Privacy Policy

Account & profile: your name, email address, WhatsApp number, and password (stored only as a secure hash). During registration you also provide your designation, medical college, state, district, and optionally your city, and you confirm that you are 18 or older and accept our policies. We record when you did so and which version of the policies you accepted.

Activity data: your exam attempts, answers, scores, grading notes, practice sessions, which spotters you have opened and when, bookmarks, credits and how you earned or spent them, library submissions, hosted exams and invitations, connections with other members, study-room use, focus sessions, tasks, and goals, notifications, and reports you file.

Plan and payment information: your plan, its dates, and any requests to upgrade. Paid plans are bought on the website through Razorpay, our payment processor, or arranged directly with our team (for example by UPI or bank transfer). We record the amount, date, the payment reference, and the payment method name; we do not collect or store your card, UPI, or bank details, except the UPI ID an ambassador gives us to be paid, described below. The app does not take payments.

RadOpus and messages: listings you post, listings you save, promotions you buy, and messages you send us through the contact form.

Technical and security data: your IP address, approximate location derived from it (country and city), device and browser information, the time of each sign-in, whether the connection looked like a VPN or proxy, and whether a sign-in was blocked or flagged. On the app, a push-notification token and a device identifier so we can send you notifications. We also record errors the app or website reports so we can fix them.

Launch announcement list: if you enter your email address on our holding page before Viewbox opens, we store that address and the date you gave it, so we can tell you when it opens. Nothing else about you is kept with it: no name, no account, no profile. Your IP address is used at that moment only to rate-limit sign-ups and block automated abuse, and those records are deleted automatically about a day later. We use the address for the launch announcement and nothing else, and you can ask us to remove it at any time by contacting the Grievance Officer below. We delete the list once the launch announcement has been sent.

Teaching and contribution interest: if you tell us on your settings page that you are an academic radiologist, or that you would teach online, contribute cases, or host exams, we store those answers along with any institution and note you choose to add. We use them only to contact you about teaching or contributing. They are visible to the Viewbox team alone, never shown to other users, never listed, and never searchable. You can remove them at any time by unticking every option on that page; they are included in your data export and deleted when you close your account.

Ambassador programme: if you apply to be an ambassador, we store your name, email address, WhatsApp number, college or hospital, course and year, city, and any handle and note you add, to review your application and contact you about it. If you become an ambassador, we also store the UPI ID you give us for payouts, the commission on each purchase made by people who signed up with your code (its date, price and amount), and the payouts we make to you. You see the date and price of those purchases, never who made them. If you signed up with an ambassador's code, the date and price of your purchases in your first year are used to work out their commission; they are not told who bought. A rejected application is deleted 180 days after it was decided, and a pending or rejected one when you close your account. Commission and payout records are kept as financial records. Your application and earnings are included in your data export.

We use your information for these purposes:

• To create and manage your account and verify your access against our community (to perform our agreement with you);
• To run exams, grading, the library, practice, leaderboards, credits, connections, study rooms, and RadOpus (to perform our agreement with you);
• To provide paid plans, record payments, and show or remove advertising according to your plan and credits (to perform our agreement with you);
• To send you service messages such as exam reminders, approvals, policy updates, and security notices, and notifications you have opted into (with your consent, which you can withdraw in your settings or device settings);
• To keep the Service secure, detect account sharing, cheating, and automated access, enforce our Terms, and prevent abuse (our legitimate interest in protecting the Service and other members);
• To comply with law, respond to lawful requests, and establish or defend legal claims; and
• To understand how the Service is used and to improve and support it, using aggregated figures wherever possible.

We do not use your personal data for automated decisions that have legal or similarly significant effects on you. Security checks may automatically block a sign-in; a person reviews any block you ask us about.

By registering you consent to the processing described in this policy for the purposes above. You can withdraw consent at any time: turn off notifications in your settings or device, untick your teaching interest, or delete your account from your settings, which withdraws consent for everything except what we must keep by law. Withdrawing consent does not affect processing that happened before, and some features cannot work without the data they need.

We do not sell your personal data. We share it only with service providers who process it on our instructions, under contracts that require them to protect it:

• Supabase: our database, authentication, and image storage provider;
• Vercel: hosting for the website and its server code;
• Resend: delivery of the emails we send you;
• Google Firebase: push notifications to the app;
• Google AdSense and AdMob: advertising shown to free accounts, which may use your advertising identifier or cookies as described in our Cookie Policy;
• Cloudflare Turnstile: a check at registration that you are not a bot;
• IPQualityScore: a check of your IP address at sign-in to detect VPNs, proxies, and anonymisers. Only the IP address is sent.
• Razorpay: processes online payments for plans bought on the website. When you pay, your name, email address, and WhatsApp number are passed to Razorpay to prefill the payment form, and Razorpay collects your payment details directly under its own privacy policy.

