Phlebo1 Privacy Policy

Who this policy is for

Phlebo1 is used by phlebotomists and field agents working with Labtest1 — not by patients. It describes how we handle your data as an agent, and how you must handle the patient data you encounter on the job.

Information we collect about you

Your name, mobile number and email; your address and city; the last four digits of your Aadhaar together with a one-way hash of the full number; your profile photo and certification documents; your device model and push-notification token; and app diagnostics.

Aadhaar handling

Your full Aadhaar number is never stored or transmitted. It is hashed on your device with SHA-256, and only the hash and the last four digits leave the app — in line with the DPDP Act data-minimisation principle and Aadhaar Act section 29.

Location

Precise location is recorded in two situations. While a job trip is active, so pickups can be routed and the collection of a sample can be evidenced. And while you have marked yourself Available for work, so dispatch can offer you the jobs closest to you. Tracking runs in a foreground service with a persistent notification, so you can always see when it is on.

The app requests while-in-use access only — it does not track you in the background. Recording stops when you end a trip and when you go offline, and nothing is collected while you are marked unavailable. Points older than 90 days are pruned from the device.

Patient and health data you handle

Sample details, basic vitals and lab report images you capture belong to the patient, not to you. They are transmitted to Labtest1 and are visible to you only for the orders assigned to you.

The app is deliberately write-only for reports: you can upload, but never list, browse or download them.

How we use your data

To verify that you are an authorised agent, assign and route jobs, evidence collections and deliveries, calculate commissions and payouts, send you assignment notifications, and detect fraud or misuse.

Sharing

We share data with the processors needed to run the service — cloud hosting and database, SMS and WhatsApp delivery, push notifications, and the payment gateway used for field collections.

We do not sell your data, and this app runs no advertising or ad attribution.

Retention

Assignment history, trip logs, collection records and commission ledgers are operational and financial records, retained as required by law and for audit. Your profile and identity data are removed or anonymised when you delete your account.

Your rights and account deletion

You can request deletion of your account from Compliance → Delete Account inside the app. Access is revoked immediately and final erasure completes within 30 days.

If you no longer have the app installed, see the Phlebo1 Account Deletion page. For access, correction or any other request, email us.