Privacy Policy
Privacy Policy
Effective: August 2026 Version: 1.0.0 (DPDP-Ready Standard V1)
PediaRoots is responsible for the personal data processed through PediaRoots.
This Privacy Policy is designed with reference to the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025, and other applicable Indian law.
PediaRoots voluntarily adopts the applicable DPDP-ready controls from launch, including appropriate safeguards for children’s personal data.
- 1. What We Collect
- Parent name, email, phone: Account, authentication and communication
- Parent/guardian confirmation: Child-profile consent and account administration
- Child date of birth: Age-specific growth, development and immunisation guidance
- Child name: Optional personalisation
- Child sex: Growth reference information
- Weight, height, head circumference: Growth tracking
- Developmental milestones: Developmental tracking
- Immunisation information: Schedule tracking
- Nutrition/feeding information: Age-appropriate educational guidance
- Questions to Dr. Roots: AI-generated educational guidance
- Photos/notes: Optional family record
- Device/usage information: Security, service operation and product improvement
We aim to collect only information reasonably necessary for these purposes.
- 2. What We Do Not Do
- PediaRoots does not:
- Sell personal data
- Sell children’s data
- Provide targeted advertising to children
- Use advertising technology to build children’s profiles
- Intentionally build behavioural or psychological profiles of children for advertising
- Transmit the child’s PediaRoots health record to an external healthcare service
3. Analytics We measure parent interaction with PediaRoots, including registration, onboarding completion, feature use and return visits. Analytics are configured to avoid collection of children’s names, health measurements, or symptom descriptions.
4. AI Processing Dr. Roots uses Google Gemini API. Information necessary to generate an AI response (anonymized prompt context) is transmitted to the provider. Prompts are sanitized server-side to exclude personal child names.
- 5. Third-Party Processors
- Infrastructure providers include:
- Google Firebase / Google Cloud (Auth, Firestore, Storage)
- Google Gemini API (LLM)