1. Who we are and what this policy covers
This Privacy Policy explains how Healthy Greens Tech Solution LLP ("Healthy Greens", "we", "us"), with its office at Bengaluru, collects, uses, stores and protects data through the website healthygreens.co.in and the Healthy Greens plant disease diagnosis API (the "Services").
It is written to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them.
Our role. Healthy Greens provides its Services only to businesses ("Clients") that integrate our API into their own apps and services. Farmers and other people who use those apps ("End Users") do not deal with us directly.
- For End User data sent to us through the API, the Client decides why and how the data is collected. The Client is the Data Fiduciary, and Healthy Greens processes that data on the Client's behalf and under the Client's agreement with us, except for model improvement, where we act on our own behalf as described in Section 2.
- For data about Client representatives and website visitors, Healthy Greens is the Data Fiduciary.
If you are an End User, please also read the privacy policy of the app you use. It should tell you that your data is shared with Healthy Greens.
2. Data we collect and how we use it
| Data | Where it comes from | Why we use it |
|---|---|---|
| Plant and leaf images | Sent by Clients through the API | To diagnose plant diseases and return results; to train and improve our models |
| Photos uploaded to the demo on our website, and their results | Uploaded by website visitors to "Try it live" on our API documentation page | To show the diagnosis; to train and improve our models |
| GPS location | Sent by Clients with images | To improve diagnosis accuracy using regional crop and disease patterns; to train and improve our models |
| User-specific ID | Sent by Clients to identify an End User or request | To link requests, provide crop health history and troubleshoot issues |
| Client business contact details (name, email, phone, company) | Given by Clients when requesting access or through our contact form | To set up accounts, provide support, send invoices and service notices |
| API usage data (API key, request times, volumes, errors) | Generated when the API is used | To enforce usage limits, bill correctly, monitor uptime and keep the Services secure |
| Website usage data (IP address, browser, pages visited, actions such as trying the demo) | Collected through cookies and similar browser storage on our website, using Amplitude | To run and improve the website (see Section 4) |
We do not ask for names, phone numbers or other direct identifiers of End Users. The user-specific ID is assigned by the Client. Clients should not send us names, phone numbers or other personal details of End Users.
Model training. We use images and location data received through the Services to train and improve our disease detection models. Where practical, we separate this data from user-specific IDs before using it for training. Clients are responsible for informing End Users of this use and obtaining any consent required, as set out in our Terms and Conditions.
Legal basis. We process personal data on the basis of consent obtained by the Client from End Users, consent or legitimate use in relation to Client representatives, and where required to comply with law.
We never sell your data. We do not sell personal data or share it for advertising.
3. Sharing, storage, security and retention
Who we share data with. We share data only with:
- Google Cloud Platform (GCP), which hosts our servers, storage and processing, under Google's data processing terms;
- Amplitude, Inc., our product analytics provider, which processes website usage data and API usage statistics (such as request times, results and errors, but not images, names, contact details or exact locations) on our behalf, under Amplitude's data processing terms;
- SQLite Cloud, Inc., our database provider, which stores contact form submissions, API client accounts and records of analysis requests (including results and any location sent) on our behalf;
- our agronomists and staff, where needed to provide support or expert review, on a need-to-know basis;
- authorities, where required by law, court order or to protect our rights, users or the public.
We do not share Client Data with any other third party without the Client's permission.
Where data is stored. Images and website data are stored on GCP servers located in Asia, including India. Contact form submissions, API client accounts and records of analysis requests are stored by SQLite Cloud on servers in the United States. Website and API usage analytics are processed and stored by Amplitude in the United States. If data is processed outside India, we do so only as permitted under the DPDP Act and any restrictions notified by the Government of India.
Security. We use reasonable security safeguards, including encryption in transit (HTTPS), access controls, API key authentication and restricted staff access. No system is completely secure. If a personal data breach occurs, we will inform affected Clients and the Data Protection Board of India as required by law.
Retention. We keep Client Data for the period set out in the relevant Client Agreement. We keep photos uploaded to the demo on our website, and their results, for as long as they help us improve our models; to have one deleted, contact our Grievance Officer and quote the green_trace_id shown with its result. We keep contact form submissions for as long as we need them to respond to you or provide the Services. When that period ends, or the Client Agreement ends, we delete the data or anonymise it so it can no longer identify any person, unless we must keep it longer by law. Anonymised data may continue to be used to improve our models. Client account and billing records are kept as long as required by tax and accounting laws.
4. Cookies
Our website uses cookies, which are small text files stored on your browser.
- Essential cookies keep the website working and secure. They cannot be switched off.
- Analytics cookies help us understand how visitors use the website, such as which pages are visited and whether the demo works for them, so we can improve it. We use Amplitude for this. If you submit our contact form, we link your earlier website activity to your enquiry using an internal reference number; your name, email and phone number are not sent to Amplitude.
We do not use cookies for advertising. You can block or delete cookies in your browser settings, though some parts of the website may not work properly. The API does not use cookies.
5. Your rights, children, changes and contact
Your rights. Under the DPDP Act, you have the right to:
- get a summary of the personal data we process about you and who we have shared it with;
- ask us to correct, complete or update your personal data;
- ask us to erase your personal data, unless we must keep it by law;
- withdraw consent you gave, with effect for the future;
- nominate another person to exercise your rights in case of death or incapacity;
- raise a grievance with us, and then with the Data Protection Board of India if it is not resolved.
End Users should first contact the Client whose app they use, because the Client holds the link between the user-specific ID and the individual. We will support Clients in responding to these requests. You may also contact our Grievance Officer directly.
Children. Our Services are for businesses and are not directed at children. We do not knowingly process personal data of anyone under 18. Clients must not send us such data without verifiable parental consent as required by the DPDP Act.
Changes to this policy. We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new "Last updated" date, and active Clients will be notified of material changes by email.
Grievance Officer and contact. For questions, requests or complaints about your personal data, contact:
Keshav, Grievance Officer
Email: business@healthygreens.co.in
We will acknowledge your request within 24 hours and respond within the time limits set by law.