Other members see what you choose to show them: your name on leaderboards unless you choose to be anonymous, on exams you host, on listings you post, and to people you connect with. Hosts of exams you take see your answers and scores for that exam. Administrators can view profile details (including your WhatsApp number), activity, and security records to approve accounts, grade exams, review content, and investigate misuse.

We may also disclose information where required by law, to a court or regulator, to protect the rights, safety, and security of our users and the Service, or to a successor if the Service is transferred, who will be bound by this policy.

Each sign-in is recorded with its IP address, approximate location, device information, and the result of our checks. We use these records to spot impossible travel, account sharing, and automated access, and to answer your own questions about your account. Sign-in records are deleted automatically after 180 days, and error reports after 90 days. We may keep records that are part of an investigation or a legal matter for longer.

Passwords are stored as secure hashes, connections are encrypted in transit, data is encrypted at rest by our providers, administrator access requires a second factor, and access to your data is restricted by row-level security so users can only see what they are permitted to. Model answers are served only on request and are watermarked, and the app blocks screenshots of teaching material. No system is perfectly secure, but we work to protect your information and to limit who can access it.

If a breach of personal data affects you, we will notify you and the Data Protection Board of India as the law requires.

We keep your information for as long as your account is active and as needed to provide the Service, resolve disputes, and meet legal obligations.

When you delete your account, we sign you out everywhere, remove your profile details, connections, study-room memberships, device tokens, teaching interest, and pending data requests, delete your focus sessions, tasks, and goals, and anonymise the rest. We keep a minimal record of the email address and WhatsApp number, together with any moderation history (rejections, bans, and appeals), so that an account removed for misuse cannot simply be re-registered, and so that we can answer a later dispute. This means a deleted email address cannot be used to sign up again. Payment records are kept for as long as accounting law requires. Backups are rotated on a schedule and deleted content may persist in them for a short period.

Content you contributed to the library may remain, anonymised, where it has already been used in exams or practice sessions.

Access: you can request a copy of the personal data we hold about your account from Settings, under Your Data, on the website or in the app. The copy is prepared as a readable page, can be collected for 7 days, and can be requested once every 30 days. We email you when a copy is ready, so you will know if someone else requested it from your account. If you need something sooner, contact the Grievance Officer.

Correction: you can update most of your details from your profile. Ask us to correct anything you cannot change yourself.

Erasure: you can delete your account from Settings. We will remove or anonymise your personal data as described in Section 7, except where we must retain it by law.

Withdrawal of consent, nomination, and grievances: see Section 3 and the Grievance Officer section below. You may nominate another person to exercise these rights for you if you are unable to.

We may need to confirm your identity before acting on a request, and we act only on requests from the account concerned or a nominated person.

Viewbox is intended for medical professionals and trainees aged 18 or older. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has registered, contact us and we will remove the account.

Our service providers may process and store data on servers located in other countries, including the United States and Singapore. Where this happens, we rely on providers that offer appropriate protection for your information, and we transfer data only to countries that Indian law permits.

Our Cookie Policy explains the cookies and similar technologies we use, including those set by advertising networks for free accounts, and how to control them.

We may update this Privacy Policy from time to time. We will revise the effective date above, record the change on our Policy Updates page, and notify you of significant changes in the app or by email.

If you have a concern about how your personal data is handled, or wish to exercise your rights (access, correction, or erasure of your data, withdrawal of consent, or nominating someone to exercise these rights for you), you may contact our Grievance Officer:

• Dr. Gavan Dhola, Founder
• Email: theviewbox.in@gmail.com
• WhatsApp: +91 76240 46054

We aim to acknowledge grievances within 72 hours and resolve them within 30 days. We may ask you to confirm your identity before acting on a request, and we will act only on requests that come from the account concerned or from a person you have nominated. If you are not satisfied with our response, you have the right to register a complaint with the Data Protection Board of India.

Viewbox is operated by Gavan Technology Private Limited (CIN U63999GJ2026PTC180228), registered office: Shop no. 12, Gavan Homes, Opp. Vastav Park, Vapi (M), Vapi, Pardi, Valsad, Gujarat 396191, India. Company website: https://gavantechnology.in. Company email: gavantechnology@gmail.com.

If you have questions about this policy or your account, reach us at:

• Email: theviewbox.in@gmail.com
• WhatsApp support: +91 76240 46054
• Website: https://www.theviewbox.in
• Instagram: @theviewbox.in