Privacy Policy
1. Overview
ReNav ("we", "us", "our") is committed to protecting the privacy of patients and caregivers who use the Service. This Privacy Policy explains what data we collect, why we collect it, and how it is used and protected.
Because ReNav serves patients with physical disabilities, we treat all communication and health-related data with the highest level of care.
2. What Data We Collect
| Data | When Collected | Why |
|---|---|---|
| Patient name, username, email | Account registration | Account identity and communication |
| Password (hashed) | Account registration | Authentication — never stored in plain text |
| Questions asked (text) | Each session | Stored for communication history and personalisation. Sent to the AI to generate answer options — except in Morse mode, where no question is sent to the AI at all |
| Selected answers (text) | Each selection | Stored for AI personalisation and communication history |
| Answers spelled in Morse mode (free text) | When the patient spells an answer | Stored in the communication history exactly as spelled. Because the patient writes these themselves rather than choosing from options, they may contain anything they wish to say — please see the note below |
| Accessibility settings | When changed | Input mode, blink speed, auto-scan interval and Morse timings — stored against your account so they follow the patient across devices |
| Face descriptors — paid plans only | When the patient's face is set up in the app, and only after you tick the consent box | To recognise whether the patient is the one facing the camera, the browser turns a few seconds of the camera into numbers that describe the face (128 numbers per sample, up to 20 samples) and sends those numbers — never a photo or video. While the app is open it repeats this every few minutes and our server answers only whether the patient was recognised. This is biometric data, and it is used for nothing else |
| Access requests | Only if you submit the form on the pricing page | Name, email address, optional phone number, the plan you asked about and any message, so we can reply and enable the plan. If you were signed in when you sent it, the request is linked to your account |
| IP address and browser info | Every request | Server logs for security and debugging (auto-deleted after 30 days) |
In the other two modes the patient chooses between four short answers, so what gets stored is predictable. In Morse mode they spell whatever they want — which is the point of the mode, and it means the stored answer can include personal, medical or private information. Those answers are stored in your communication history like any other, and you can delete them at any time by requesting deletion of your history. Nothing spelled in Morse mode is sent to Google or any other third party.
3. What We Do NOT Collect
All face detection, gaze tracking, and blink detection runs entirely in your browser using MediaPipe FaceMesh. No video footage or images are ever sent to our servers or stored anywhere. The one thing that is sent, on paid plans only, is the face check's numbers described in section 2 — not a picture of the patient.
- No video or camera footage
- No facial images or photographs. On the free plan, no biometric data of any kind; on paid plans, only the face descriptors in section 2
- No audio recordings. Spoken questions are turned into text by your browser's built-in speech service (the Web Speech API) and ReNav only ever receives the text. Be aware that some browsers, including Google Chrome, do that conversion on their maker's servers rather than on the device — if you would rather no audio left the device at all, type the question instead
- No device sensor data beyond what the browser exposes for face tracking
- No card, bank or UPI credentials — ReNav has no payment gateway and never sees or stores them. Paid plans are arranged by email and paid outside this website, so no payment details are ever entered here
4. How We Use Your Data
- Communication history and Q&A data — stored to provide AI personalisation. The last 10 question-and-answer pairs are included with the request to Google Gemini so the options it suggests fit the patient's situation. This data is never sold or shared with third parties, and none of it is sent anywhere in Morse mode.
- Email address — used only to send account-related emails (signup confirmation, password reset). We do not send marketing emails without your explicit consent.
- Questions sent to Gemini — in head and blink modes, caregiver questions are sent to Google's Gemini API to generate answer options. Please do not include sensitive identifiable information in questions. Google's data usage for API requests is governed by their Gemini API Terms. If you would rather nothing left the device, use Morse mode — it makes no AI request.
5. Data Sharing
We do not sell, rent, or trade your personal data. Data is shared only in these limited circumstances:
- Google Gemini API — caregiver question text and the last 10 Q&A pairs are sent to generate answer options, in head and blink modes only
- Google Gemini API (speech) — on paid plans only, and only when the device has no voice of its own for Tamil or Hindi: the text of the answer being spoken is sent to Google to be turned into audio. The resulting audio is kept on our server so the same sentence is never generated twice. It is stored under a fingerprint of the text, not linked to any account, shared by everyone who would hear the same words, and deleted after 90 days without use
- AWS SES — email delivery only; no personal data beyond your email address is shared
- Legal requirement — if required by law or court order in India
6. Data Retention
- Account data is retained for as long as your account exists
- Q&A history — including answers spelled in Morse mode — is retained indefinitely to support AI personalisation, unless you request deletion
- Accessibility settings are retained with your account and deleted along with it
- Face descriptors are kept until you delete them — any time, from the dashboard — or the account is deleted. The date the face was set up is kept after you delete them, because a new face can only be set up once a month
- Access requests and the record of which plan was granted are kept as financial and accounting records. Where a request was sent while signed in it is linked to your account; if the account is deleted that link is removed, but the request itself is retained
- Server access logs are retained for 30 days and then automatically deleted
- On account deletion (upon request), all associated personal data and Q&A history is permanently erased within 14 days
7. Security
- All data in transit is encrypted via HTTPS (TLS)
- Passwords are hashed using Django's PBKDF2 algorithm — never stored in plain text
- The Service runs behind Cloudflare, providing DDoS protection and WAF filtering
- Access to production data is restricted to authorised personnel only
All face-tracking computation happens inside your browser. No image or video of the patient is ever transmitted over the internet. The paid-plan face check sends numbers, never a picture, and the server never sends them back out.
8. Your Rights
You have the right to:
- Access — request a copy of the data we hold about you
- Correction — update inaccurate personal information
- Deletion — request that we delete your account and all associated data. Face descriptors can be deleted by you directly, at any time, from the dashboard
- Portability — request your Q&A history in a machine-readable format (CSV)
To exercise any of these rights, email [email protected]. We will respond within 14 days.
The one exception is access requests and plan records, which we may need to keep as financial records even after an account is deleted; the link to your account is removed in that case. Everything else — including anything spelled in Morse mode — is erased on request.
9. Children
ReNav may be used by paediatric patients under the supervision of a parent, guardian, or medical professional. In such cases, the adult creating the account is responsible for ensuring the Service is used appropriately. We do not knowingly collect data from children without adult supervision.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be notified to registered users by email. Continued use of the Service after updates constitutes acceptance.
11. Contact
For privacy-related questions or data requests, contact us at [email protected].