Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Synergy Wellness (“we”, “us”) collects, uses, stores and protects information through Synergy Feedback, our feedback and forms application available at https://synergy-feedback.vercel.app (the “Service”). It applies to patients and visitors who fill in our forms (“respondents”) and to our staff who manage forms (“administrators”).

1. Information we collect

From respondents

Your answers. The information you choose to enter in a form, such as your name, phone number, email address, the branch or treatment you received, ratings, comments, and any files or signature you provide. Some forms may ask about your health or treatment experience.
Submission details. A submission reference number (for example SW-20261006-000123) and the date and time of submission.
Technical information. To protect our forms from abuse we keep a one-way, salted hash of your IP address (we never store your actual IP address), your browser’s user-agent string and the page that linked to the form.

From administrators

Your name, email address, role and the branches you manage.
A record of administrative actions (for example creating, publishing or deleting forms) kept for security and accountability.
If you connect Google Sheets, the Google account information described in section 3.

Cookies

Public forms do not use advertising or analytics cookies. Administrators’ browsers store strictly necessary, secure cookies that keep them signed in. If CAPTCHA protection is enabled, Cloudflare Turnstile may process limited device information to tell people and bots apart.

2. How we use information

To receive, review and respond to your feedback and to improve our physiotherapy and wellness services.
To notify authorised staff that a new submission has arrived.
To keep a copy of submissions in a Google Sheet when a clinic has connected one to a form.
To produce internal statistics (for example the number of responses per branch).
To secure the Service, prevent spam and abuse, and meet our legal obligations.

We do not sell personal information and we do not use it for advertising.

3. Google user data

Administrators may connect a Google account so that each form’s submissions are copied to a Google Sheet. This section explains exactly what we access and why. Respondents never sign in with Google and never give us access to their Google account.

What we access

Basic profile (openid, email). Your Google account email address, used only to show which account is connected.
Google Sheets (spreadsheets). Used to create a new spreadsheet when you ask us to, to read the title and worksheet names of the spreadsheet you connect, to write the header row, to append a new row for each submission, and to read the “Submission ID” column of the connected sheet so that a retried sync never adds a duplicate row. We do not read or change any other content of your spreadsheets.
Google Drive file metadata (drive.metadata.readonly), if enabled. Used only to show you a searchable list of your spreadsheets (names, IDs and last-modified dates) so you can pick one to connect. We do not open, download, change or delete any Drive files.

How we store and protect it

The access and refresh tokens Google issues are encrypted with AES-256-GCM and stored on our servers. They are never sent to web browsers and are used only by our server to perform the actions above. The spreadsheet always remains owned by your Google account; we never delete spreadsheets, including when a form is disconnected.

How we use and share it

Synergy Feedback’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the Google Sheets integration you set up; we do not use it for advertising, we do not sell it, we do not use it to train artificial intelligence or machine learning models, and we do not transfer it to others except as needed to provide this feature, to comply with the law, or with your explicit consent. Our staff do not read Google user data unless you ask us to help with a problem, it is necessary for security, or the law requires it.

Revoking access and deletion

Disconnect a sheet at any time in the form’s Settings → Integrations. The spreadsheet and its data stay in your Google Drive.
A super administrator can remove a connected Google account under Integrations → Google Sheets. This revokes our access with Google and deletes the stored tokens.
You can also revoke access from your Google account at myaccount.google.com/permissions.

4. Who we share information with

We share information only with service providers that help us run the Service, under contracts that protect it:

Supabase — database, file storage and staff sign-in.
Vercel — hosting of the application.
Google — only when a clinic connects a Google Sheet to a form.
Resend — delivery of notification emails to staff (by default these emails do not include your answers).
Cloudflare — CAPTCHA protection, if enabled.

We may also disclose information if required by law or to protect the rights, safety and security of our patients, staff and services.

5. Security

Data is transmitted over HTTPS. Access to submissions is limited to authorised staff and enforced by database access rules. Uploaded files are stored privately and shown to staff only through short-lived links. Google tokens are encrypted. No method of transmission or storage is completely secure, but we work to protect your information.

6. How long we keep information

We keep submissions for as long as they are needed for the purposes in section 2 or as required by law. Authorised staff can archive or permanently delete submissions. When a submission is deleted from Synergy Feedback, any copy already written to a connected Google Sheet must be removed from that sheet separately.

7. Your rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may ask to access, correct or erase your personal information, withdraw consent, or raise a grievance. Please contact us at synergyhealthcareandwellness@gmail.com and include your submission reference number if you have it. We will respond within a reasonable time.

8. Children

Forms for patients under 18 should be completed by, or with the consent of, a parent or guardian.

9. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it last changed.

10. Contact us

Synergy Wellness
Email: synergyhealthcareandwellness@gmail.com
Website: https://www.synergyphysio.in/