Data Storage, Security & Encryption Policy

1. Introduction & Commitment

At Pranic Universe, your data privacy and security is our top priority. This Data Storage, Security & Encryption Policy explains WHERE your data is stored, HOW it is protected, encrypted, backed up, and retained. This policy applies to all users, Ayurvedic Doctors, Astrologers, Healers using our Website, Android/iOS App, and Admin Panel.

We comply with Information Technology Act, 2000, IT Rules 2021, and follow best practices inspired by ISO 27001, GDPR principles, and Ministry of AYUSH data guidelines.

2. Where Is Your Data Stored?

A. Primary Storage Location - India

• All user data including Personal Information, Kundli Data (DOB, Time, Place), Health Data (Ayurvedic history, Prakriti), Chat/Call logs, Prescriptions, Orders are stored on secure cloud servers located in India - AWS Asia-Pacific (Mumbai) Region (ap-south-1) and Google Cloud Platform Mumbai.
• Database: MongoDB Atlas / MySQL with private VPC, not publicly accessible.
• No data is stored outside India without explicit consent, except anonymized analytics.

B. Backup Location

• Encrypted automated backups stored in secondary secure zone within India (AWS Mumbai backup region).
• Backup retention: Daily backups for 30 days, weekly backups for 90 days, monthly backups for 1 year.

C. Media Storage

• Profile photos, reports, e-prescriptions stored in AWS S3 Bucket (Mumbai) with private access, signed URLs.
• Live streaming recordings (if any) stored temporarily in S3 and auto-deleted after 30 days unless needed for dispute.

3. What Data We Store - Classification

• Level 1 - Public / Non-Sensitive: App usage stats, device type, anonymized logs.
• Level 2 - Personal (PII): Name, Email, Phone, Gender, Address, Profile Photo.
• Level 3 - Sensitive Personal Data (SPDI): Date/Time/Place of Birth, Kundli details, Health history, Prakriti, Nadi details, Allergies, Current Medications, Consultation transcripts, E-Prescriptions, Payment IDs (we do NOT store Card Number/CVV).
• Level 4 - Highly Confidential: Doctor/Expert credentials (Degree, Registration Certificate), ID proofs - stored in separate encrypted vault with restricted admin access.

4. Encryption - Data Safe Kaise Hai?

A. Encryption in Transit (Data jab move hota hai)

• All data transfer between App/Website ↔ Server is encrypted with TLS 1.3 / SSL (256-bit). You see HTTPS with padlock.
• Chat/Call data uses secure WebRTC with end-to-end encryption where possible.
• Payment data encrypted by payment gateway (Razorpay/PayU) with PCI-DSS compliant encryption. We never see your full card details.

B. Encryption at Rest (Data jab server par stored hai)

• Database encrypted with AES-256 (Advanced Encryption Standard) - military-grade encryption.
• S3 files encrypted with SSE-S3 (AES-256).
• Backups also AES-256 encrypted.

C. Password Security

• Passwords never stored in plain text. Stored as bcrypt hashed + salted - one-way encryption, even we cannot see your password.
• OTPs are time-based, expire in 5 minutes, hashed.

D. Kundli & Health Data Extra Security

• Birth details and health history stored with additional field-level encryption. Only authorized backend can decrypt with private key.

5. Access Control - Kaun Dekh Sakta Hai?

Principle of Least Privilege:

• Only 2-3 senior admins (Founder + Tech Lead) have access to production database with 2FA (Two-Factor Authentication).
• Customer support can see only limited data (name, order ID) - cannot see full health history or chat content without your consent and audit log.
• Ayurvedic Doctors / Astrologers can see only data relevant to their consultation (your name, age, query, birth details) - not your payment info.
• All admin access logged with IP, time, action - audit trail maintained.
• No third party has access except as mentioned in Privacy Policy (payment gateway, logistics partner for address only).

6. Security Measures & Safeguards

• Infrastructure: AWS WAF (Web Application Firewall) to block SQL injection, XSS attacks. DDoS protection via Cloudflare. Private VPC - database not public internet facing.
• Application Security: Regular vulnerability scans, code reviews, OWASP Top 10 protection. API rate limiting to prevent brute force. OTP attempt limit (5 tries).
• Monitoring: 24x7 server monitoring, intrusion detection system (IDS), alerts for suspicious login from new device/location.
• Regular Audits: Quarterly security audit and penetration testing by external agency.
• Device Security: Auto-logout after inactivity. Option to logout from all devices.

7. Data Retention - Kitne Time Tak Store Rahega?

• Active Account: As long as account active.
• Consultation Data: Chat transcripts, call logs, prescriptions retained for 3 years as per medical/legal requirement for dispute resolution, then anonymized or deleted.
• Order Data: Invoices, payment records retained for 7 years as per Indian tax law.
• Backup: As per backup policy above.
• Deleted Account: If you request deletion via support@pranicuniverse.com, we will delete personal data within 30 days, except data we must retain by law (tax invoices, legal disputes). Backups will be overwritten in next cycle (90 days). Anonymized analytics may remain.

8. Data Backup & Disaster Recovery

Daily automated encrypted backups. Backup stored in different availability zone within Mumbai region for high availability. In case of server failure, we can restore within 4 hours (RTO). Data integrity checks run daily. Backup access also protected with encryption keys and 2FA.

9. Data Breach & Incident Response

Despite best measures, if any data breach suspected: (1) We will contain and investigate within 24 hours, (2) Notify affected users within 72 hours as per IT Rules 2021, (3) Notify CERT-In if required, (4) Take corrective action, force password reset if needed. We maintain incident log.

10. Your Rights & Control

• Right to Access: Ask what data we store about you.
• Right to Correction: Edit profile in app or email us.
• Right to Deletion: Request account deletion.
• Right to Export: Request your data in JSON/PDF format.
• Right to Opt-out: Opt-out of marketing emails/SMS via settings.

To exercise rights: Email support@pranicuniverse.com with subject "Data Request". We will respond within 15 days as per law.

11. Children's Data

We do not knowingly store data of children below 18 without parental consent. If found, will be deleted immediately. Minors must use under parent supervision.

12. International Data Transfer

Primary storage is in India. If we use any international tool (e.g., Google Analytics, Firebase Crashlytics), only anonymized, non-sensitive data is transferred with encryption. No sensitive health/birth data transferred outside India.

13. Contact & Data Protection Officer

For any data security concern, deletion, breach reporting:

• Data Protection / Grievance Officer: S Rohit Kumar
• Email: support@pranicuniverse.com / data@pranicuniverse.com
• Address: Pranic Universe, Ludhiana, Punjab - 141008, India
• Response: Acknowledgement in 24 hrs, resolution in 15 days.

14. Changes to This Policy

We may update this Data Storage & Security Policy as technology evolves. Major changes notified via email/app notification. Continued use after 30 days = acceptance. Latest version always available at www.pranicuniverse.com/data-security-policy

© Pranic Universe / Pranicverse | support@pranicuniverse.com | Data Protection Officer: S Rohit Kumar | Ludhiana, Punjab - 141008