Privacy Policy

Your trust matters. This policy explains what we collect, why, who can see it, and how you stay in control.

Last updated:

Draft notice: This policy is a working draft prepared for the platform. Final legal wording must be reviewed and approved by the project owner and a qualified legal advisor before public launch.

1. Who we are

RakthDaan (“we”, “us”, “the platform”) is a not-for-profit online service that helps people who need blood connect with voluntary blood donors. We act as the data fiduciary for personal data processed through this website, under the Digital Personal Data Protection Act, 2023 and other applicable Indian law. We are not a blood bank, hospital or medical provider.

2. Data we collect

a) Donors (when you register)

  • Identity & contact: full name, mobile number (verified by OTP), WhatsApp number, email address (optional).
  • Donation profile: date of birth (only to confirm you are at least 18; never shown to other users), blood group, last donation date (optional), availability status, listing visibility.
  • Location: state, city, pincode, locality, optional address, and the map location you choose.
  • Declarations: your consent and your self-declaration of basic eligibility (weight, general health).
  • Records: timestamps of when your profile was created and updated.

b) People searching for donors

  • Verified mobile number and an internal user ID.
  • A log entry each time you reveal a donor’s contact details (your user ID, mobile number, the donor’s ID and the time).
  • Your device location only if you choose “use my current location”; it is used in your browser for that search and is not stored.

c) Contact form and requests

  • Contact form: name, email, optional phone, subject and message.
  • Update/deactivation/deletion requests: donor name, registered mobile number, request type and message.

d) Technical data

Our hosting and authentication providers may automatically process IP address, browser/device information and security signals (for example reCAPTCHA risk scores) to deliver the service and prevent abuse.

We do not collect medical records, test results, Aadhaar or other government ID numbers, or payment information.

3. Why we use your data

  • To create and maintain your donor profile and let you manage it.
  • To let verified users find donors by blood group and location, and to contact them for genuine blood requirements.
  • To verify identities with OTP and to prevent spam, scraping, fraud and misuse.
  • To respond to messages and to process update, deactivation and deletion requests.
  • To show aggregate, non-identifying statistics (for example, number of registered donors per blood group).

We process donor data on the basis of your consent, which you give when registering and may withdraw at any time. We do not sell, rent or trade personal data, and we do not use it for advertising.

4. What other users can see

Donor information is never visible to the general public or search engines. Only users who have verified their own mobile number can search, and they can see:

  • Your masked name (e.g. “P***** K****”) — your full name is stored separately and never displayed;
  • Blood group, availability, state, city, locality and pincode;
  • Approximate distance, calculated from a location rounded to roughly 1 km;
  • Your last donation date, if you provided it. Donors who donated in the last 3 months are not shown in search until 3 months have passed.

Your mobile and WhatsApp numbers are shown to a verified user only when they explicitly request them for a blood requirement, one donor at a time, and each request is logged. Your email, exact map location and address are never shown to other users.

5. Mobile OTP verification

We use Firebase Authentication (provided by Google) to send a one-time password by SMS to your mobile number. Your number is shared with Google and its SMS delivery partners solely to send the OTP and verify you. A reCAPTCHA check (also provided by Google) is used to prevent automated abuse; it may analyse device and interaction data. Your verified number becomes your login.

6. Third-party processors

We rely on the following service providers, who process data on our behalf under their own terms and privacy policies:

  • Google Firebase (Authentication, Cloud Firestore database, Hosting, optional App Check) — Firebase privacy.
  • Google reCAPTCHA — Google Privacy Policy.
  • Maps & geocoding: Google Maps Platform and/or OpenStreetMap with Nominatim, to display maps and convert addresses to locations. Search text and coordinates you enter are sent to the provider for that purpose.
  • WhatsApp (Meta), only if you choose to open a WhatsApp chat link.

Some providers may store or process data on servers outside India, subject to applicable law.

7. Storage and security

Data is stored in Google Cloud Firestore. Access is enforced by strict database security rules: private profiles are readable only by the donor and authorised administrators, public listings contain only masked data, and contact details can be read only one record at a time after a logged request. All traffic is encrypted with HTTPS. No system is completely secure; if we become aware of a personal data breach we will act promptly and notify affected users and authorities as required by law.

8. Data retention

  • Donor profiles are kept while your account is active. If you delete your data, your profile, public listing, contact record and statistics entry are removed immediately from the live database.
  • We may ask inactive donors (no update for 24 months) to confirm their details and may remove listings that are not confirmed.
  • Contact-reveal logs are kept for up to 12 months to investigate misuse, then deleted.
  • Contact messages and requests are kept for up to 24 months, or as long as needed to resolve the matter.
  • Backups maintained by our providers may retain data for a limited additional period before being overwritten.

9. Your rights & choices

Subject to applicable law, you have the right to access, correct, update and erase your personal data, withdraw consent, and nominate another person to exercise your rights.

  • Correct or update: log in at Update / Remove Details and edit your profile.
  • Pause: switch off “Available to donate” or hide your listing at any time.
  • Delete: use “Delete my data” on the same page for immediate deletion, or submit a deletion request for our administrators to action.
  • Other requests or grievances: email us at the address below. We aim to respond within 30 days.

To protect you, we verify identity (by OTP or other reasonable means) before acting on a request.

10. Children

The platform is intended for adults. Donors must be at least 18 years old. We do not knowingly collect data from children; if you believe a child has registered, please contact us and we will delete the data.

11. Cookies & local storage

We do not use advertising or tracking cookies. We use your browser’s local storage and essential cookies set by Firebase and reCAPTCHA to keep you signed in, protect against abuse, cache the app for offline use and remember simple preferences.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date above will change, and significant changes will be highlighted on the website.

13. Contact for privacy requests

Grievance / Privacy Officer: [Name to be added]
Email: privacy@example.org
Address: Your organisation address, City, State, PIN

If you are not satisfied with our response, you may approach the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.