Medhaverse (“Medhaverse”, “we”, “us”, “our”) is operated by Medhaverse Edutech LLP. We provide an AI tutoring service for school-going children in India. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have. It is written to align with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
1. Who this policy applies to
This policy applies to (a) parents or legal guardians who create a Medhaverse account (“Parents”) and (b) children whose Parents add them as learners on the platform (“Children”). Children do not create accounts on their own. A Parent must sign in and add each Child.
2. Information we collect
From Parents
- Name, email, and password (hashed) when you create an account.
- Optional profile details: phone number, city/state, preferred language.
- Billing information (when paid plans are purchased), processed by our payment partner.
- Communications you send us (support emails, feedback, ratings).
- Basic technical data: IP address, browser type, device type, pages visited.
From Children added by a Parent
- Child’s display name, avatar, grade, and medium of instruction.
- Learning activity: questions asked, time spent, mastery scores, chat messages with the AI tutor.
- Assignments and answer attempts.
We do not ask Children for an email address, phone number, photograph, or precise location. We do not knowingly collect more information from a Child than is needed to provide the learning experience.
3. How we use the information
- To create and manage your Parent account and your Children’s learner profiles.
- To generate personalised diagnostics, daily plans, and AI tutoring responses.
- To show Parents progress dashboards for each Child.
- To improve content quality, fix bugs, and prevent abuse.
- To send service-related messages (e.g., security alerts, important changes to the service).
- To comply with applicable law and respond to lawful requests.
We do not sell personal data. We do not use Children’s data to serve advertising and we do not allow third-party advertising networks to track Children on Medhaverse.
4. Legal basis and consent
We process personal data on the basis of the consent you provide when you create an account and add a Child, and for the limited purposes you have authorised. Parental consent is required before we begin processing any Child’s personal data, and that consent can be withdrawn at any time from the parent dashboard.
5. How AI tutoring uses data
Medhaverse uses large-language-model providers via OpenRouter to generate tutoring responses. The Child’s question, the relevant textbook passage, and limited prior context are sent to the model provider so that an answer can be generated. We do not send Parent or Child identifiers (name, email) to the model provider. Model providers are contractually prohibited from using this data to train their public models.
6. Sharing and disclosure
We share personal data only as described below:
- Service providers who help us run Medhaverse (cloud hosting, email delivery, error monitoring, LLM inference, payments). They are bound by confidentiality and data-protection obligations.
- Legal compliance: when required by law, court order, or to protect the rights and safety of users.
- Business transfers: if Medhaverse Edutech LLP is acquired or merged, personal data may be transferred to the successor entity, subject to the same protections set out here.
7. Where data is stored
Personal data is stored on servers located in the European Union (Helsinki, Finland) and is accessed by Medhaverse Edutech LLP personnel from India. Where data is transferred outside India, we rely on contractual safeguards and lawful transfer mechanisms.
8. Security
We use industry-standard safeguards: encryption in transit (HTTPS/TLS), encryption at rest for databases and backups, role-based access controls, audit logs, and regular dependency updates. No system is perfectly secure; if we become aware of a personal-data breach that is likely to result in significant harm, we will notify affected users and the Data Protection Board of India as required by the DPDP Act.
9. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you or your Child.
- Correct inaccurate or outdated data.
- Delete your account, any Child profile, or specific data items.
- Withdraw consent at any time (this does not affect the lawfulness of past processing).
- Nominate another individual to exercise your rights in the event of your death or incapacity.
- Lodge a complaint with the Data Protection Board of India.
You can exercise most of these rights directly from the parent dashboard. For anything else, email hello@medhaverse.in. We aim to respond within 30 days.
10. Children’s privacy
Medhaverse is designed to be used by Children with the consent and supervision of a Parent. A Parent can review, export, or delete a Child’s data at any time from the parent dashboard. If you believe a Child has been added to Medhaverse without proper parental consent, please contact us and we will remove the profile.
11. Retention
We keep personal data only as long as needed for the purposes set out in this policy. See our Data Retention & Prevention Policy for specific timelines and our deletion practices.
12. Changes to this policy
We will update this policy from time to time. If we make material changes, we will give Parents reasonable notice (in-app banner or email) before the new policy takes effect. The date at the top of this page always reflects the latest version.
13. Contact
Questions, requests, or grievances? Email our Data Protection contact at hello@medhaverse.in.