Privacy Policy
Last updated · 26 October 2026
1. Who is responsible and what this covers
Cistema Pte. Ltd. ("Cistema", "we", "us"), UEN 202405162W, 160 Robinson Road, #26-03, SBF Center, Singapore 068914, is responsible for your personal data when you use Hela. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary, and under Singapore's Personal Data Protection Act 2012 ("PDPA") we are the organisation that collects, uses and discloses your personal data.
This Privacy Policy covers the Hela mobile apps for iOS and Android, the website at hela.org, and our support channels (together, "Hela"). It is written for users in India, who are the people Hela is built for, and it applies to everyone who uses Hela.
This Policy is also the notice we are required to give you under Section 5 of the DPDP Act: it tells you what personal data we process, why, how to exercise your rights, and how to complain to us and to the Data Protection Board of India. Please read it together with our Terms of Use.
2. Personal data we collect
We collect only what Hela needs to work. The table lists each category, with examples and where it comes from.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, email address, profile picture, sign-in provider user ID | Google or Apple, when you sign in |
| Onboarding data | Medical college, admission year | You, during onboarding |
| Study activity | Material you read, questions you attempt, your answers and scores, bookmarks, progress, time spent | Generated as you use Hela |
| Comments | Text you post, the item it is posted on, and when | You |
| Device and technical data | Device model, operating system and version, app version, language, time zone, IP address, installation identifier, push-notification token, crash reports | Collected automatically by the app |
| Usage analytics | Screens viewed, features used, session length, aggregated usage events | Collected automatically through Google Firebase Analytics |
| Support data | Messages you send us and the email address you send them from | You, when you contact us |
What we do not collect. Hela does not collect health or medical records, information about patients, payment or financial information (Hela is free), government identifiers such as Aadhaar or passport numbers, precise location, your contacts, or your photos other than the profile picture your sign-in provider shares. We do not use advertising networks or advertising SDKs, and we do not buy data about you from anyone.
3. Why we use your personal data and on what legal basis
We use your personal data only for the purposes below. Under the DPDP Act we rely on your consent, or on a "legitimate use" under Section 7 where the Act allows it. Under the PDPA we rely on your consent or on deemed consent where you volunteer data for an obvious purpose.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your account, and let you sign in | Account data, device data | Consent; data you volunteer for this purpose (DPDP s.7(a)) |
| Tailor content to your college and year of study | Onboarding data | Consent |
| Track and show your study progress and scores | Study activity | Consent |
| Publish, moderate and respond to comments, and meet our duties under the IT Rules, 2021 | Comments, account data | Consent; compliance with law (DPDP s.7(c)) |
| Send push notifications such as study reminders and service updates | Push-notification token | Consent, given through your device settings, which you can turn off at any time |
| Understand how Hela is used, fix crashes and improve it | Usage analytics, device data, crash reports | Consent |
| Keep Hela secure, and detect and prevent abuse, fraud and breaches of our Terms | Device data, technical logs, study activity | Legitimate use for security and compliance with law (DPDP s.7); deemed consent (PDPA) |
| Respond to your support requests and complaints | Support data, account data | Data you volunteer for this purpose (DPDP s.7(a)) |
| Tell you about changes to Hela, these terms or this Policy | Email address | Compliance with our legal duties to notify you |
| Comply with the law, court orders and lawful requests from authorities | Whatever the request lawfully requires | Compliance with law (DPDP s.7(c)) |
We do not send marketing emails or messages unless you separately opt in, and you can opt out at any time. We do not make automated decisions about you that have legal or similarly significant effects. We never sell your personal data.
4. Consent and how to withdraw it
When you create your account we show you this Policy and ask for your consent to the processing in Section 3. Your consent is free, specific, informed and limited to those purposes.
You can withdraw consent at any time, and withdrawing is as easy as giving it:
- All processing: delete your account in the app (Settings → Account → Delete account). This withdraws consent for everything and starts deletion under Section 7.
- Push notifications: turn them off in your device settings or in the app.
- Analytics or any single purpose: write to our Grievance Officer at the address in Section 13 and tell us which purpose you are withdrawing.
- Consent Manager: once Consent Managers registered under the DPDP Act are available, you may also manage your consent to Hela through one of them.
