Privacy Policy — scan2help

scan2help is built for child safety. We collect only the data required to operate the platform, share it only with the people who need it, and never sell or monetise it. This policy covers two scan2help products: the school safety app (QR scanning for school staff and parents, Sections 1–12) and the vehicle tracking app for school transport drivers (Sections 13–20).

1. Who We Are

scan2help is a product of Vidhilekha Lab LLP, a limited liability partnership registered in Lucknow, Uttar Pradesh, India. For any privacy-related queries, contact us at info@vidhilekhalab.com.

2. Data We Collect

We collect the minimum data necessary to run the platform. The table below describes each category, who provides it, and why we need it.

Category	Data points	Provided by	Purpose
Student profile	Name, photo, blood group, class, school, roll number	School admin	Identify the child in emergency and routine scan events
Parent & emergency contacts	WhatsApp-registered phone number, up to 3 emergency contact numbers	Parent / school admin	Send journey notifications and emergency SOS alerts via WhatsApp
Scan events	Timestamp, event type (arrival / departure / emergency), approximate location of the scan	Automatically on each QR scan	Build journey timeline, trigger alerts, maintain attendance records
School staff profiles	Name, role (owner / sub-admin / teacher), phone number used for login	School owner admin	Authenticate staff, attribute scan events to the correct staff member
Device & usage data	Device type, operating system, app version, in-app actions	Automatically via the app	Diagnose bugs, improve performance, detect misuse
Camera access	The app activates your device camera to read QR codes. No images or video are captured, stored, or transmitted.	Device hardware — activated on demand while scanning	Read QR codes on scan2help physical tags to record arrival, departure, and emergency events

We do not collect precise GPS coordinates of the child. The scan location is derived from the approximate location of the device used to scan the QR tag — this is only accessible to verified school admins.

The scan2help app requests the Camera permission (android.permission.CAMERA) exclusively to scan QR codes printed on student safety tags. The camera viewfinder is active only while a staff member is actively scanning a tag. No photographs or video frames are saved to the device or uploaded to our servers.

3. Children's Data

scan2help handles data about minors. We treat this with the highest level of care.

Student data is entered by the school, which acts as the data processor on behalf of the parent and institution.
Schools must obtain parental consent before enrolling a student on the platform. By using scan2help, schools confirm this consent has been obtained.
The public-facing QR scan page intentionally shows no personally identifying information — only blood group and a masked alert button — to protect the child's identity from casual scanners.
Full student details are only accessible to the verified registered parent and authorised school admins.

4. How We Use Your Data

Send WhatsApp journey notifications (arrival, departure, home) to registered parents.
Send emergency SOS alerts when a bystander triggers the Alert Parents button.
Generate attendance records and journey timelines for school admins.
Authenticate parents and school staff via phone-based OTP login.
Improve the platform based on anonymised usage patterns.
Respond to support requests or legal obligations.

We do not use your data for advertising, profiling, or sale to third parties.

5. The Three-Tier Privacy Model

Access to student data is governed by three access tiers:

Tier 1 — Anyone (no login): Blood group and the Alert Parents button only. No name, no photo, no school, no contact numbers.
Tier 2 — Registered parent: Full profile of their own child, complete scan history, and journey timeline. No access to other students.
Tier 3 — School admin: Full operational access to all students enrolled in their school, including scan logs, approximate scan location, and attendance records.

6. WhatsApp Communications

Notifications are sent via WhatsApp using the Business API. By registering your WhatsApp number on the platform, you consent to receiving safety notifications from scan2help. Every message is clearly identified as a safety notification. You may contact us to opt out at any time, though opting out will disable journey alerts for your child.

7. Data Sharing

We share data only in the following circumstances:

Within the platform: As described in the three-tier model above.
WhatsApp / Meta: Phone numbers and message content are transmitted to WhatsApp Business API providers to deliver notifications.
Service providers: Hosting, storage, and infrastructure providers who are bound by confidentiality obligations and do not have independent access to your data.
Legal obligations: If required by Indian law, court order, or government authority.

We do not sell, rent, or trade personal data to any third party.

8. Data Retention

Student profiles and scan history are retained for the duration of the school's active subscription, plus 12 months after termination.
After the retention period, data is permanently deleted or irreversibly anonymised.
Parents or school admins may request earlier deletion by contacting us.

9. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS/TLS), OTP-based authentication, role-based access controls, and regular security reviews. No system is entirely without risk; we will notify affected users promptly in the event of a breach that affects their personal data.

10. Your Rights

Under applicable Indian law, you have the right to:

Access the personal data we hold about you or your child.
Correct inaccurate or incomplete data.
Request deletion of your data (subject to legal retention obligations).
Withdraw consent for WhatsApp notifications.
Raise a grievance with us regarding how your data is handled.

To exercise any of these rights, email us at info@vidhilekhalab.com. We will respond within 30 days.

