FamFirst reads lab reports and shows you every result with its reference range. This policy explains what we collect, why, how long we keep it, who else is involved, and how to exercise your rights. We've written it to be read, not skimmed past.
Who we are
FamFirst is operated by GenDev Studio ("we", "us"). Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the Data Fiduciary for the personal data you give us, and you are the Data Principal.
Contact for anything in this policy, including requests and complaints: hello@gendev.studio.
What we collect
- Your account details from Google when you sign in: your name, email address and Google profile picture link.
- Your answers when you join: whether you're exploring FamFirst for yourself or a company, and your company and role if you share them, plus the date you agreed to this policy.
- Family profiles you create: the names (and optional relation) you give each person.
- Results read from reports you upload: test names, values, units, reference ranges, the line on the report each value came from, and the patient name, age, sex, report date and lab name printed on the report. This is health data, and we treat it with extra care.
- Pilot requests from the For teams page: your name, work email, company, role, monthly report volume and message.
- Records of actions (an audit trail): when you sign in, upload, view, export or delete something. These records contain identifiers and dates, never report contents.
- Basic server logs: the page requested, the response code and how long it took. They don't contain report contents.
What we don't keep
- The file you upload. It's read in memory and on a temporary disk on our server, then deleted, whether reading worked or not.
- Page images. Previews of your report's pages are shown only in your browser tab right after upload and are never stored.
- Tracking data. We don't use analytics, advertising or tracking tools. See the cookie policy.
Why we use it
- To read your reports and show you the results (the service you asked for).
- To keep your reports organised by person and, if you switch it on, to show trends over time.
- To keep you signed in and your account secure.
- To reply to pilot requests and messages you send us.
- To keep the service safe, for example limiting how many reports can be uploaded per day.
We process your data on the basis of your consent, which you give when you join and can withdraw at any time by deleting your account. We don't sell your data, and we don't use your reports to train AI models.
How long we keep it
- Report results: 30 days from the day you check a report, then they're deleted automatically.
- Unless you switch on Keep history for a person in your family profiles. Their reports are then kept until you delete them, so trends can build up. Switching it off gives those reports 30 more days, then they're deleted.
- Your account and profiles are kept until you delete your account.
- Backups. Nightly backups of our database may still hold deleted results for up to 14 days, after which they're gone from backups too.
- Pilot requests are kept while we're in conversation with you, and for at most 2 years.
- Audit records are kept for security and accountability; they contain no report contents.
You can delete a report from its page, a person and their reports from Family, or everything from Account at any time.
Who else is involved
We share the minimum needed with these service providers, who process data for us:
- Google, to let you sign in with your Google account.
- Our hosting provider, which runs the server where FamFirst and its database live.
- An AI service for matching test names (currently Groq), used only when a test name on your report isn't in our dictionary. It receives the bare test name, such as "S. Creat", and nothing else: never your name, values, files or any other part of the report.
We may disclose information if the law requires it.
Your rights
Under the DPDP Act you can:
- Access a summary of the data we hold about you.
- Correct or complete it (for report results, the simplest way is to delete the report and upload it again).
- Erase it: delete reports, people or your whole account in the app, or ask us.
- Withdraw consent, by deleting your account. This doesn't affect processing that happened before.
- Nominate someone to exercise these rights on your behalf if you die or become unable to.
- Raise a grievance with us at hello@gendev.studio. We aim to reply within 7 days. If you're not satisfied, you can complain to the Data Protection Board of India.
Children
FamFirst is for adults. If you're a parent or legal guardian, you may upload your child's report and manage it in a family profile; you're responsible for that decision.
Security
Data is encrypted in transit (HTTPS). The parts of our system that read reports can't be reached from the internet. Access to the server is restricted and logged. If a breach affecting your data happens, we'll tell you and the Data Protection Board as the law requires.
Changes to this policy
If we change this policy in a way that affects how your data is used, we'll ask you to agree again before you upload another report. The date at the top shows when it last changed.
FamFirst reads what's printed on lab reports. It doesn't give medical advice.