SanoVault Privacy Policy
Updated 25 September 2026 · Argali Knowledge Services Private Limited
Who operates SanoVault
SanoVault is operated by Argali Knowledge Services Private Limited. Contact support@eisenvault.com for privacy questions, access or correction requests, deletion requests, or complaints. Our published head-office address is 4th Floor, Statesman House, Barakhamba Road, New Delhi 110001, India.
Information we process and why
We process your name, email address, sign-in identifiers and sessions to manage your account. Family profiles may include names, dates of birth, contact details, ABHA numbers and emergency contacts. Records may include medical reports, photos, PDFs, prescriptions, medicines, blood pressure, growth measurements, vaccinations and visit notes. We use this information to store, organise, search and display records, prepare summaries, and provide the family and sharing features you request. Saved PDF passwords are stored encrypted. Limited operational and security logs help us protect accounts and diagnose failures. We do not sell health records or use them for advertising.
Family access and children’s records
Every login member of a family folder can access the patients and records linked to it. A patient can belong to several families. Only add another person’s information with their permission or legal authority to manage it. Adults managing children’s records must have appropriate parental or guardian authority. SanoVault is intended for adults managing personal and family records, not for children to create independent accounts.
Sharing
Inviting someone gives them family-folder access. Anyone holding a document share link can access the document until the link expires or is revoked. Recipients can download copies. Revoking a link or deleting a record cannot remove copies already downloaded. A previously issued temporary download URL may remain usable until it expires or the underlying file is erased.
Service providers and AI processing
We use Neon for the database and web sign-in, Cloudflare R2 for private file storage, and Vercel for hosting. Apple or Google processes authentication when you choose that method. Optional Groq AI processing sends extracted document text and, for some OCR or medicine-label tasks, images to Groq to produce extracted fields, classifications and summaries. It is enabled by default for now, and you can turn it off during onboarding or later in AI processing settings; while off, SanoVault does not send your uploads to Groq. Groq may process data outside your country. Configured email services, including Brevo, process recipient details and messages. If you use WhatsApp import, Meta/WhatsApp processes your number, messages and attachments; SanoVault records linked numbers and imported messages. Providers process information under their applicable terms and our service arrangements. Infrastructure may process information outside your country; SanoVault does not promise India-only storage.
Device permissions and offline copies
The camera is used to scan reports or photograph labels. You can select photos or files to attach. The native app stores credentials and cached metadata in platform secure storage and local document copies and pending uploads for offline use. Signing out or deleting your account on that device clears its SanoVault cache. Another offline device cannot receive an immediate deletion or access-revocation update and must reconnect. Exports saved outside SanoVault remain under your control.
Removing a patient or deleting a family
Removing a patient from a family removes that family’s access. If another family still has the patient, their records remain there. If no family remains, the patient and associated records are permanently deleted. Only the family creator can delete an entire family. This removes memberships, invitations and WhatsApp links, deletes patients belonging only to that family, and preserves patients linked elsewhere. Deleting a patient or family does not delete anyone’s login account.
Deleting your login account
Use Delete account in the app’s More menu or www.sanovault.com/delete-account. You can also email support@eisenvault.com, including if you cannot sign in. We may verify identity and authority before acting. Deletion removes your profile, login access, sessions, invitations and related account information. Families with other members remain; a remaining member takes over families you created. Families where you are the last member are deleted. Shared patient records remain available to their other families. A patient profile is separate from a login: remove patient records you are authorised to delete before deleting your login, or contact support about records held by another family.
Retention and deletion processing
Active records remain until removed or the applicable family is deleted. Deletion removes live database records; physical file erasure and sign-in-provider cleanup are queued and retried after provider failures. Limited identifiers or encrypted revocation tokens remain in that queue while cleanup is pending. A one-way account-identifier hash is retained for up to 180 days, or longer while sign-in cleanup is pending, to reject old sessions. Backup and infrastructure-log copies may remain until the providers’ configured retention periods expire and are not part of the live account. Previously shared, exported or offline copies are not remotely erased. Contact support for deletion status or applicable backup-retention details.
Your choices and privacy requests
You can inspect and edit information, download documents, manage family access and share links, remove patients, delete families or your login account, and enable or disable Groq AI document processing in Settings. Contact support@eisenvault.com to request access, correction, erasure, withdrawal of consent or to raise a privacy grievance. We assess requests under applicable law and may verify identity and authority, especially for shared records.
Security and medical limitations
We use HTTPS, private file storage, authenticated access and access checks. This is not end-to-end encrypted storage: the service and its providers process content to deliver the features described above. No system can promise absolute security. SanoVault organises records and is not a medical device; it does not diagnose, treat, cure or prevent medical conditions. Verify extracted information against originals and consult a healthcare professional for medical decisions. This policy does not claim HIPAA, GDPR or DPDP certification.
Policy updates
We revise this page and its date when practices change. Material changes requiring notice or additional permission will be presented through the service as applicable. Contact support@eisenvault.com for clarification or an earlier version.