaya.com from the address you signed up with, with the subject “Delete my data”.
• Staff and caregivers: ask your agency administrator, or email us; the account is deactivated at once and personal data erased on the same 30-day timeline.

Deleting your account removes your login, contact details, documents, photos, messages and device tokens. Invoices and payment records are kept for the 8-year statutory period with names and contact details removed.

9. Your rights

Under the DPDP Act you can:

• Access your data and get a summary of how it is used. You can download it from the family portal.
• Correct or update data that is wrong or incomplete.
• Erase your data by asking us to delete your account.
• Withdraw consent for any optional purpose at any time. This does not affect what was done before you withdrew.
• Nominate someone to use these rights for you if you die or cannot act yourself.
• Raise a grievance with our Grievance Officer (below).

Use the privacy section of the family portal, or email contact@kushalaya.com. We may need to confirm who you are before acting on a request.

10. Security

We use reasonable security safeguards, including encrypted connections, sign-in controls and access limited to the people who need it. Every consent, data download and delete request is logged. No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

11. Children

Our service is for adults. We do not knowingly collect data from children, except where a child’s details appear in a family member’s records.

12. Cookies

We use the cookies and browser storage needed to keep you signed in and to make the site work. We do not use advertising cookies.

13. Grievance Officer

For any question, complaint or request about your personal data, contact:

• Grievance Officer, KushAlaya Private Limited
• Name: Krish Posa (Founder)
• Phone: +91 83095 00488
• Email: contact@kushalaya.com
• Address: Uppal, Rangareddy district, Hyderabad, Telangana 500039, India

We aim to reply within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

14. Changes to this policy

We may update this policy. If a change affects what you agreed to, we will ask for your consent again in the family portal. The date at the top shows the latest version.