Sweet Buddy — Privacy Policy
Last updated: 2 August 2026
Sweet Buddy is a care-management application for children living with Type 1 Diabetes, operated by Art For Cause Foundation (“AFC”, “we”, “us”) for its diabetes-care programme in India. AFC is the Data Fiduciary responsible for the personal data described here, under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules.
This policy explains what information we collect, why, who we share it with, how long we keep it, how we protect it, and the rights you have. Because Sweet Buddy is used to care for children, it is built around the consent of the child’s parent or legal guardian.
1. Who this policy is for
Sweet Buddy is used by AFC’s care team (doctors, diabetes educators, coordinators) and by the parents/legal guardians of enrolled children. The child is the individual whose data is primarily processed (the Data Principal); the parent or guardian provides and manages consent on the child’s behalf.
2. Information we collect
We collect only what is needed to run the programme and care for the child:
- Identity & contact details: the child’s name, date of birth, sex, class/school, and enrolment site/city; and the guardian’s name, relationship to the child, mobile number, and occupation. Sweet Buddy does not use email addresses anywhere.
- Health & clinical information: blood-glucose readings, HbA1c results, insulin regimens and doses given, prescriptions and insulin/consumable products, injection-site checks, clinical events, risk assessments and flags, clinical review notes, care recommendations, and eligibility assessments.
- Documents & media: consent forms and other enrolment/legal documents, photographs, and reports or files uploaded as part of care.
- Communications: messages exchanged between guardians and the care team.
- Programme & engagement: enrolment status, referrals, camp attendance and invitations, supplies dispensed to the child, and in-app rewards/progress used to encourage daily self-care.
- Account & technical data: mobile number, device identifiers, sign-in and session records, security audit logs, and limited network information (such as an IP address) used only to operate and protect the service. We do not use advertising identifiers.
3. How we use this information
We use personal data to:
- provide diabetes care and follow-up for the child;
- provide medicines, devices, test supplies and other support;
- enable medical consultations, education and counselling;
- monitor and improve the quality of the programme;
- carry out clinical audits, research, publications and impact assessment — using de-identified or aggregated data wherever possible; and
- operate, secure and support the app (sign-in, and preventing misuse or fraud).
Sweet Buddy is a record-keeping and support tool. It does not diagnose, and it never calculates or recommends an insulin dose — clinical decisions are made by the child’s doctor and care team. We do not use personal data for advertising, and we do not sell it.
4. Our legal basis: your consent
We process personal data on the basis of the consent given by the child’s parent or legal guardian, obtained through the in-app consent notice and the signed Consent & No Objection Declaration at enrolment. You may withdraw your consent at any time (see “Your rights” below). Withdrawing consent does not affect processing already carried out, but it may affect our ability to continue providing certain services through the app. We may also process data where the law requires or permits it.
5. Children’s data
Sweet Buddy exists to care for children, so we take particular care with their data as the DPDP Act requires. We process a child’s personal data only with the verifiable consent of a parent or legal guardian, only for the child’s care and the purposes above. We do not carry out behavioural tracking or targeted advertising directed at children, and we do not undertake processing that is likely to cause a detrimental effect on a child’s well-being.
6. Who we share information with
We share personal data only where it is needed, and only on a need-to-know basis:
- Authorised healthcare providers — the treating doctors and educators, and partner hospitals and laboratories involved in the child’s care.
- Researchers, funding agencies and government authorities — where necessary for treatment, programme implementation, legal compliance, or approved research. Materials prepared by AFC (reports, publications, presentations) will not intentionally reveal a child’s identity without additional permission, unless required by law.
- Technology service providers (Data Processors) — providers who host our systems and deliver messages (for example, secure cloud/database hosting and SMS delivery). They act only on our instructions, under contract, and may not use the data for their own purposes.
We do not sell personal data or share it with advertisers.
7. How we protect your data
We apply technical and organisational safeguards appropriate to the sensitivity of health data, including: encryption of data in transit and at rest; strict role-based access so staff see only what their role and site allow; database-level access controls; an immutable audit trail of access to clinical and personal records; and an architecture in which the client apps never connect to the database directly. No system can be guaranteed perfectly secure, but we work to protect your information and to detect and respond to incidents.
8. How long we keep it
We keep personal data for as long as needed to provide care and run the programme, and to meet clinical, audit and legal obligations. When it is no longer needed for these purposes, or when you withdraw consent and we are not otherwise required to keep it, we delete it or de-identify it.
9. Your rights
As the parent/legal guardian (on the child’s behalf), under the DPDP Act you may:
- obtain a summary of the personal data we process and how;
- have inaccurate or incomplete data corrected, completed or updated;
- request erasure of personal data that is no longer required;
- withdraw your consent at any time;
- nominate another individual to exercise these rights if you are unable to; and
- have a grievance addressed by us, and escalate to the Data Protection Board of India.
To exercise any of these, contact us through the Sweet Buddy app (care-team messaging) or contact the Grievance Officer below. We will respond within the timelines the law requires.
10. Grievance Officer & contact
If you have questions or a complaint about how your data is handled, please contact our Grievance Officer:
- Data Fiduciary: Art For Cause Foundation (AFC)
- Grievance Officer: [Grievance Officer name]
- Contact: [Grievance Officer phone number]
- Registered address: [AFC registered postal address, India]
If your grievance is not resolved satisfactorily, you have the right to complain to the Data Protection Board of India.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will show you the updated notice in the app and ask you to read and accept it before you continue. The date at the top shows when this policy was last updated.