This policy explains how Blooms Care India Limited (“Second Spring”, “we”) handles personal data, as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 and its rules. It applies to Blooms, their family members and carers, and anyone who signs up. Please read it with our Terms & Conditions.
Wellness support, not medical treatment. We use your health information to support everyday wellbeing and to encourage you to see your doctor when something looks different. We do not diagnose, prescribe or give clinical advice.
1. What we collect
- Who you are: name, date of birth, gender, phone / WhatsApp number, email, town and district, preferred language, time zone.
- Family and carers: their names, relationship, contact details, how they call the Bloom, and what each may see.
- Health and wellbeing (sensitive): health conditions, medicines as prescribed, allergies, blood group, body measurements, blood-test results and the target ranges your doctor set, assessments, falls, daily check-ins on mood, sleep, activity and loneliness, medicine doses taken, appointments and visits, and documents you upload (prescriptions, reports, scans, discharge summaries).
- Food: meals you log (including photos), likes and dislikes, and healthy-meal orders with delivery details.
- Voice and messages: if you switch them on, WhatsApp messages with us, and what Alexa understood you to say to the Second Spring skill (we receive the words, not recordings) with your Alexa account identifier.
- Account and safety: login email, sign-in attempts and locks, consent records, and a log of who viewed or changed what.
We collect this from you, from the family member who signs you up with your agreement, from our care team's assessment with you (including assessment forms they fill in), and from documents or doctor's evaluations you share with us.
2. Why we use it
- to provide the service you signed up for: check-ins, reminders, wellbeing reports, visits, appointments and meals;
- to notice changes and alert the care team or the family you chose;
- to suggest food and activity that suit you (general guidance only);
- to keep accounts secure and the service working well;
- to meet legal duties, and to respond in a medical emergency where the law allows without consent.
We never sell your data, never use it for advertising, and never use it to make decisions about you without a person in our care team being involved.
3. Your consent, purpose by purpose
We ask for consent for each purpose separately: keeping care records and health data, sharing with family, WhatsApp, Alexa, daily updates, meal orders, photos and others. Each consent is recorded with the date, who gave it, and this policy's version. You can withdraw any consent at any time, as easily as you gave it, in the app or by telling the care team; we then stop that use (this does not undo what was done before). Withdrawing some consents means we cannot provide that feature.
If a family member signs up on a Bloom's behalf, they confirm the Bloom knows and agrees; our care team confirms this with the Bloom. If a Bloom cannot decide for themselves, only their lawful guardian may consent for them. Second Spring is not for children.
4. Who can see it
- Our care team, only what each role needs. Every view and change by staff is logged.
- Family members the Bloom allows, with what the Bloom allows. The Bloom can remove access at any time.
- Partner kitchens (only if you order meals): name, delivery address, phone, the meal, portion size and dietary notes such as allergies.
- A doctor or anyone you choose, when you share a health report link (it expires after 7 days).
- Service providers who process data for us under contract and our instructions: Supabase (database and file storage), Vercel (app hosting), Brevo (emails), Meta (WhatsApp), Amazon (Alexa) and Google (assessment forms). Some of them store data outside India, which the Act allows except to countries the Government restricts.
- Authorities, only when the law requires.
5. How we protect it
Data is encrypted in transit and at rest. Access is controlled in the database itself, so each person sees only what they are allowed to. Documents and photos are kept in private storage. Logins are protected by password rules and a lock after repeated wrong tries. We keep access logs for at least one year. If a personal data breach happens, we will tell you and the Data Protection Board of India without delay, as the Rules require, with what happened and what you can do.
6. How long we keep it
We keep your data while you use Second Spring. When you leave, or withdraw consent for a purpose, we delete or anonymise the related data within 6 months, unless a law requires us to keep some of it longer (for example billing records for tax, or logs). We tell you before deleting where the Rules require it.
7. Your rights
- to get a summary of your data and of how we use and share it;
- to correct, complete or update it;
- to have it erased when it is no longer needed or you withdraw consent (except what the law requires us to keep);
- to withdraw consent at any time;
- to nominate a person to use these rights for you if you die or become unable to;
- to have your complaints heard by our Grievance Officer, and then by the Data Protection Board of India.
Ask the care team on +919916684554 or write to our Grievance Officer. We may need to confirm who you are. We reply as soon as we can and in any case within 90 days. Please also keep your own details correct and do not share anyone else's data without their consent.
8. Grievance Officer
M.K. Musthafa, Blooms Care India Limited, Kochi, Kerala, India. Email: musthafamk@gmail.com. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
9. Changes
We will tell you about important changes in the app or by message before they apply, and ask for consent again where the law requires. The version and date are at the top of this page and are stored with every consent you give.