1. Who we are and what this policy covers
Dharini is an open-source One Health disease surveillance platform developed and operated by ARTPARK, Indian Institute of Science, Ground Floor, Entrepreneurship Building, Bengaluru 560012 and NCBS-TIFR (National Centre for Biological Sciences, Tata Institute of Fundamental Research, GKVK, Bellary Road, Bengaluru 560065) (“we”, “us”). The platform supports clinical and environmental sample collection, pathogen surveillance, genomic sequence analysis, and decision support, with a primary focus on animal health. This policy explains what information Dharini collects, how it is stored and protected, with whom it is shared, and the choices available to you.
It applies to:
- the Dharini web application (dashboard, monitoring, lab and admin tools);
- the Dharini mobile application for Android (field collection);
- the Dharini backend services and APIs that support both.
It covers two groups of people:
- Platform users: field collectors, lab staff, team leads, project and workspace administrators.
- Site owners and contacts: farm owners, site owners and workers whose details are recorded during site registration and visits.
Dharini is used for public-health and animal-health surveillance. Most information is entered by authorised users as part of an organisation’s surveillance project. That organisation decides why the data is collected; we process it on its behalf and for operating the platform.
Dharini is a product of ARTPARK. Use of Dharini is governed by ARTPARK’s Terms of Use.
2. Information we collect
We collect account details about users, contact details about site owners, precise location, surveillance and laboratory records, and technical data about how the apps are used.
2.1 Platform users
| Category | Details |
|---|---|
| Identity | First name, last name, designation or job title, profile picture |
| Contact | Mobile number, email address, postal address |
| Account and access | User ID, role, team, project, workspace, organisation, account status, date created and updated |
| Login | One-time passwords (OTPs) sent to your phone or email, their expiry time, failed attempt counts |
| Invitations | Who invited you, invitee name, phone, email, team, role, project, invite token and expiry date |
| Activity records | Which samples you collected, received, preprocessed, extracted, tested or reported on, and when; sites and projects you created or edited |
2.2 Site owners and sites
| Category | Details |
|---|---|
| Owner contact | Site owner’s name and phone number (optional) |
| Site details | Site name and code, site type and sub-type (for example poultry farm, broiler), number of workers |
| Address | Address, village, block, PIN code, region or district |
| Consent | Record of the owner’s consent to sample collection |
| Photos | Photos of the site taken during registration or visits |
| Schedule | Collection frequency, days, times, start and expiry dates, assigned collector |
2.3 Location
- Device location: precise GPS location from the mobile device when you register a site or complete a visit.
- Visit location: the coordinates where each visit was completed.
- Site and sample location: the coordinates of each site and sample, linked to a region or district.
2.4 Surveillance, animal and laboratory data
| Category | Details |
|---|---|
| Visits | Scheduled, started and completed times, round, status, collector, comments, photos |
| Questionnaires | Answers to disease and environmental questionnaires, suspected positive cases |
| Animal details | Tag or bird ID, species, breed, age, sex, vaccination stage, disease history, milk yield, fever, date symptoms were first noticed, vectors, drops in feed, water or egg intake |
| Samples | Barcode, accession ID, sample type, quantity, habitat, collection time, storage temperature and details, rejection reasons, photos, pooling and replicate links |
| Lab results | Disease tested, test result, Ct value, variant, viral load, kit or protocol, comments, result reports |
| Genomic sequencing | Sequence files and metadata (platform, library type, method, file format), NCBI accession, organism and title |
| Audit trail | A record of changes made to a sample during collection and laboratory processing, including previous and new values, who made the change and when |
2.5 Device and technical data
- Crash data: error reports, stack traces, app version, device model and operating system.
- Network data: IP address and browser or device type, received by our servers and service providers when you use Dharini.
3. How we collect information
Most information is typed in or captured by authorised users. The rest comes automatically from the apps and devices.
