Privacy Policy

DocuHub, available at https://docuhub.pdfyra.app, is operated by Sonu Kumar Jha, trading as Pdfyra (we, us, our), founded by Sonu Kumar Jha. We decide why and how your personal data is processed, which makes us the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). This policy is published in line with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), the DPDP Act and the rules made under it, as they are in force from time to time.

• Account data: your name, email address, phone number and a hashed form of your password. We never store your password in readable form.
• Documents you upload: files and details you add to the Family Document Vault, including the names and relations of family members you create.
• Medical information: reports you upload to the Medical Report Organizer, along with test values, dates, provider names and notes you enter.
• Tracker entries: titles, categories, expiry dates and notes you add to the Expiry & Renewal Tracker.
• Verification results: for each Document Verification check we store the file name, file size, a SHA-256 fingerprint, the findings and the date. The file itself is not stored.
• Batch settings: the workflow settings you choose to save. Files processed in Batch Workflows are not stored.
• Payment records: plan, amount, date and Razorpay order, payment and subscription IDs. Card, UPI and bank details are handled by Razorpay and never reach our servers. We keep payment records after account deletion for as long as tax and accounting laws require.
• Document Assistant requests: the goal you type and the checklist we prepare, kept so you can reopen them. Please do not type ID numbers or other sensitive details.
• Emergency contacts: the name and email address of any trusted contact you name, and a record of their access requests. Add someone only if they have agreed.
• Technical data: IP address, browser type and request logs, used for security, rate limiting and troubleshooting.

Passwords, medical records and financial information are sensitive personal data under the SPDI Rules. Documents you upload may also contain identity numbers and other sensitive details. We collect this data only because you choose to provide it, and we use it only to run the services you ask for.

• To create and secure your account and to sign you in.
• To provide the services you use, such as storing documents, showing trends and running checks.
• To send service emails: email verification, password reset links and password change alerts, notices before your plan ends, and reminders about the items you track (which you can turn off on the Tracker page).
• To read and explain medical reports with AI, only when you ask for it and have given your consent, which you can withdraw at any time.
• To let an emergency contact you name request access to your Family Document Vault. It opens only after a waiting period in which you are emailed and can refuse, and it never includes your medical reports.
• To prevent abuse, fraud and unauthorized access.
• To meet legal obligations and respond to lawful requests.

We do not sell your personal data, and we do not use your documents for advertising.

We process your personal data based on your consent, which you give when you create an account and when you upload or enter data. You can withdraw consent at any time by deleting your account (see section 8). Withdrawing consent does not affect processing that already took place lawfully, and some services cannot work without your data.

We share data only with service providers that help us run DocuHub, under appropriate safeguards:

• Cloudflare, which carries traffic between your browser and our servers.
• Amazon Web Services (Amazon SES), which delivers emails such as password reset links.
• Razorpay, which processes payments for paid plans.
• Anthropic, which provides the AI model behind the Document Assistant and, only if you give consent, behind reading and explaining medical reports. The Document Assistant receives only the text you type. For medical reports, Read with AI sends the report file and Explain sends only the saved test values. This may involve processing outside India.
• Hosting and infrastructure providers that run our servers.

We may also disclose data where required by law, a court order or a request from a competent government authority, or to protect the rights and safety of our users and the service.

• Files in the Vault and Medical Report Organizer are encrypted with AES-256-GCM before they are stored.
• Passwords are hashed with Argon2.
• All traffic uses HTTPS. Session cookies are HttpOnly and Secure.
• Login, signup and password reset are rate limited to resist guessing and abuse.
• Access to each account is limited to its owner.

No system is completely secure. If a personal data breach occurs that affects you, we will report it to the authorities and inform you as required by law.

We keep your data while your account is active. You can delete your account at any time from Delete Account. Your account, documents, medical records, tracker entries, verification history and saved workflows are then permanently deleted. Any backups we maintain are rotated, and deleted data leaves them within 30 days. We may keep limited information where the law requires it, for example to resolve disputes or comply with a legal obligation.

Under the DPDP Act you have the right to:

• know what personal data we process and why;
• ask us to correct or update your data;
• ask us to erase your data;
• withdraw your consent;
• have your grievances redressed, and nominate another person to exercise your rights if you die or become incapacitated.

You can correct most data directly in the app. For anything else, write to [email protected] from your registered email address.

DocuHub is meant for people aged 18 and over. We do not knowingly collect personal data of children. If you believe a child has created an account, contact us and we will delete it. The Vault lets you add family members, including minors, to organize their documents. You should do this only as their parent or lawful guardian, or with proper authority.

Our providers may process data on servers outside India. Where that happens we rely on providers that use recognised security practices, and we will follow any restrictions that the Government of India notifies under the DPDP Act.

We use only two cookies of our own, and no advertising or analytics cookies:

• docuhub_session: keeps you signed in. It is essential, HttpOnly and Secure.
• docuhub_known: remembers that this browser has an account so we can send you to the log in page instead of sign up. It lasts one year.

When you open the billing page, the Razorpay checkout loads and may set its own cookies for payment processing and fraud prevention. These are governed by the policies of Razorpay.

We may update this policy from time to time. We will change the date at the top and, for material changes, notify you in the app or by email.

Name: Sonu Kumar Jha
Designation: Founder and Grievance Officer, Sonu Kumar Jha, trading as Pdfyra
Email: [email protected]
WhatsApp: +91 79827 70094

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.