Privacy Policy

Welcome to RidelyGo ("we", "our", "us"). RidelyGo is a medicine delivery and ride-hailing platform operated in Samastipur, Bihar, India. We are committed to protecting your privacy and handling your personal data responsibly in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 of India and all applicable laws.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and store it, and what rights you have over your data. This policy applies to all users of the RidelyGo platform — Customers (Riders), Delivery Partners (Captains), and Pharmacy Partners.

1. Data We Collect

We collect only the data necessary to provide our services. Here is a detailed breakdown:

A. Personal Data

B. Sensitive Personal Data

C. Non-Personal / Technical Data

2. How We Use Your Data

We use the data we collect for the following purposes:

• Order Fulfilment: Process medicine orders, assign delivery partners, calculate ETA, and track deliveries in real-time.
• Ride-Hailing: Match riders with captains, calculate fares, track rides.
• Account Management: Authenticate users via phone OTP, manage profiles, and preferences.
• Pharmacy Verification: Verify drug license numbers, license expiry dates, and GST details of partner pharmacies.
• Delivery Partner Verification: Verify identity documents, vehicle details, and driving licenses of captains.
• Communication: Send order status notifications, delivery OTPs, and critical service updates via push notifications.
• Financial Settlements: Process weekly pharmacy settlements, track captain earnings, and reconcile COD payments.
• Safety & Compliance: Maintain audit logs for regulatory compliance, manage prescription data per Pharmacy Act, and enforce DPDP Act rights.
• Improvement: Analyse anonymised usage patterns to improve app performance, fix bugs, and add features.
• Marketing (opt-in only): Send promotional offers and updates — only with your explicit consent, which you can withdraw at any time.

3. Consent Mechanism

In accordance with the DPDP Act 2023, we obtain your explicit consent before processing your personal data:

• Required Consent: At signup, you must agree to the processing of your personal data for service delivery. This is mandatory to use RidelyGo.
• Optional Consent: Marketing communications require separate opt-in consent. You can opt out at any time from Settings.
• Pre-unchecked: All consent checkboxes are unchecked by default — we never assume consent.
• Recorded: Your consent timestamp is recorded in our systems for audit purposes.

4. Data Storage & Retention

Where We Store Data

All data is stored on Google Firebase (Google Cloud Platform) servers. Firebase provides enterprise-grade security including encryption at rest and in transit. Some data is cached locally on your device using Hive (encrypted local storage) for offline access.

How Long We Keep Data

Automatic Deletion

We run automated processes to enforce retention limits:

• Prescription images older than 3 years are permanently deleted (monthly automated cleanup).
• Abandoned carts are cleaned every 6 hours.
• Expired ride data is cleaned automatically.

5. Data Sharing & Disclosure

We do not sell your personal data to third parties. We share data only in these limited circumstances:

6. Prescription Data Handling

Prescription data is treated with the highest level of security due to its sensitive medical nature:

• Upload: Prescriptions are uploaded directly to Firebase Storage over encrypted HTTPS connections.
• Access Control: Only the uploading customer, the assigned pharmacy, and authorised admin staff can access prescription images. Access by admin is logged in the audit trail.
• Image Compression: Prescription images are compressed to ≤500KB before upload to minimise data exposure.
• Retention: Prescription images are retained for 3 years as required by the Pharmacy Act and then permanently deleted by our automated compliance system.
• Audit Trail: Every access to prescription data by admin/support staff is logged with timestamp, user ID, and reason.

7. Your Rights Under the DPDP Act 2023

As a Data Principal, you have the following rights:

Account Deletion Process

When you request account deletion:

1. Your personal data (name, phone, email, address) is permanently anonymised.
2. Your orders and rides are retained with anonymised references ("Deleted User") for legal compliance.
3. Your prescriptions, cart, favorites, and FCM tokens are permanently deleted.
4. Financial/settlement data is archived for 7 years as required by tax law, then deleted.
5. Your Firebase Authentication account is disabled immediately.
6. The entire process is logged in our audit trail.

8. Data Security

We implement multiple layers of security to protect your data:

• Encryption at Rest: All data stored in Firebase/Google Cloud is encrypted at rest using Google-managed encryption keys (AES-256).
• Encryption in Transit: All communication between the app and servers uses HTTPS/TLS encryption.
• Authentication: Phone-based OTP authentication via Firebase Auth with rate limiting (max 3 requests per 10 minutes).
• Firestore Security Rules: Comprehensive role-based access control — users can only read/write their own data. Admin access is logged.
• Audit Logging: All sensitive operations (prescription access, status changes, data exports, account deletions) are logged with timestamps.
• Local Storage: Offline cached data on your device is stored using Hive encrypted storage.
• Rate Limiting: API-level rate limiting on Cloud Functions to prevent abuse.
• Breach Notification: In the event of a data breach, we will notify affected users and the Data Protection Board within 72 hours as required by the DPDP Act.

9. Children's Privacy

RidelyGo is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete such data promptly. If you are a parent or guardian and believe your child has shared personal data with us, please contact us.

10. Cookies & Device Data

The RidelyGo mobile app does not use browser cookies. However:

• Firebase Analytics: Uses anonymous device identifiers to track app usage patterns. No personally identifiable information is sent to analytics.
• Firebase Crashlytics: Collects device information (model, OS version) and crash stack traces to help us fix bugs. No personal data is included in crash reports.
• Firebase Performance: Collects network latency and screen rendering data to optimise app speed.
• Shared Preferences: Stores your language preference (English/Hindi/Bhojpuri) locally on your device.

Our web panels (Pharmacy & Admin) may use essential cookies for session management only.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this page.
• We will notify you via an in-app notification for significant changes.
• Continued use of RidelyGo after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.