MLITH Privacy Policy

Last Updated: April 14, 2026

1. Information We Collect

We collect the following categories of personal data to provide and improve our services:

1.1 Information You Provide Directly

Data Category	Specific Data	Purpose
Identity Information	First name, middle name, last name, date of birth	Account creation, member identification, and duplicate detection
Contact Information	Phone number, alternate phone number, email address, address, city, state, country	Communication, event coordination, and account verification (OTP)
Account Credentials	Username, password	Authentication and secure access to your account
Professional Information	Profession	Community profiling (optional field)
Event & Class Data	Event registration details, food preferences, accommodation preferences, class participation history, certificate codes, attendance records	Managing event registrations, tracking class completions, and issuing certificates
Payment Information	Transaction amount, payment status, transaction ID	Processing event registration fees
Volunteer Data	Volunteer team assignments, volunteer roles	Managing volunteer operations during events

1.2 Information Collected Automatically

Data Category	Specific Data	Purpose
Device Information	Device type/platform (Android, Web, iOS), app version, device identifier	Push notification delivery, app compatibility, and debugging
Push Notification Tokens	Firebase Cloud Messaging (FCM) registration tokens	Sending event reminders, updates, and important announcements
Session Tokens	Authentication tokens	Maintaining your login session securely
Activity Logs	Registration activity, login timestamps, feature interaction logs	Audit trail, service improvement, and troubleshooting

1.3 Information We Do NOT Collect

• We do not collect GPS/location data.
• We do not access your camera, microphone, contacts, or files (except when you explicitly initiate file uploads, such as event posters for admin users).
• We do not use cookies for advertising or third-party tracking.
• We do not store your full payment card/bank details — all payment processing is handled securely by our third-party payment gateway (Razorpay).

2. How We Use Your Information

We use your personal information solely for the following purposes:

• Account Management: To create and manage your healer profile, authenticate your identity, and provide secure access to your account.
• Event & Class Services: To register you for events, track your class participation history, manage accommodation and food preferences, and generate certificates.
• Communication: To send push notifications about event updates, class schedules, registration confirmations, and important community announcements.
• Payment Processing: To facilitate and record event registration fee payments through our authorized payment gateway.
• Volunteer Coordination: To assign volunteers to teams and manage event operations.
• Service Improvement: To monitor app performance, identify and fix bugs, and improve the overall user experience.
• Security & Compliance: To detect duplicate registrations, prevent unauthorized access, and maintain audit logs for administrative accountability.

3. How We Store and Protect Your Data

3.1 Storage

• Your data is stored on secure servers hosted in India.
• Our database uses MySQL with encrypted connections and access controls.
• Passwords are stored in a hashed format and are never stored or transmitted in plain text.
• Authentication tokens are generated securely and expire after a defined period.

3.2 Security Measures

• HTTPS/SSL encryption for all data transmitted between your device and our servers.
• Role-based access control (RBAC) with a 5-level security model to restrict access to sensitive data based on user roles.
• Firebase service accounts with OAuth 2.0 authentication for push notification services.
• Input validation and parameterized queries to prevent SQL injection and other attacks.
• Regular security reviews and updates to our codebase.

4. How Long We Retain Your Data

We retain your personal data for as long as is necessary to fulfill the purposes described in this policy:

Data Type	Retention Period
Account & Profile Data	Retained for as long as your account is active. Deleted within 90 days of an account deletion request.
Event Registration Data	Retained for 3 years after the event date for record-keeping and certificate verification purposes.
Class Participation & Certificates	Retained indefinitely as permanent educational records, unless you request deletion.
Payment Transaction Records	Retained for 7 years as required by Indian financial regulations and tax compliance.
Device Tokens (FCM)	Automatically deactivated when you log out or when the token becomes invalid. Active tokens are retained as long as your account is active.
Session Tokens	Expire automatically after the session timeout period.
Activity & Audit Logs	Retained for 2 years for security, troubleshooting, and compliance purposes.

5. How to Request Data Deletion

You have the right to request deletion of your personal data. Here's how:

1. Email us at the contact address provided below with the subject line "Data Deletion Request".
2. Include your registered name, Healer ID (if assigned), and registered phone number or email for identity verification.
3. We will verify your identity and process your request within 30 days.
4. Upon approval, we will:
   • Permanently delete your profile data, contact details, and account credentials.
   • Deactivate all device tokens and active sessions.
   • Remove your volunteer team assignments.
   • Anonymize your activity logs.

Data We May Retain After Deletion

Certain data may be retained even after an account deletion request, as required by law or for legitimate organizational purposes:

• Payment transaction records — retained for up to 7 years per Indian financial regulations.
• Class participation records — may be anonymized and retained for historical/educational record-keeping.
• Audit logs — may be retained in anonymized form for security compliance.

6. Third-Party Services

We use the following third-party services, each governed by their own privacy policies:

Service	Provider	Purpose	Data Shared
Firebase Cloud Messaging	Google LLC	Push notifications	Device tokens, platform info
Firebase Phone Auth	Google LLC	Phone number verification (OTP)	Phone number
Razorpay	Razorpay Software Pvt. Ltd.	Payment processing	Name, email, phone, transaction amount

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

7. Data Sharing & Disclosure

We may share your data only in the following limited circumstances:

• With authorized administrators and volunteers within the MLITH community who need access to manage events, classes, and registrations (governed by role-based access controls).
• With payment processors (Razorpay) to complete your transactions.
• When required by law — if mandated by a court order, legal process, or government authority under applicable Indian law.
• To protect rights and safety — if necessary to protect the rights, property, or safety of MLITH, our users, or the public.

8. Your Rights

As a user of the MLITH App, you have the following rights:

• Access: You can view your profile data, class history, and event registrations within the App at any time.
• Correction: You can request corrections to inaccurate personal data by contacting us.
• Deletion: You can request deletion of your account and personal data as described in Section 5.
• Opt-out of Notifications: You can disable push notifications through your device settings or by logging out of the App.
• Data Portability: You can request a copy of your personal data in a machine-readable format by contacting us.

9. Children's Privacy

The MLITH App is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete such information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes:

• The "Last Updated" date at the top of this page will be revised.
• For significant changes, we will notify users through a push notification or an in-app announcement.
• Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: