Syntro Health
Syntro Health
Syntro Health
Last updated: November 11, 2026 · Legal text version 2026-10-10
Syntro Health is operated by Binary Froster Technologies, HSR Layout, Sector 7, Bengaluru, Karnataka 560102, India. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). For users in the UK or the EU, we act as a controller under the UK GDPR and the EU GDPR.
Contact for privacy questions: privacy@syntrohealth.com
Person who answers privacy questions: [name and contact to be confirmed before publication]
UK or EU representative (if required for your country): [to be confirmed before publication]
| Category | Examples | Sensitivity |
|---|---|---|
| Account | Name, email, hashed password, consent records, and Google account ID if you sign in with Google | Ordinary |
| Health profile | Age, sex and gender identity, height, weight, body measurements, activity, sleep, stress, alcohol and smoking habits, diet type, food allergies, medical conditions, medicines and supplements you report, pregnancy or breastfeeding status, menstrual health questions, and gender-affirming hormone questions if you answer them | Health data (special category) |
| Screening answers | Eating-pattern screening questions and the risk flags they produce, physical-check signs you report, and social circumstances such as food access and budget | Health data (special category) |
| Lab reports | Reports you or a technician upload (PDF, scan or photo), the biomarker values we read from them, and the name, age and sex printed on the report, which we use to check it belongs to your profile | Health data (special category) |
| Plan activity | Food diary entries, weight and progress entries, plan history, meal follow-up records, weekly check-ins (energy, dislikes, skipped meal times, and any symptoms you tick), food photos and voice notes you submit for analysis | Health data |
| Clinical notes | Notes that a doctor, dietitian or you enter about a condition or medicine | Health data (special category) |
| Professional links | Which dietitian, doctor or technician you have connected to your profile | Ordinary |
| Security | IP address, browser type, timestamps, sign-in attempts, rate-limit records | Ordinary |
| Device data | The wearable panel shows sample values only. No device data is collected at present. | None |
| Purpose | Legal basis |
|---|---|
| Create your account and provide the service | Contract (UK GDPR and EU GDPR Art 6(1)(b)); under the DPDP Act, consent |
| Generate your diet plan, read lab reports, analyse food photos and voice notes, and prepare each weekly plan | Your consent to health processing (UK GDPR and EU GDPR Art 9(2)(a); DPDP Act s.6). You give it on the questionnaire or when you upload a report, and you can withdraw it in Account settings at any time. |
| Show your plan to a dietitian or doctor you connect, or let a technician upload a report for you | Your consent (Art 9(2)(a)), given by you or on your instruction |
| Keep the service secure and prevent abuse | Legitimate interests (Art 6(1)(f)); for health data, the same consent |
| Meet legal obligations, for example reporting a cyber incident or answering a lawful request | Legal obligation (Art 6(1)(c)); under the DPDP Act, the lawful ground that applies |
We do not sell your data, and we do not use your health data for advertising.
| Recipient | What they receive | Why |
|---|---|---|
| Google (Gemini API) | Your health profile, lab report text or scans, food photos and voice notes that you submit | Generating plans, reading reports and analysing photos. The data-use terms of the Gemini tier in use: [to be confirmed before publication]. |
| OpenAI (only when the operator enables it) | The same profile data sent to Gemini | An alternative AI provider. Not used unless it is turned on. |
| Supabase (database hosting, where used) | All data stored on the platform | Storing the application database |
| Hosting provider (Vercel or Render, whichever is live) | Requests and data handled by the application | Running the application [to be confirmed which deployment is live] |
| Resend (email) | Your email address and the text of messages we send | Account, password reset and plan notification emails |
| Upstash QStash (background jobs) | A job identifier only. No health data is sent. | Running plan generation in the background |
| Google (sign-in, if you use it) | Authentication only | Signing in with your Google account |
| Professionals and technicians you connect | Your profile, plans and reports, as far as the connection allows | Your dietitian, doctor or technician acting for you |
We do not share your health data with advertisers or insurers.
Our hosting and AI providers process data outside India, the UK and the EEA, mainly in the United States. [The transfer mechanism for each processor, and the countries they process in, must be confirmed before publication.] Under the DPDP Act, transfers are allowed except to countries the Central Government restricts. For UK and EU users, transfers rely on the mechanisms described in the UK GDPR and EU GDPR.
Your consent: you can withdraw consent to health processing at any time in Account settings. We then stop new health processing for your account. The data already held stays until you delete it, and any processing done before you withdrew stays lawful.
India (DPDP Act, 2023): you can ask for a summary of your data and the processing done with it, correction of inaccurate data, and erasure. You can also raise a grievance (see section 10).
UK and EU: you can ask us for access to your data, correction, erasure, restriction, a copy in a portable format, or to object to processing. We reply within one month, as the UK GDPR and EU GDPR require.
Grievance officer (India): [name and contact to be confirmed before publication]. Send a grievance by email to privacy@syntrohealth.com. We acknowledge it and respond within the time the law requires.
If you are not satisfied with our answer, you can complain to:
We keep a record of every personal data breach, whether or not it is reported. A breach that affects the security of personal data is reported to CERT-In within 6 hours of our becoming aware of it, as Indian law requires. Where the DPDP Act requires it, we also notify the Data Protection Board of India and each person affected. In the UK and EU, we report a breach to the regulator within 72 hours where feasible, and tell affected people without undue delay if the breach is likely to put them at high risk.
Syntro Health is for adults aged 18 or over. You confirm your age when you register and when you create a profile, and the service refuses a profile for a person under 18. We do not knowingly collect data from children. If we learn that we have, we delete it.
See our Cookie Policy. Strictly necessary cookies keep you signed in and protect forms. Other storage on your device needs your consent under the UK PECR and EU ePrivacy rules.
We will tell registered users by email or in the app when we make significant changes. The version and date appear at the top of this page. Where we need your consent again, we will ask for it.