- From you: when you log in, complete your profile, accept an invitation, or enter a site, visit, sample and lab data.
- From other users: administrators who invite you, and field collectors who record site owner details and consent.
- From your device: location, camera and photos, only after you grant permission.
- Automatically: crash reports and network data.
- From public sources: weather, bird-sighting and map data for a site’s location.
Device permissions (mobile app)
| Permission | Why we ask | When it is used |
|---|---|---|
| Precise and approximate location | To record where a site is and where a visit was completed | When you register a site or complete a visit |
| Camera | To scan sample barcodes and QR codes, and take site, visit and sample photos | When you open the scanner or take a photo |
| Photos and files | To attach existing photos and export data files | When you choose a file |
| Vibration | To confirm a successful scan | During scanning |
You can turn off any permission in your device settings. Some features, such as site registration or barcode scanning, will not work without it.
4. How we use information
We use information to run disease surveillance projects and to operate, secure and improve Dharini. We do not sell personal data or use it for advertising.
- Accounts and login: verify your identity with OTPs, keep you signed in, and control what you can see based on your role, team, project and workspace.
- Invitations: send invite emails and messages to people asked to join a team or project.
- Field work: schedule visits, assign collectors, record sites, samples and questionnaire answers, and contact site owners about collection.
- Laboratory processing: track each sample through receiving, preprocessing, extraction, testing and reporting.
- Surveillance and analysis: produce maps, dashboards, statistics and reports on disease occurrence for project teams and public-health authorities.
- Environmental context: fetch weather and bird-sighting data near a site to support disease analysis.
- Genomic research: process sequence data and, where the project requires, submit it to public databases (see section 6).
- Accountability: keep an audit trail of who changed which sample record and when.
- Improvement and support: understand how features are used, find and fix errors, and measure performance.
- Security and legal compliance: prevent misuse (for example limiting OTP attempts), and meet legal obligations.
5. How information is stored and secured
For the Dharini service we host, your information is stored in Dharini’s own database and file storage on servers in AWS ap-south-1 (Mumbai, India). If your organisation runs Dharini on its own servers, your information is stored wherever your organisation chooses to host it. In both cases, a small amount of data is kept for a short time on your device so the apps work offline and you stay signed in.
5.1 Where information is stored
| Store | What it holds | How it is protected |
|---|---|---|
| Central database (PostgreSQL with PostGIS) | User accounts, invitations, sites, visits, questionnaires, animal details, samples, lab results, sequencing records, audit trail, location coordinates | Access only through the Dharini backend; role-based permissions; database credentials kept in server configuration |
| File storage (S3-compatible object storage) | Profile pictures, site, visit and sample photos, lab reports, batch documents, genomic sequence files | Files are private; viewing or downloading uses links that expire after 1 hour; upload links expire after 5 minutes |
| Temporary cache (Redis) | Failed OTP attempt counters, background job queues, application cache | Short-lived entries; not exposed to the internet |
| Mobile app, secure storage | Your login token | Stored in the device’s secure keystore (Android Keystore) |
| Mobile app, offline storage | Sites, visits and submissions recorded while offline, and a queue of changes waiting to sync | Kept on the device until synced to the server; removed when you log out or uninstall the app |
| Web browser, cookie | Your login token | HTTP-only cookie that expires about 8 days after you log in (the 7-day session plus a 1-day grace period) |
| Web browser, local storage | Selected workspace and project | Stays in your browser; cleared when you log out or clear browser data |
5.2 How we protect it
- No passwords. You log in with a one-time password sent to your phone or email. Each OTP expires after 3 minutes, and repeated wrong attempts are blocked.
- Signed sessions. After login you receive a signed access token. Sessions last 7 days on both web and mobile.
- Role-based access. What you can see and change depends on your role, team, project and workspace. Data from one workspace is not visible to users of another.
- Encryption in transit. Data travelling between the apps and our servers is sent over HTTPS (TLS).