Withdrawing consent does not affect processing that happened before you withdrew. After you withdraw, we stop the processing within a reasonable time and delete the related data, unless the law requires us to keep it. Some features will not work without the data they depend on; for example, Hela cannot track your progress without your study activity.
5. Who we share your personal data with
We share personal data only with the parties below, and only as much as each needs. Every service provider that processes personal data for us is a Data Processor bound by a written contract under Section 8(2) of the DPDP Act and the PDPA, and may use the data only on our instructions.
| Recipient | What they receive | Why | Where they process it |
|---|---|---|---|
| Amazon Web Services (AWS) | All data stored by Hela | Hosting our servers and database | Mumbai, India |
| Google LLC (Google Sign-In, Firebase Authentication, Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging) | Account data at sign-in; device data, usage analytics, crash reports, push-notification token | Sign-in, analytics, crash reporting, push notifications | Google's global infrastructure, including the United States |
| Apple Inc. (Sign in with Apple, Apple Push Notification service) | Apple ID sign-in data; push-notification token | Sign-in and notifications on iOS | Apple's global infrastructure |
| Other Hela users | Your first and last name, as received from your sign-in provider, and the comments you post | Comments are shown with your name to other users inside Hela; you cannot post anonymously or under a different name at present | Within Hela |
| Courts, regulators and law-enforcement agencies | What the law or a valid order requires | To comply with legal obligations, enforce our Terms, or protect the rights and safety of users and others | India or Singapore, as the request requires |
| A buyer or successor of our business | Personal data forming part of the business | In a merger, acquisition or sale of assets; we will notify you before your data is transferred and the buyer must honour this Policy | Depends on the buyer |
For the sign-in services themselves, Google and Apple act as independent Data Fiduciaries under their own privacy policies, because they decide how your Google or Apple account data is used. Firebase Analytics, Crashlytics, Cloud Messaging and AWS act as our processors.
Our own staff and contractors in Singapore and India may access personal data to operate Hela, under confidentiality obligations and only as their role requires.
We do not sell personal data, and we do not share it with advertisers, data brokers or advertising networks.
6. Where your data is stored and cross-border transfers
Your personal data is stored on Amazon Web Services servers in Mumbai, India. Our team accesses it from Singapore, and from India where we have staff there.
Some technical data is processed outside India: Google processes sign-in, analytics, crash and push-notification data on its global infrastructure, including in the United States, and Apple processes Sign in with Apple and push-notification data on its infrastructure.
India. Section 16 of the DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts by notification. We do not transfer personal data to any restricted country, and if a country we rely on becomes restricted we will take the steps needed to comply, which may include changing providers.
Singapore. Under Section 26 of the PDPA, we transfer personal data out of Singapore only where the recipient is bound to protect it to a standard comparable to the PDPA. We achieve this through our data-processing contracts with AWS, Google and Apple, which include contractual safeguards for international transfers.
Whatever the location, your personal data remains protected by this Policy and by the DPDP Act and PDPA rights described in Section 9.
7. How long we keep your personal data
We keep personal data only as long as the purpose in Section 3 requires, and then delete or anonymise it. The schedule below applies unless the law requires a longer period.
| Data | While your account is active | After you delete your account or withdraw consent |
|---|---|---|
| Account and onboarding data | Kept | Deleted within 30 days, except a minimal registration record (your email address and user ID) which Rule 3(1)(g) of the IT Rules, 2021 requires us to keep for 180 days, after which it is deleted |
| Study activity | Kept | Identifiers removed within 30 days; only anonymised, aggregated statistics remain |
| Comments | Kept while posted | Deleted or stripped of your name within 30 days; content removed for breaching our Terms may be kept for up to 180 days under the IT Rules, 2021 |
| Device and technical logs | Rolling 90 days | Rolling 90 days |
| Usage analytics (Firebase) | Up to 14 months, then aggregated | Up to 14 months, then aggregated |
| Support correspondence | Kept | 24 months after the matter is closed |
| Backups | Rolling 90 days | Purged from backups within 90 days |
Inactive accounts. If you do not use Hela for 36 months, we will email you and, if you do not sign in within 30 days, delete your account and data under this schedule.
Legal holds. We keep data longer where a law, court order or ongoing investigation requires it, and only for as long as that requirement lasts.
Deleting your account. You can delete your account at any time from Settings → Account → Delete account. Deletion is permanent and cannot be undone. You can also request deletion without the app at hela.org/delete-account.
