How we handle your data

This Privacy Policy describes how A TO Z LINK, a sole proprietorship registered in India, operating the brand “GLP-1 Check” through the website www.glp1check.in (the “Service”), collects, uses, stores, and protects your personal data.

We are the Data Fiduciaryfor the personal data you provide to us, as defined under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

Operator: A TO Z LINK
Contact: [email protected]

We collect only the data needed to operate the Service. Categories:

• Triage inputs you provide: age, sex, height, weight, waist circumference, self-reported medical history (e.g. type 2 diabetes, hypertension, PCOS, thyroid history, prior pancreatitis), and prior weight-loss treatment history. This data is health-adjacent and we treat it with extra care.
• Optional contact data: phone number and (if provided) name, only if you voluntarily submit the lead form to be contacted by a specialist about your result. You may use the Service entirely without providing any contact data.
• Communication data: if you message us on WhatsApp via our official business number, we receive and store the contents of your conversation, message timestamps, delivery status, and the WhatsApp phone number you used to contact us.
• Technical data: IP address, device type, browser type, referring URL, pages visited, and timestamps. This is collected automatically by our hosting provider and analytics tools.
• Cookies and analytics identifiers: see Section 9.

We do not collect government identity numbers (Aadhaar, PAN), payment information (we do not currently process payments on this site), biometric data, or precise geolocation.

• To compute your GLP-1 Readiness Score and show you your triage result.
• To save your triage submission so you can revisit the result link.
• To contact you (only if you opt in) to discuss your result with a specialist.
• To respond to your messages, support requests, and grievances.
• To monitor Service performance, debug issues, and prevent abuse.
• To improve the Service through aggregated analytics.
• To comply with applicable Indian law, court orders, or regulatory requests.

Under the DPDP Act, we process your personal data on the basis of your consent. By submitting the triage form, the lead capture form, or messaging us on WhatsApp, you provide consent for the processing described in this Privacy Policy.

Where the law permits processing for “legitimate uses” (such as responding to a medical emergency or complying with a legal obligation), we may process your data on that basis instead.

You may withdraw your consent at any time by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We do not sell your personal data. We share it only with the following categories of Data Processors, who act on our behalf and under contractual terms:

• Hosting and database— Supabase Inc., with our database hosted in the AWS Mumbai (ap-south-1) region. Triage submissions and lead data are stored here.
• Application hosting— Vercel Inc., which serves the Service's pages.
• Email delivery— Google LLC (Google Workspace SMTP) for transactional email.
• Analytics and product instrumentation— Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation), used to understand aggregate usage. These tools may set cookies in your browser.
• WhatsApp messaging infrastructure— Interakt (Haptik Inc.) as our WhatsApp Business Solution Provider, and Meta Platforms Ireland Ltd / WhatsApp LLC for the underlying message delivery, when you communicate with us on WhatsApp.
• AI processing— Anthropic, PBC, where we use the Claude API for limited content generation. We do not send your triage submissions or contact data to Anthropic.
• Connected clinics and booking partners— only with your explicit consent (e.g. when you choose to book a consultation), and only the data necessary for the booking.
• Legal and regulatory authorities— if required by Indian law, a court order, or a binding regulatory request.

Some of these processors are located outside India. The Indian government has not at this time issued a country restriction list under the DPDP Act, so cross-border transfer is permitted to all jurisdictions other than any that may be specifically restricted in future. We use processors with appropriate data protection commitments.

• Triage submissions: retained for up to 24 months from the submission date, after which they are deleted or irreversibly anonymised.
• Lead capture data (phone number, name): retained for up to 24 months from your last interaction. If you ask us to delete it sooner, we will.
• WhatsApp conversation history: retained for up to 24 months from your last message, for support continuity and regulatory traceability.
• Analytics data:retained per the analytics provider's default settings (Google Analytics: typically 14 months; Microsoft Clarity: typically 13 months).
• Email correspondence: retained as long as needed to handle the matter and meet our legal obligations.

As a Data Principal, you have the following rights with respect to your personal data:

• Right to access: obtain a summary of the personal data we hold about you and how it is being processed.
• Right to correction and erasure: ask us to correct inaccurate data, complete incomplete data, update outdated data, or erase data that is no longer necessary for the purpose for which it was collected.
• Right to grievance redressal: contact our Grievance Officer (see below).
• Right to nominate: nominate another individual to exercise these rights on your behalf in case of your death or incapacity.

To exercise any of these rights, email [email protected] with your request. We will respond within a reasonable timeframe consistent with the DPDP Act.

• Data in transit is encrypted using HTTPS (TLS 1.2 or above).
• Database access is restricted to the application's service role and authorised administrators using least-privilege controls.
• Row-Level Security policies are enabled on the database to prevent unauthorised cross-record access.
• Triage submissions use a random session identifier and are not linked to your name unless you voluntarily submit the lead form.
• WhatsApp messages are delivered over Meta's end-to-end encrypted infrastructure.
• We periodically review our security posture and update controls as the Service evolves.

We use a small number of cookies and similar technologies for the following purposes:

• Strictly necessary: session cookies required to operate the Service (e.g. to remember your triage session).
• Analytics: Google Analytics and Microsoft Clarity set cookies to measure aggregate site usage. These tools may also record session replay information for product improvement, anonymised to the extent technically possible.

You can disable cookies in your browser settings. Most parts of the Service will continue to work, but some features may behave unexpectedly.

The Service is intended for adults aged 18 and above. Semaglutide is not approved for chronic weight management in adolescents under 18 in India, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted personal data to us, please email [email protected] and we will delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when it was last revised. Material changes will be highlighted on this page or communicated to you through the Service.

For any privacy concern, complaint, or request to exercise your rights under the DPDP Act, please contact our Grievance Officer:

We will acknowledge your communication and respond within a reasonable timeframe. If you are not satisfied with our response, you may approach the Data Protection Board of India under the DPDP Act.