- Audit trail. Changes to sample records during collection and laboratory processing are logged with the user and time.
- Limited staff access. Only authorised administrators can access the servers and database.
5.3 If personal data is breached
We keep an incident-response procedure for personal data breaches. If a breach affects personal data in Dharini:
- We contain the incident, find out what data and which people are affected, and record it in an internal breach register.
- We tell the organisation running your project without delay, and within 24 hours of confirming the breach, so it can meet its own duties.
- The organisation running the project informs each affected person and the Data Protection Board of India without delay, and sends the Board a detailed report within 72 hours, as the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 require.
- Cyber security incidents are also reported to CERT-In within the time it requires.
- Each notice describes what happened and when, what data is involved, the likely impact, the steps taken, and who to contact.
7. How long we keep information
We keep surveillance records for as long as the project needs them for public-health purposes, then delete them.
| Information | How long it is kept |
|---|---|
| OTPs | Valid for 3 minutes; replaced when a new code is requested |
| Failed login attempt counters | A few minutes |
| File viewing and upload links | 1 hour (viewing), 5 minutes (upload) |
| Login sessions | 7 days (web and mobile). The web login cookie is kept for about 8 days |
| Unaccepted invitations | Expires after 24 hours |
| User accounts | While the project is active |
| Sites, visits, samples, lab results and audit trail | Until the project is deleted from the platform. Deleting a project automatically deletes its sites, visits, samples and results |
| Offline data on your device | Until it is synced to the server, or the app is removed |
| Crash reports | 30 days |
When a record is removed in the app, it is usually marked inactive rather than erased, so the audit trail stays complete. Project administrators can permanently delete samples, visits, sites and whole projects, including their linked records and files.
8. Your rights and choices
Under India’s Digital Personal Data Protection Act, 2023 and other applicable laws, you can ask us to:
- Access a summary of the personal data we hold about you and who it has been shared with.
- Correct or update inaccurate or incomplete data. You can edit most profile details yourself on the profile page.
- Erase your personal data when it is no longer needed, unless we must keep it by law or for public-health records.
- Withdraw consent where we rely on it, for example for contact access or a site owner’s collection consent. Withdrawing does not affect processing that already took place.
- Nominate another person to exercise your rights if you die or become unable to.
- Raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.
You can also:
- turn off location or camera permissions in your device settings;
- log out to clear your login token and local data from the device.
To make a request, email dharini-support@artpark.in. We will reply within 5 days. Site owners may contact us directly, or through the field team that registered their site.
8.1 Grievance Officer
For any concern about how your personal data is handled, or if your request is not resolved, contact our Grievance Officer. We will acknowledge your complaint within 5 days and resolve it within 30 days of receiving it. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.
Name: Rukshat YaduvanshiDesignation: Grievance Officer, DhariniEmail: dharini-support@artpark.inAddress: ARTPARK, Ground Floor, Entrepreneurship Building / Innovation Centre Building (SID Building), Indian Institute of Science (IISc), Bengaluru, Karnataka – 560012, IndiaEach Dharini deployment is run by its own administrator, who handles privacy requests for that deployment. For the one present in ARTPARK you can reach out to us at the following:
Administrator / organisation: ARTPARKEmail: dharini-support@artpark.inAddress: Ground Floor, Entrepreneurship Building / Innovation Centre Building (SID Building), Indian Institute of Science (IISc), Bengaluru, Karnataka – 560012, India9. Children, changes and contact
Children
Dharini is a professional tool for surveillance staff. It is not meant for anyone under 18, and we do not knowingly collect children’s personal data.
Changes to this policy
We may update this policy when the platform or the law changes. We will change the “Last updated” date at the top and, for significant changes, notify users in the app or by email.
Privacy policies
- Information Technology Act, 2000 (India), together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), India’s comprehensive data-protection framework. Dharini operates as a Data Processor in respect of the limited personal data it processes.