Public scanning and private ownership are separate.

Who is responsible for your data

BIDUA Industries Pvt Ltd, which develops and operates TagVomo, decides how personal data in TagVomo is used and is the data fiduciary under the DPDP Act (registered office: Suite 209, C-104, Sector 65, Noida, Uttar Pradesh 201301; CIN U72100UP2024PTC213229). Our marketing partner, RAMAERA Industries Ltd, does not receive owner, scanner, health or payment data from TagVomo. Contact [email protected] for any privacy request.

Data we handle

Activation and operations may use names, mobile numbers, email, delivery and billing address, country, object details, orders, GST invoice records, payment status, messages and support records. Location is collected only when the scanner grants browser permission and submits it. Health information is stored only when an owner adds it. We do not store card or UPI details; online payments are processed by Cashfree.

Consent and purpose

We process your data for the purposes you are told about when you activate a tag, place an order or opt in to messaging, and for legal obligations. Optional messaging (WhatsApp, SMS, voice) is used only if you opted in, and you can withdraw that consent from your owner settings at any time. Withdrawing consent does not affect processing already done. Where a tag protects a child, the activating parent or guardian confirms they may consent for that child.

What a public scan returns

The scan response contains limited tag context and available actions. Stored owner and emergency-contact phone numbers are excluded. Child names, photos and owner-enabled item details are further restricted by category rules.

How data is used and shared

We use data to activate and manage tags, relay alerts, run temporary conversations, fulfil and invoice orders, process refunds, prevent abuse, provide owner controls and maintain operational audit records. We share the minimum necessary data with messaging, email, voice, payment, courier and hosting providers acting for us. We do not sell personal data. Marketing partners who issue promo codes see only how many times their codes were used and the totals, never who used them.

Health and clinical access

Owner-selected emergency fields may appear during a scan. Full medical history and insurance require verified doctor sign-in plus a short-lived patient OTP grant. ABHA/ABDM sync remains disabled in production until verified provider configuration is available.

Retention

Owner and tag data is kept while your tag is active and until you ask us to delete it. Temporary conversation access expires and conversation data is pruned automatically. Order, payment, refund and GST invoice records are kept for the period required by Indian tax and accounting law, even after you delete your tag data. Security and audit logs are kept for a limited period and abuse telemetry is hashed where implemented.

Your rights

Under the DPDP Act you can access a summary of your data, ask us to correct or complete it, ask us to erase it, withdraw consent, nominate a person to exercise your rights if you die or become incapacitated, and use our grievance process. Owners can download their tag data and submit an erasure request from the dashboard. We aim to respond within 30 days. Deleting data deactivates the linked QR identity. Records we must keep by law (for example tax invoices and payment records) are retained but limited to that purpose.

Grievances and requests

Write to [email protected] with the relevant Tag ID or order ID and the request type. This address also serves as our grievance contact; if you are not satisfied with our response you may complain to the Data Protection Board of India once it is operational. Do not email an owner key, OTP, PIN or full medical record.