PrivacyWhat happens to
personal data.

This website

This website is built to collect nothing.

It sets no cookies. It runs no analytics, no tag manager, and no advertising or tracking technology of any kind. It makes no third-party requests — fonts, styles and scripts are served from our own domain, so visiting a page does not disclose your visit to anyone else. There are no forms, no accounts and no embedded media.

Our hosting provider records standard server logs, which may include your IP address, the page requested, the time of the request and your browser’s user-agent string. Those logs exist for availability and security, are not used to build a profile of anyone, and are retained for [LOG RETENTION] before deletion.

If you browse with JavaScript disabled, the only consequence is that our email address appears as text for you to type rather than as a link.

If you write to us

The address on this site is an ordinary mailbox. If you write to us, we hold what you send — your name and email address, the content of your message, any attachment — and our replies.

We use it to answer you, to carry on the conversation if it becomes one, and to keep a record of what was discussed or agreed. We do not add you to a mailing list. We do not use your correspondence to train any model.

We keep correspondence while the matter it concerns is live, and for [CORRESPONDENCE RETENTION] afterwards where a record is needed for legal or contractual reasons. You can ask us to delete it sooner.

Client data in the systems we deploy

Our systems run inside the client institution’s own environment. For the personal data held in them — banking records, clinical records, claims records — the institution is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023, or the controller under the GDPR, and Gronomix acts as a Data Processor on that institution’s documented instructions, under a written agreement.

In that role:

• Processing happens inside the client’s deployment boundary. Our systems are read-only against the client’s systems of record and are isolated per tenant, with no pooling of data between clients.
• We do not use client data to train, fine-tune or evaluate any model — not for that client, and not for any other.
• Identifiable clinical data is not sent to an external inference service. There is no fallback path that would do so.
• Where our personnel need access for support, it is granted on request, limited in scope and duration, logged, and governed by the agreement with the institution.
• We do not decide the purposes for which client data is processed, and we do not use it for our own purposes.

If you are an individual whose personal data may sit in a client’s system — a borrower, a member, a patient — the institution holds the relationship, the records and the obligation to answer you, and your request should go to it. We support our clients in responding. If you write to us and we can identify who to direct you to, we will tell you.

Our data processing agreement, sub-processor list and security documentation are available to client institutions and prospective clients on request.

Legal bases

For the server logs and correspondence described above, we rely on our legitimate interests in operating a secure website and in responding to people who contact us. Under the Digital Personal Data Protection Act, 2023, we also rely on the legitimate uses that permit processing personal data you have voluntarily provided for the purpose for which you provided it. Where we rely on your consent, you may withdraw it at any time.

Sharing

We do not sell personal data, and we do not share it for advertising or profiling.

We disclose it only to our hosting and email providers, acting as processors under contract and solely to provide those services; to professional advisers bound by confidentiality, where needed; and to a public authority where we are legally required to disclose. There are no other recipients.

International transfers

Gronomix is established in India. Our hosting and email providers may process data outside India, including in [HOSTING REGIONS]. Where personal data protected by the GDPR is transferred outside the European Economic Area, the transfer is made under the European Commission’s standard contractual clauses.

Security

The website keeps its own attack surface small by design: it stores nothing, runs no third-party code and has no administrative interface exposed to the public internet. For everything else, access to our systems is restricted to named individuals and reviewed; devices and credentials are managed; and correspondence is held in accounts protected by multi-factor authentication. Where we hold a certification we will name it here; we do not claim one we are still pursuing.

Your rights

Depending on where you are and which law applies, you may ask us to confirm what personal data of yours we hold and to give you a copy; to correct or complete it; to erase it; to restrict or object to how we use it; or to provide it in a portable form. Under the Digital Personal Data Protection Act, 2023, you may also nominate another person to exercise your rights in the event of your death or incapacity.

Write to post@gronomix.com. We will respond within 30 days.

Grievance Officer

Under the Digital Personal Data Protection Act, 2023, you may raise a grievance with:

If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you may complain to your local data protection authority. In India, you may approach the Data Protection Board of India.

Children

This website is not directed at children, and we do not knowingly collect personal data from anyone under 18.

Changes

If this notice changes materially, we will post the revised version here with a new effective date, and where we hold your contact details and the change affects you, we will tell you directly.