1. Information Technology Act 2000
SleepScorePro operates in compliance with the Information Technology Act 2000 (IT Act) and the Information Technology (Amendment) Act 2008. We are committed to following the rules and obligations applicable to intermediaries and body corporates under Indian law.
Specifically, we comply with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules), including the maintenance of a comprehensive information security programme and the appointment of a Grievance Officer.
2. Sensitive Personal Data Under IT Rules 2011
Under Rule 3 of the SPDI Rules 2011, health-related data is classified as Sensitive Personal Data or Information (SPDI). SleepScorePro takes the following position regarding sleep data:
Our data handling approach
- Sleep calculator data (bedtime, wake time, sleep latency, WASO) is processed entirely within your browser using client-side JavaScript. This data is stored in your browser's localStorage only and is never transmitted to or stored on our servers.
- Only data you voluntarily provide via our contact form or newsletter subscription (name, email address) is stored on our servers. No health data is stored server-side.
- Sleep scores shared optionally during newsletter signup are stored solely for the purpose of personalising educational content and are never used for commercial profiling.
3. Digital Personal Data Protection Act 2023 (DPDP Act)
The Digital Personal Data Protection Act 2023 (DPDP Act) is India's primary data protection legislation, enacted on 11 August 2023. SleepScorePro is committed to full compliance as the rules and regulations under the DPDP Act are progressively notified by the Indian Government.
Our current compliance measures under the DPDP Act include:
We collect only the minimum data necessary for the stated purpose (data minimisation)
We obtain explicit consent before collecting personal data from users
We provide clear and accessible notice about all data processing purposes
We have a designated Grievance Officer available to all users
We implement reasonable security practices to protect personal data
We do not process personal data of children (under 18) without verifiable parental consent
We respond to data principal requests within the timelines prescribed by law
We do not transfer personal data outside India without appropriate safeguards
4. Grievance Officer
As mandated by Rule 5(9) of the Information Technology (Intermediaries Guidelines) Rules and the IT Act 2000, SleepScorePro has designated a Grievance Officer to address complaints and concerns from users.
Grievance Officer — Harsh
See our full Grievance Officer page for the complete complaints procedure.
5. Data Localisation and International Transfers
SleepScorePro uses international service providers to operate our platform, including:
- Google Analytics 4 — analytics (only with your consent; data may be processed in the US)
- Vercel — website hosting and edge network (global infrastructure)
- Email service providers — for newsletter delivery (when applicable)
Personal data transferred outside India is subject to appropriate safeguards in accordance with applicable law and the terms agreed with our service providers. We will update this section as the DPDP Act's data localisation and cross-border transfer rules are notified.
6. Your Rights as a Data Principal Under the DPDP Act 2023
Under the Digital Personal Data Protection Act 2023, you (as a Data Principal) have the following rights with respect to your personal data:
Right to Access
Request a summary of personal data we process about you and the processing activities.
Right to Correction
Request correction of inaccurate or incomplete personal data we hold.
Right to Erasure
Request deletion of your personal data when the purpose of collection is fulfilled or consent is withdrawn.
Right to Grievance Redressal
File a complaint with our Grievance Officer and expect resolution within 30 days.
Right to Nominate
Nominate a trusted person to exercise your rights in the event of your death or incapacity.
To exercise any of these rights, email contact[at]sleepscorepro.com with the subject: DPDP Rights Request. We will respond within 30 days.
7. Compliance Timeline
The DPDP Act 2023 was enacted on 11 August 2023. Many of its operative provisions and rules are subject to notification by the Central Government. SleepScorePro will progressively implement full compliance as the rules are notified, including:
- Registering as a Significant Data Fiduciary (if applicable under the notified criteria)
- Appointing a Data Protection Officer (if required)
- Completing Data Protection Impact Assessments for high-risk processing activities
This page will be updated as new obligations come into effect.
8. Contact
For IT Act or DPDP Act related enquiries, contact our Grievance Officer at contact[at]sleepscorepro.com.
See also: Grievance Officer · Privacy Policy · GDPR Policy