Privacy policy
Last updated 28 August 2026
We collect as little as the product can work with, we keep it in India, and we do not sell it. This page explains exactly what we hold and what you can make us do about it.
Who is responsible for your data
LUMINOVIX TECHNOLOGIES, ADD REGISTERED BUSINESS ADDRESS, is the data fiduciary for the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
What we collect
| Data | Why we have it |
|---|---|
| Email address | To create your account, sign you in, restore your access on a new device, and send you a receipt. |
| Your answers and progress | Which questions you attempted, what you chose, what you flagged, your exam date. This is what makes your progress, mistakes list and readiness score work, and what lets you resume on another device. |
| Session and device information | A record of the device currently signed in, so we can enforce one active session per account and detect sharing. |
| Purchase records | Which pass you bought, when, how much, and the payment reference. Needed to give you access, to handle refunds, and to keep lawful business records. |
We do not collect or store your card, UPI or bank details. Payments are handled entirely by Razorpay; we receive only a reference and a confirmation that a payment succeeded.
We do not run advertising trackers, we do not build advertising profiles, and we do not sell or rent your data to anyone.
Where your data lives
Your account and study data are stored in India, in a database hosted by Supabase in the Mumbai region. Some infrastructure providers we rely on operate globally and may process limited technical data (such as an IP address in a server log) outside India.
Who we share it with
Only the providers we need to run the service, and only for that purpose:
- Supabase — database, authentication and email delivery for sign-in links.
- Razorpay — payment processing. Razorpay is a regulated payment aggregator and handles your payment details under its own privacy policy.
- Vercel — website and application hosting.
- Google Play or Apple — if you buy inside a mobile app, that store processes the payment under its own terms.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
Storage on your own device
The app stores content and your recent answers in your browser or device storage. That is what lets it work offline and on a slow connection. It stays on your device, and clearing your browser data removes it. We do not use advertising or analytics cookies.
How long we keep it
- Account and study data: while your account exists, and for 12 months after your last sign-in.
- Purchase and payment records: as long as Indian tax and accounting law requires us to keep them, which is longer than the rest.
- If you ask us to delete your account, we act on it as described below.
Your rights
Under the DPDP Act you may:
- ask what personal data we hold about you and how we use it;
- ask us to correct anything inaccurate or incomplete;
- ask us to erase your data — we will do so except where we must keep purchase records for legal reasons;
- withdraw your consent, which will mean closing your account; and
- nominate someone to exercise these rights if you are unable to.
Write to us and we will respond within 30 days. Deleting your account permanently removes your study history, and a deleted account cannot be restored.
Grievance officer
If you are unhappy with how we have handled your data, contact our grievance officer:
- Name: ADD NAME
- Email: ADD support@bcbrbuddy.in
- Address: ADD REGISTERED BUSINESS ADDRESS
If we do not resolve your complaint you may escalate it to the Data Protection Board of India.
Children
BCBR Buddy is intended for medical professionals and postgraduate students, and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will remove it.
Security
Access to your data is enforced at the database level rather than in app code, connections are encrypted in transit, and payment credentials never reach our systems. No system is perfectly secure, but we will notify you and the Data Protection Board of a breach affecting your data as the law requires.
Changes
We will post any change here with a new date at the top, and tell you by email if the change is significant.
Contact
Any question about this policy: contact us.