Privacy Policy

Last updated: 11 September 2026

EMCY ("we", "us") is an emergency response service that connects patients with nearby hospitals during medical emergencies. Because of what EMCY does, we handle sensitive information — this policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have.

The short version: EMCY is a courier, not a custodian. Our job is finished when a hospital takes over your care. We hold the minimum needed to get you there, we encrypt it, and we delete it on a fixed clock afterwards.

Information we collect

• Account details — your name, phone number, email address, date of birth, and profile photo (if you add one).
• Medical profile — information you choose to provide, such as blood group, allergies, existing conditions, and medications, so hospitals can prepare for you.
• Emergency contacts and dependents — names and phone numbers of people you add, and profiles you create for dependents in your care.
• Precise location — collected when you trigger or participate in an emergency, so hospitals know where you are. We do not track your location outside of an active emergency.
• Emergency details — the symptoms, triage answers, case updates, and messages exchanged with the hospital during an emergency.
• Photos, voice notes, and video clips — anything you choose to send to the responding hospital to help them understand the situation.
• Device information — push notification tokens and basic device data needed to deliver alerts reliably.

We do not collect Aadhaar

An earlier version of the app asked for your Aadhaar number during sign-up. It should not have — storing Aadhaar is restricted to entities registered with UIDAI for that purpose, and EMCY is not one. We removed the field, and every Aadhaar number that had been collected has been permanently deleted. No copy was archived. We will never ask for it again.

How we use it

• To alert nearby hospitals and dispatch the one you confirm during an emergency.
• To share your relevant medical profile with the responding hospital so they can prepare.
• To notify your emergency contacts when you are in an emergency.
• To operate, secure, and improve the service (including crash and error reporting).

We do not sell your personal information. We do not use it for advertising, and we do not profile your behaviour — EMCY carries no analytics or advertising software of any kind.

Who we share it with

• Responding hospitals — the hospital(s) handling your emergency receive your identity, location, medical profile, and case details.
• Your emergency contacts — they are notified of your emergency and its status.
• Service providers — we use Google Firebase (authentication, push notifications, storage), our cloud hosting providers, and Sentry (error reporting) to run the service. They process data on our behalf.
• Legal requirements — we may disclose information where required by law.

After handover, the hospital holds your record

This is the part most people do not expect, and it is the reason the deletion clock below is as short as it is.

Once a hospital records an outcome for your case, that hospital becomes the custodian of your medical record — the same as if you had walked into their emergency department yourself. They keep it under the rules that apply to them, for as long as those rules require. EMCY does not, and after 37 days EMCY no longer has it at all.

So if you need the record of an emergency later — for insurance, for a follow-up, for anything — ask the treating hospital, not us. You can also take your own copy from the app at any point during those 37 days; see Your rights below.

How long we keep it

Your account, profile, medical details, emergency contacts, and dependent profiles are kept while your account is active, and are deleted when you delete your account.

Emergency case records run on a fixed clock, measured from handover:

• At handover — your live location trail is erased immediately.
• 72 hours after handover — photos, voice notes, and video clips are deleted.
• 7 days after handover — the case leaves the app. It no longer appears for you or for the hospital, though you can still export it.
• 37 days after handover — the case is permanently deleted. Not hidden, not archived — deleted.
• 44 days at the outside — the point by which it has also aged out of our database backups.

"Handover" means the hospital recording what happened to you — admitted, discharged, and so on. It does not mean simply arriving at the hospital, and it does not mean being referred onward to another hospital. While your care is still moving, the clock has not started.

If you delete your account before a case has been deleted, your profile is removed immediately and the remaining case record is stripped of the details identifying you, then deleted when its clock runs out. We keep records longer than this only where the law requires it of us — payment records, which we are required to retain for eight years, and security logs, which we retain for 180 days as required of us by CERT-In. Neither contains your medical details.

Security

Data is encrypted in transit, and the personal information we hold is also encrypted at rest — your name, phone number, email address, date of birth, address, medical conditions, allergies, medications, and the names and numbers of your emergency contacts are stored as ciphertext, not as readable text. The keys that decrypt them are held outside the database, so a copy of the database on its own does not reveal any of it.

Access is authenticated and role-restricted, hospitals only see cases they are responding to, and every time a member of hospital staff opens your record we log it — which is why we can tell you who has read your data (see below). No system is perfectly secure, but we design for the sensitivity of what we carry.

Your rights

• Get everything we hold about you. One request from inside the app returns all of it: your profile, contacts, dependents and their consent records, every case (including ones already deleted, listed as deleted rather than left out), your payments, and which hospital staff have read your data, when, and which part. We answer within 30 days, and usually immediately.
• Take a copy of any case. At any point in the 37 days you can export a case from the app, in a machine-readable format and in a printable one. The file states its own deletion date.
• Correct your information. You can view and edit your profile and medical information in the app at any time.
• Delete your account and data — see Delete Account.
• Complain. Contact us first (below); if we do not resolve it, you can escalate to the Data Protection Board of India.

One limit worth stating plainly: a case export is for the patient and the relative coordinating for them, and for the treating hospital. Being notified that someone collapsed does not entitle a person to that someone's medical record.

Children and dependents

EMCY accounts are for adults. A child's profile exists only as a dependent profile created and managed by a parent or guardian, and we record that consent — which adult gave it, for which dependent, on what basis, and when.

We do not track, monitor, or profile the behaviour of children, and we do not direct advertising at them. We do not do any of those things to anyone: EMCY has no analytics software and no advertising software in it at all.

Changes

We will update this policy as the service evolves and change the date above. For significant changes we will notify you in the app.

Contact

Questions about this policy or your data, and any privacy complaint, go to our grievance contact:

S Kavin Balaji, Grievance Officer — emcysupport@gmail.com

If you are not satisfied with how we handle your complaint, you may raise it with the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023.