Privacy Notice

Smily Pruthi, a sole proprietor trading as Dr. Smily Pruthi from Ludhiana, Punjab, India, controls the personal information described in this Notice ("Dr. Smily", "we", "us" or "our"). This Notice applies to the public website, student platform, administrator-operated support, payments, protected learning content and notifications.

For a privacy question, rights request or grievance, email [email protected] with the subject "Privacy Request" or open an in-app Support case. We may verify that the request belongs to you before disclosing or changing account information.

We collect information you provide, information created through your use of the platform, and limited technical information necessary to deliver and protect the service.

• Account and profile information, including name, email, optional phone number, date of birth, gender, institution, city, state, country, training stage, learning goal, exam date and study preferences when you choose to provide them.
• Learning information, including selected subject, lesson and video progress, chapter activity, answers and scores where learning activities are available, bookmarks, reading position and related study activity.
• Purchase and support information, including the plan selected, amount, tax record, billing name, email, phone and state, payment-provider references, refund evidence, support messages and attachments.
• Authentication, device and security information, including sign-in method, session identifiers, IP address, user agent, one-way device-token hashes, device label, access times, concurrent playback, audit events and visible or forensic watermark identifiers.
• Notification information, including in-app read status, communication preferences and an encrypted push token when you separately enable browser or device push notifications.
• Legal-consent evidence, including the accepted document versions, timestamp, IP address and user agent.
• Content-protection events generated when supported controls encounter actions such as copy, print, context-menu, cut or drag attempts. These controls do not detect every screenshot, recording or misuse.

Most information comes directly from you. We also receive limited information from Google when you choose Google sign-in, from Razorpay about a payment or refund, from VdoCipher during protected playback, from Firebase when push is enabled, and from the device or browser used to access the platform.

We do not intentionally collect complete card details, UPI PINs, banking passwords, government identity documents, patient records or health information. Do not submit patient names, clinical images, medical records or other identifiable patient information through support, WhatsApp, uploads or any platform feature.

Depending on the purpose and applicable law, we process information to perform the service you request, meet legal obligations, protect legitimate interests such as security and content ownership, or act on your consent for an optional feature.

• Create and secure your account, authenticate sign-ins, enforce device and stream limits, and prevent credential sharing, fraud and abuse.
• Deliver the selected subject, protected video lessons, mapped notes, progress, purchases, refunds, support and service communications.
• Remember bounded preferences such as theme, playback quality, captions, lesson filters and reading position on your device.
• Maintain reliability, diagnose errors, improve accessibility and understand platform performance using operational or appropriately aggregated information.
• Meet accounting, tax, consumer, security, record-keeping and dispute-resolution obligations.
• Deter and investigate suspected piracy or unauthorized distribution, trace leaked material where reasonably possible, enforce the Terms and preserve proportionate evidence.

During signup you accept the Terms and acknowledge this Notice. That action is not blanket consent for unrelated marketing, advertising or optional analytics. We record the document versions, time, IP address and user agent as evidence of the legal notice presented to you.

Account, payment, security, support and material legal messages are necessary service communications. Promotional offers are optional and are off by default. Browser or device push is optional and is requested separately; denying or disabling it does not remove in-app messages.

Where processing relies on consent, you may withdraw it through the available preference or by contacting us. Withdrawal does not affect earlier lawful processing. An optional feature may stop working when its necessary permission is withdrawn.

We do not sell personal information and do not currently use third-party behavioural advertising. We disclose only the information reasonably necessary for the following providers to perform their services.

• DigitalOcean and configured S3-compatible storage providers for application hosting, databases, backups and protected media storage.
• VdoCipher for encrypted video playback, short-lived playback authorization, stream controls and account-linked watermarking.
• Razorpay for checkout, payment verification, receipts, refunds and fraud controls. Razorpay handles complete card or banking credentials under its own privacy and security terms.
• Resend for email sign-in codes and necessary transactional email.
• Google Identity for Google sign-in when chosen by you, and Firebase Cloud Messaging for push delivery only after push is enabled.
• WhatsApp and Meta only when you choose to open an external WhatsApp conversation.
• Professional advisers, courts, regulators, law-enforcement authorities or another party to a lawful business transfer where disclosure is reasonably necessary, proportionate and permitted by law.

Our business is based in India. Some providers may process or store limited information in India, Singapore, the United States or other locations used by their infrastructure. Provider locations can change over time.

Where applicable law requires it, we use contractual, organizational and technical safeguards for international processing and restrict providers to the purpose for which the information was disclosed.

We keep personal information only while it is needed for the purpose described here or for a legal, security, accounting, fraud-prevention or dispute requirement. Short-lived sign-in codes expire within the authentication window; related abuse-prevention records are retained for a bounded security period. Active sessions expire or are revoked, while required security logs are retained for the applicable incident-response period, including at least 180 days where the CERT-In directions apply.

Account and learning information is kept while the account is active and then deleted or de-identified after a verified deletion request and the applicable operational period. Invalid or disabled push tokens are removed or deactivated. Support information is kept while a case and any related dispute remain relevant.

Payment, refund, tax, consent and audit records may be retained for the period required by tax, accounting, consumer, limitation, security or other applicable law even after account deletion. Backup copies rotate out under the backup schedule and are not restored for ordinary product use after deletion.

We use access controls, least-privilege administrator permissions, protected sessions, encryption in transit, encryption or one-way hashing for selected sensitive values, private media storage, audit records, backups and other proportionate safeguards. Payment credentials are handled by Razorpay rather than stored by Dr. Smily.

Protected content can carry an account-linked watermark, and suspicious access, concurrent playback or attempted control bypasses may be reviewed. We use this information to protect learners, accounts and teaching material; it is not used to make clinical or employment decisions about you.

No online service can promise absolute security. Report suspected account misuse or a privacy incident promptly to [email protected].

Subject to applicable law, you may request a summary or copy of personal information we process, correction or completion, deletion, withdrawal of consent, details of relevant sharing, restriction or objection, portability where applicable, nomination where available under Indian law, and grievance review. You will not be denied ordinary service merely for making a lawful privacy request, although deleting information necessary for an account may require closing it.

Email [email protected] with the subject "Privacy Request" or open in-app Support. State whether you want access, correction, deletion, consent withdrawal or grievance review. Do not send identity documents unless we specifically request a proportionate verification method. We will acknowledge the request, verify account ownership and respond within the period required by applicable law.

If you are dissatisfied after using our grievance process, you may complain to the Data Protection Board of India or another competent privacy or consumer authority when that remedy is available to you.

The platform is intended only for adults aged 18 years or older. A person under 18 must not create an account, purchase a plan or use protected content. If you believe a minor has provided personal information, contact us so that we can investigate and delete it where required.

We use essential cookies and similar browser storage for authentication, CSRF protection, session hints, theme, accessibility, playback preferences, notification choices, checkout recovery, filters and bounded lesson or reading position. Some values remain on the device until they expire, are cleared by the app or are removed through browser settings.

The platform does not currently load optional advertising cookies. If non-essential analytics or advertising technology is introduced, it will be documented and presented for a separate choice where required before it loads.

We may update this Notice when the product, providers or law changes. Material changes will receive a new version and will be presented for acknowledgement or consent, as appropriate, before continued protected access.

The privacy contact for Smily Pruthi, sole proprietor trading as Dr. Smily Pruthi, is [email protected]. Use the subject "Privacy Request" for access, correction, deletion, consent or grievance matters.