Privacy Policy

Last updated: October 2026

Our Commitment

Bonaca helps families keep an eye on a parent's wellbeing, with the parent's consent. The parent (the person whose data is collected) connects a wearable. Up to two family members they invite can then see that data. The data belongs to the person it describes. This policy explains, in plain language, what we collect, why, who can see it, and how you can have it deleted.

In this policy, "Bonaca", "we" and "us" mean the team that runs the Bonaca app and bonaca.in.

What We Collect

Account and profile details

• Your name, and your phone number (used to sign in)
• Your email address, if you sign in with Google or email
• Date of birth and gender
• Height and weight, which you enter when you set up your profile
• A profile picture, if you choose to upload one
• Nicknames you give to family members in the app
• Account and user IDs that we assign to you

Health information from your connected wearable

When you connect a wearable, we collect health measurements that your device and its health platform record, including:

• Heart rate and heart-rate variability (HRV)
• Blood oxygen (SpO₂)
• Respiratory rate
• Body or skin temperature
• Blood pressure
• Blood glucose
• ECG readings
• Falls detected by the device
• Nutrition and hydration, and body fat or body composition, where your connected account provides them

We only receive the measurements your device and platform actually record and share. Many devices don't record all of these.

When you connect a Google account to sync your wearable data, we also receive that Google account's email address.

Fitness information from your connected wearable

• Steps and calories burned
• Workouts and activity, including how long and how intensely you exercised
• Sleep: duration and sleep quality
• VO₂ max (a cardio-fitness estimate)

Information we work out from the above

• Daily summaries, trends and insights
• Alerts when a reading looks unusual for you

Your location, only if you turn on Location Sharing

Location Sharing is off until you turn it on yourself, in the app under Profile → Location Sharing. The app explains what it shares before your phone asks for permission. When it is on:

• Your phone reads its location when you open Bonaca, works out the name of the area you are in (for example "HSR Layout, Bengaluru") and sends us that area name, the time, and your coordinates rounded to about 100 metres.
• We keep only your latest location. Each new one replaces the previous one, so we hold no history of where you have been.
• Family members you share the Behaviour category with see only the area name and when it was recorded. They never see your coordinates, a map or your address.
• If your phone stops allowing Bonaca to use location, your family see "Location not shared right now" instead of your last area.

You can turn Location Sharing off at any time. We then delete your stored location straight away.

Inviting a family member

• The phone number of the family member you invite
• If you use the contact picker, only the one contact you pick. We use it to fill in their name and number. The app does not read or upload your contact list.

Device and purchase information

• A push-notification token for your device, so we can send you notifications
• Subscription purchase records from Google Play or the Apple App Store: which plan, when it renews, and the store's transaction reference. We never see your card, UPI or bank details. Google or Apple handles payment.

What we do not collect

• Your location, unless you turn on Location Sharing (see above). Even then, we never collect a history of your movements.
• Your advertising ID, and we do not use advertising or analytics tracking tools
• Your contact list, messages, call logs, microphone or camera
• Medical records, prescriptions or diagnoses from doctors or hospitals

Why We Collect It

• To provide Bonaca: to show a parent's wellbeing to the family members they choose, and to create daily summaries, trends and alerts
• To show your family where you were last active: only if you turn on Location Sharing
• To manage your account: to sign you in, verify your phone number and keep your profile
• To keep Bonaca secure: to verify sign-ins and purchases and to prevent misuse
• To manage your subscription: to check that a purchase is valid and track when it renews or ends

We do not use your data for advertising. We do not sell it, and we do not build marketing or analytics profiles from it.

Who Can See Your Data

Family members you choose. A parent can share their data with up to two family members they invite. For each person, the parent chooses which categories to share: vitals, activity and behaviour. A parent's last active area is part of behaviour, and is shared only if the parent has also turned on Location Sharing. The parent can change or stop sharing at any time in the app. Family members only see what has been shared with them.

Profile pictures are stored at a web address that is hard to guess. Anyone who has that exact link can view the picture, so please don't upload a photo you want to keep private.

Service Providers We Use

We use the following providers to run Bonaca. They process data for us only to provide their service, and we never sell data to them.

• Google Cloud Platform: hosting, our database and file storage. Our servers and database run in Google Cloud's India region (Mumbai, asia-south1).
• Google Firebase Authentication: signing in, and sending and checking the SMS verification code. If you choose to, you can also sign in with your Google account.
• Open Wearables: open-source software that we run on our own servers to collect data from the wearable platform you connect. Your data is not sent to a separate company here.
• The wearable and health platform you connect (for example, Google Health): the source of your wearable data. You authorise this connection yourself, and you can disconnect it at any time.
• Your phone's built-in location and geocoding service (Google Play services on Android): if you turn on Location Sharing, your phone uses it to find your location and the name of your area. This happens on your phone, under Google's own terms, before anything reaches us.
• Expo push notification service: delivers app notifications to your phone, through Apple's and Google's notification services. A notification's text, which can include a family member's name and a short alert, passes through these services.
• Google Play Billing and Apple In-App Purchase: subscription payments
• Vercel: hosts bonaca.in and forwards the app's requests to our servers
• Formspree: if you join the waitlist on bonaca.in, it receives the email address you enter so that we can contact you

Some of these providers may process data outside India. We may also disclose data if the law requires us to.

Bonaca's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Protect It

Data travelling between the app and our servers is encrypted with HTTPS (TLS). Access to our servers and database is restricted. Within the app, you can only see a person's data if they have shared it with you. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

How Long We Keep It

• We keep your data while your account is active.
• For your location, we keep only the latest one while Location Sharing is on, and delete it as soon as you turn Location Sharing off.
• After we verify a request to delete your account, we delete your personal data within 30 days.
• Our database backups are deleted automatically on a fixed schedule. Nightly copies are kept for 7 days, and daily server snapshots for 14 days. So deleted data also leaves our backups within about 22 days.
• Subscription purchase records are kept as required by Indian tax and accounting law, typically up to 8 years.
• Our servers keep technical logs for security and troubleshooting. These include IP address, request time, and device or app version. We keep them for up to 180 days, stored in India, as Indian cybersecurity rules require. Our hosting providers may keep their own logs for a shorter time.

Deleting Your Account and Data

To delete your account and your data, see bonaca.in/delete-account. You can also email carebonaca@gmail.com from the email linked to your account, or include your registered phone number in the email. You can also disconnect your wearable or stop sharing with a family member at any time in the app.

Your Rights (DPDP Act 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Have your data deleted
• Withdraw your consent at any time. We will then stop collecting and sharing your data, and this does not affect anything we did before you withdrew.
• Nominate someone to use these rights for you if you die or become unable to
• Have a complaint resolved by our Grievance Officer

To use any of these rights, email carebonaca@gmail.com.

Grievance Officer

Our designated Grievance Officer can be reached at carebonaca@gmail.com. We will respond within 72 hours.

Children

Bonaca is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

Not a Medical or Emergency Service

Bonaca is not a medical device and does not diagnose or treat any condition. It is not an emergency service. In an emergency, contact local emergency services immediately.

Changes to This Policy

Before we make a significant change to this policy, we will tell you in the app. The date at the top shows when it was last updated.