How We Protect Your Child’s Data
How We Protect Your Child’s Data
Effective: August 2026 Framework: Digital Personal Data Protection Act, 2023 (DPDP Act) & DPDP Rules 2025 Compliance Standard: DPDP-Ready Standard V1 (Section 9 — Processing of Personal Data of Children)
PediaRoots processes personal data relating to children strictly under defined product purposes with enhanced statutory safeguards mandated by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025.
- 1. Verifiable Parental Consent (DPDP Act Section 9(1))
- In strict compliance with Section 9(1) of the DPDP Act, 2023:
- Before any personal data relating to a child is collected or processed, PediaRoots obtains verifiable consent from the parent or lawful guardian.
- The user explicitly declares and attests that they are at least 18 years of age and the child’s parent or legal guardian.
- PediaRoots cryptographically records the parental attestation, timestamp, consent scope, and legal policy version.
- A child profile cannot be activated without this affirmative, recorded parental authorization.
- 2. Absolute Prohibition on Detrimental Processing (DPDP Act Section 9(2))
- In strict compliance with Section 9(2) of the DPDP Act, 2023:
- PediaRoots does not undertake any processing of personal data that is likely to cause any detrimental effect on the physical health, psychological well-being, or emotional development of any child.
- All guidance algorithms and pediatric reference content adhere strictly to evidence-based standards published by the Indian Academy of Pediatrics (IAP) and the World Health Organization (WHO).
- 3. Strict Ban on Tracking, Behavioural Monitoring & Targeted Advertising (DPDP Act Section 9(3))
- In strict compliance with Section 9(3) of the DPDP Act, 2023:
- No Tracking or Behavioural Monitoring: PediaRoots never tracks, monitors, or benchmarks a child's online behavior, screen time habits, or engagement patterns for commercial or profiling objectives.
- No Targeted Advertising: PediaRoots is entirely ad-free. We do not display, serve, or facilitate targeted or programmatic advertising directed at children or their parents based on children's health, developmental, or clinical logs.
- Zero Advertising Trackers: No third-party ad networks, marketing pixels, or behavioral profiling SDKs are integrated into the child record environment.
- No Sale or Commercial Brokering: Children’s personal data, health metrics, and symptom records are never sold, rented, leased, or shared with data brokers, commercial advertisers, or pharmaceutical marketing entities.
- 4. Data Minimization & Purpose Limitation
- In accordance with DPDP principles, PediaRoots limits child data collection strictly to what is necessary for clinical guidance and tracking:
- Child Date of Birth: Required solely to compute age in days/months for WHO growth percentiles, IAP vaccine timing, and developmental milestones.
- Growth & Immunization Records: Stored under strict user-scoped encryption for parental reference.
- Child Name is Optional: Parents may use a nickname, initials, or alias.
- We Never Collect: Government identity numbers (Aadhaar/PAN), school details, residential addresses, facial biometric data, or location telemetry.
- 5. AI Privacy Safeguards (Dr. Roots)
- Questions submitted to Dr. Roots for pediatric triage are processed server-side.
- Automated sanitization strips identifiers before contextual reasoning models evaluate clinical symptoms.
- Child records are never used to train generalized commercial AI foundation models.
- 6. Parental Rights under the DPDP Act
- As a parent or lawful guardian, you hold full statutory rights under the DPDP Act, 2023:
- Right to Access: View and review all personal and health data stored for your child at any time in the app.
- Right to Correction: Update or correct inaccurate developmental or growth logs.
- Right to Erasure / Account Deletion: Permanently delete your child’s entire profile, clinical records, and associated data with immediate cascade deletion across all databases.
- Right to Withdraw Consent: Withdraw parental consent at any time, which halts all processing and initiates data deletion.
- 7. Grievance Redressal Mechanism
- Under the DPDP Act, 2023, you may raise any inquiry, objection, or grievance regarding your child’s data directly to our designated Grievance Desk:
- Grievance Officer: PediaRoots Grievance Desk
- Direct Email: legal@pediaroots.com
- Statutory Response: We acknowledge all inquiries within 24 hours and resolve statutory requests within timelines prescribed under the DPDP Act and Rules.