Eat Healthy lets you order food from your phone, pay online, and have it delivered to a patient's bedside inside Apex Super Speciality Hospital, Varanasi. There are no customer accounts or logins — every order is a fresh submission of a few details, kept only as long as this policy says.

The canteen is run by a third-party contractor at the hospital. That contractor is the data fiduciary for the information described below — not the hospital itself. Your payment is collected by Apex Welcare Private Limited, which passes it on to the contractor's account.

Orders may only be placed by adults: patients or their attendants.

What we collect

When you check out, we collect:

• •Your name and 10-digit mobile number.
• •Bed number (you may leave this blank; it is optional free text).
• •An optional dietary note, up to 280 characters.
• •The items you ordered and the amount charged.
• •An order code and timestamps.

Card, UPI and bank details are entered on Razorpay's own checkout screen. They never reach the canteen and are never stored by us — we only store Razorpay's order and payment reference IDs.

To stop abuse of order lookups and checkout, we briefly keep the IP address of a request and, for order lookups, a one-way hash of the phone number (not the phone number itself — the hash cannot be turned back into a number). These records are temporary: the check for a given number or address only looks a few minutes back, and old records are cleared automatically, usually within about two days.

What we don't collect

• •No customer accounts or passwords.
• •Your cart is kept only in your own browser's local storage until you check out; your language choice is not stored anywhere.
• •No analytics, advertising or tracking cookies, and no third-party trackers.
• •Fonts are self-hosted — no font requests leave the canteen's own servers.
• •A session cookie is used only to sign kitchen and admin staff into their own staff pages — never on the pages you use to order or track food.

Who sees your information

• •Canteen kitchen and delivery staff see your name, phone, bed, dietary note and items, so they can prepare and deliver your order.
• •The operator (the contractor running the canteen) sees order records.
• •Razorpay processes your payment, Supabase hosts our database, and Vercel hosts this website — each only for that purpose.

Your information is never sold, and never used for marketing. We do not send promotional SMS or WhatsApp messages.

Order links are not private conversations

The order status link (/o/…) shows status, items, amount and bed — but not your name or phone number. Anyone who has the link can see that much, so please don't share it. The /track page finds your orders by phone number instead, and is rate-limited to stop it being misused to guess at other people's numbers.

How long we keep it

Personal details — name, phone number, bed and dietary note — are deleted within 60 days of the order. A record of the order without those details (items, amount, date and payment reference) may be kept longer, for accounts and tax purposes. Razorpay separately keeps its own payment records under its own legal obligations.

Your rights

Under the Digital Personal Data Protection Act, 2023 and the IT Rules, 2011, you can ask for a summary of your data, ask us to correct it, or ask us to erase it (subject to the legal retention above). You may also nominate someone to exercise these rights on your behalf. If you withdraw consent, an order already in progress cannot be processed further.

Grievance officer: ANIL · [EMAIL_ADDRESS] · 9598123400. Grievances are acknowledged and resolved within 30 days. If yours remains unresolved, you may approach the Data Protection Board of India.

Operator / data fiduciary

Eat Healthy Kitchen Services · B.L.W. Hydle Road, Varanasi, Uttar Pradesh 221004 · [EMAIL_ADDRESS]

Changes to this policy

We may update this policy from time to time. The date at the top of this page always shows when it was last changed.