Privacy policy

1. Overview & who we are

Researva is an online platform that connects MD/MS researchers with verified research professionals who help create medical thesis end-to-end — from research protocol and literature review to statistics and writing. This Privacy Policy applies to researva.com and all of its subdomains (including the web app, the admin panel and any professional tools), our mobile experiences, and any related services (collectively, the “Services”).

It explains how we handle personal data when you use the Services, whether you are a researcher, a research professional, or a visitor. References to “we”, “us”, “our” and “Researva” mean the entity that operates the Services and determines the purposes and means of processing (the “data fiduciary” under Indian law).

2. Information we collect

We collect the information you give us and the information we generate as you use the Services:

• Account & identity: name, email address, phone number, password (stored as a salted hash), your role (researcher, professional or admin) and email-verification status.
• Profile & professional details: for researchers, your institution, department and study details; for professionals, qualifications, areas of expertise, bio, verification documents and ratings.
• Thesis & project data: thesis topics, university guidelines, uploaded documents (protocols, synopses, chapters, datasets, images), messages in your exchange threads, document checklists, milestones and agreed deliverables.
• Communications: messages to support, contact-form submissions, and the email / SMS / one-time codes we send for verification and notifications.
• Payment & transaction data: billing details, the plan or order you choose and transaction references. We use third-party payment processors and do not store full card numbers on our servers.
• Technical & usage data: IP address, device and browser type, pages viewed, referring URLs, and cookies or similar technologies (see Section 5).

3. How we use your information

We use your information to:

• Provide, operate and maintain the Services.
• Create and manage your account and thesis workspace.
• Match researchers with suitable professionals and assign your mentor.
• Deliver thesis and professional services — store and transmit documents and facilitate your exchange thread.
• Process payments and track project milestones.
• Verify identity, and prevent fraud, abuse and unauthorised access, and enforce our terms.
• Communicate with you — service messages, one-time codes, updates and support.
• Improve and personalise the Services, analyse usage, and conduct research on aggregated or anonymised data.
• Comply with our legal and contractual obligations.

4. Legal basis & the DPDP Act 2023

We are committed to the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and process your data on the following bases:

• Your consent — freely given, specific and informed — for the purposes above, including sending non-essential communications, which you can withdraw at any time.
• Performing a contract with you — to provide the Services you request, process payments and fulfil our agreement.
• Compliance with law — where processing is required by applicable law.
• Legitimate interests — such as securing the platform and preventing fraud, balanced against your rights.

Sensitive personal data — such as government ID or verification documents, or health-related research data you choose to upload — is processed only with your specific, informed consent. You may withdraw consent at any time (Section 8); withdrawal does not affect processing already carried out.

5. Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how the Services are used, and keep the platform secure. Importantly, your session cookie is set as a host-only cookie scoped to the exact subdomain you are using (for example the web app or the admin panel are kept separate). Session cookies are not shared across subdomains, so signing in to one part of Researva does not sign you in to another, and your sessions stay isolated.

We do not use these session cookies for cross-site advertising or third-party tracking. You can control cookies through your browser settings; disabling strictly necessary cookies may affect your ability to use the Services.

6. How we share information

We share information only as described here:

• Professionals you engage: to deliver the service, we share what is needed (for example your thesis requirements and documents) with the professional(s) you hire and your assigned mentor.
• Service providers / processors: hosting, cloud storage, email / SMS / OTP delivery, payment processors, analytics and customer-support tooling — all under contractual confidentiality and data-protection obligations.
• Academic institutions / coordinators: only as needed to fulfil your engagement (for example where a university coordinator is involved).
• Legal & safety: to comply with law, enforce our terms, protect rights, safety and property, or in connection with a merger or acquisition (with notice to you).

We do not sell your personal data, and we do not use it to train external AI models without your consent.

7. Data retention

We keep personal data only as long as necessary for the purposes in this policy, to provide the Services, and to comply with legal, accounting or reporting requirements. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (for example transaction records) to comply with law. Uploaded thesis documents are removed from active storage but may persist in backups for a limited period before deletion.

8. Your rights

Under the DPDP Act you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• withdraw your consent at any time;
• request erasure of your personal data, subject to legal retention obligations;
• nominate a representative to exercise these rights on your behalf; and
• lodge a grievance with our Data Protection Officer and, if unsatisfied, with the Data Protection Board of India.

To exercise any of these rights, email us at support@researva.com or use the contact options in Section 12. We respond within the timeframes required by law (generally within 30 days) and verify your identity before acting on a request.

9. How we protect your data

We protect your data with technical and organisational measures appropriate to the risk: encryption in transit (HTTPS / TLS), hashed passwords, host-only session cookies, role-based access controls, least-privilege admin access, monitoring and regular review. No method of transmission or storage is 100% secure, but we work to protect your account — for example by recommending strong passwords and supporting one-time-code verification.

10. Children

The Services are intended for users who are at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the Services or by email. The “Last updated” date shows the latest revision, and your continued use after changes take effect constitutes acceptance of the updated policy.

12. Contact us

Questions, requests or a privacy grievance? Contact us:

• Email our team at support@researva.com
• Call or WhatsApp us at +91 72230 28521 (Mon–Sat, 10 AM–6 PM IST)
• Use our contact form at researva.com/contact

You can also reach our Data Protection Grievance Officer at the same email address above.