8. How we protect your personal data
We take reasonable security safeguards, as Section 8(5) of the DPDP Act and Section 24 of the PDPA require, to prevent personal data breaches. These include:
- encryption of data in transit (TLS) and at rest on AWS;
- sign-in through Google and Apple, so we never store your password;
- role-based access controls and least-privilege access for our staff, with logging of access to production systems;
- separation of production data from development and test environments;
- regular review of our providers' security certifications and of our own configuration; and
- a documented incident-response process.
No system is completely secure. If you think your account has been compromised, contact us at once at the address in Section 13.
If a breach happens. If a personal data breach affects you, we will notify you without undue delay with a description of the breach, its likely consequences, the steps we are taking, and what you can do to protect yourself. We will also notify the Data Protection Board of India without delay, with full details within 72 hours as the DPDP Rules, 2025 require, and the Personal Data Protection Commission of Singapore within 3 calendar days where the breach is notifiable under the PDPA.
9. Your rights and how to use them
You have the rights below. They are free to exercise. Once we have verified your identity, we respond within 90 days if you are in India, as the DPDP Rules, 2025 allow, and within 30 days if you are in Singapore, as the PDPA requires.
| Right | India (DPDP Act) | Singapore (PDPA) |
|---|---|---|
| Access: a summary of the personal data we hold about you, how we process it, and the processors and other fiduciaries we have shared it with | Section 11 | Section 21 |
| Correction, completion and updating of inaccurate or incomplete data | Section 12 | Section 22 |
| Erasure of personal data no longer needed for its purpose, or where you withdraw consent | Section 12 | Through withdrawal of consent |
| Withdrawal of consent at any time | Section 6 | Section 16 |
| Grievance redressal: a response from us, and then a complaint to the regulator | Section 13 | Section 28 |
| Nomination: name a person to exercise your rights if you die or become incapacitated | Section 14 | Not provided |
How to exercise them. Use the account controls in the app for deletion and for updating your onboarding details, or write to our Grievance Officer at the address in Section 13 from the email address linked to your account. We may ask for information to confirm it is you. If we refuse a request, we will tell you why and how to complain.
Your duties. Under Section 15 of the DPDP Act you must not impersonate anyone, must not suppress material information when giving us data, must not file a false or frivolous grievance, and must give only information you can verify as authentic when exercising a right to correction or erasure.
Complaining to a regulator. If you are not satisfied with our response, you may complain:
- in India, to the Data Protection Board of India, after first raising the matter with our Grievance Officer, as Section 13(3) of the DPDP Act requires; or
- in Singapore, to the Personal Data Protection Commission at pdpc.gov.sg.
10. Children
Hela is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, who is a child under Section 2(f) of the DPDP Act. We do not track, monitor the behaviour of, or direct advertising at children. If we learn that an account belongs to someone under 18, we will close it and delete its data under Section 7. If you believe a child has created an account, tell us at the address in Section 13.
11. Cookies and the hela.org website
The website at hela.org uses only strictly necessary cookies and similar technologies needed to display the site and keep it secure. These do not require your consent. If we add analytics or other optional cookies in future, we will ask for your consent through a banner before setting them, and you will be able to refuse without losing access to the site.
The Hela apps do not use cookies. They use the device identifiers and analytics described in Section 2.
12. Changes to this Policy
We may update this Policy when Hela changes, when we add providers, or when the law changes. The current version is always at hela.org/privacy and in the app, with its effective date at the top.
If a change materially affects how we use your personal data, we will tell you at least 15 days before it takes effect, in the app or by email, and where the law requires it we will ask for your consent again. Earlier versions are available on request.
13. Contact us
Our Grievance Officer under the DPDP Act and the IT Rules, 2021, who is also our Data Protection Officer under the PDPA, handles all questions, requests and complaints about personal data.
| Grievance Officer / Data Protection Officer | Nur Alisyah |
| alisyah@designmed.org | |
| Postal address | Grievance Officer, Cistema Pte. Ltd., 160 Robinson Road, #26-03, SBF Center, Singapore 068914 |
| Company | Cistema Pte. Ltd., UEN 202405162W, incorporated in Singapore |
| Website | hela.org |
We acknowledge personal data requests and complaints within 7 days and resolve them within 90 days for users in India (DPDP Act) or 30 days for users in Singapore (PDPA). Each request receives a ticket number so you can follow its progress.