11. Cookies and Tracking

The scan2help marketing website uses no tracking cookies or third-party analytics. The app may use session tokens stored locally on your device for authentication purposes only.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to registered users via WhatsApp or in-app notification. The effective date at the top of this page will always reflect the latest version.

Part B · Vehicle App

scan2help Vehicle — Driver App

The following sections apply specifically to the scan2help Vehicle Android app used by school transport drivers (package: com.vidhilekhalab.scan2help.vehicle). This is a separate app from the school staff app described in Sections 1–12 above.

13. What the Vehicle App Does

The scan2help Vehicle app is used by school bus and van drivers to manage live trips, track student boarding and alighting, and stream real-time vehicle location to parents. When a trip is active, parents of enrolled students can see the bus's live position, speed, and whether their child has boarded — helping them plan pickups and receive automatic arrival alerts via WhatsApp.

14. Data Collected by the Vehicle App

Category	Data points	Collected by	Purpose
Driver identity	Mobile phone number, full name	Driver at OTP login	Authenticate the driver; attribute trip events to the correct driver account
Vehicle & route info	Vehicle ID and name, route ID and name, trip type (morning / afternoon), school name and emergency contact numbers	Fetched from scan2help servers after login	Populate the driver dashboard and route checklist
Precise GPS location	Latitude, longitude, speed (m/s), timestamp — captured every 8 seconds during an active trip	Device GPS sensor (automatic during trip)	Stream live vehicle position to Firebase for parent tracking; send periodic updates to the scan2help server
Trip events	Trip start time, trip end time, student boarding events (student ID + timestamp), student dropping events (student ID + timestamp)	Automatically on each trip action	Build journey timeline; trigger parent WhatsApp notifications on boarding and arrival; maintain attendance records for the school
Student data (read-only)	Student name, grade, section, photo (URL, cached locally), pickup / dropoff GPS coordinates	Fetched from scan2help servers for the assigned route only	Display the student checklist; calculate proximity to student pickup / dropoff locations

The vehicle app does not access the device camera, microphone, contacts, call log, or any file storage beyond its own application data.

15. Location Tracking and Background Access

Real-time location tracking is the core function of the vehicle app. Here is exactly how it works:

Frequency: GPS coordinates are captured every 8 seconds while a trip is active.
Background operation: The app runs a persistent foreground service that continues GPS tracking even when the screen is off, the app is minimised, or the driver switches to another app. A visible notification is always shown to the driver when tracking is active.
After device reboot: The background service restarts automatically if the device is rebooted during an active trip (RECEIVE_BOOT_COMPLETED permission).
Where location data goes: Each GPS update is sent over HTTPS to the scan2help server and simultaneously written to Firebase Realtime Database, where parents of students on the route can read it in real time.
Proximity notifications: When the vehicle is approximately 200 metres (by road) from a student's pickup or dropoff point, the app triggers a WhatsApp alert to that student's registered parents. Road distance is verified using the Google Distance Matrix API before the notification is sent.
Trip end: GPS polling stops immediately when the driver ends the trip. No location data is collected outside of active trips.

16. Android Permissions — Vehicle App

The vehicle app requests the following permissions. All are required for core trip-tracking functionality.

Permission	Why it is needed
`ACCESS_FINE_LOCATION`	Precise GPS coordinates (within ~5 m) for real-time vehicle tracking
`ACCESS_COARSE_LOCATION`	Fallback location via cell towers / Wi-Fi if GPS signal is unavailable
`ACCESS_BACKGROUND_LOCATION`	Continue GPS tracking when the app is backgrounded or the screen is off
`FOREGROUND_SERVICE` + `FOREGROUND_SERVICE_LOCATION`	Required by Android to run a location-enabled foreground service that persists in the background
`WAKE_LOCK`	Keep the CPU active during GPS polling so location updates are not missed when the screen turns off
`RECEIVE_BOOT_COMPLETED`	Restart the GPS tracking service automatically if the device reboots mid-trip
`INTERNET`	Communicate with the scan2help API and Firebase Realtime Database

17. Third-Party Services — Vehicle App

Google Firebase (Realtime Database & Authentication): Real-time vehicle location and student boarding status are written to Firebase Realtime Database. Anonymous Firebase authentication is used to generate short-lived tokens granting parents read-only access to their child's trip data only. Firebase is operated by Google; data is processed under Google's Privacy Policy.
Google Maps (Static API, Navigation SDK, Distance Matrix API): Used to display live maps and turn-by-turn navigation within the driver app, and to calculate road distance for arrival proximity checks. Location data is transmitted to Google's servers for these calculations.
MSG91 (OTP delivery): The driver's phone number is shared with MSG91 solely to deliver the one-time password at login. MSG91 is an Indian SMS API provider. No other driver data is shared with MSG91.

18. Student Data Shown to Drivers

Drivers can see a limited, route-scoped set of student data for students on their assigned route only:

Student name, grade, section, and profile photo — displayed on the boarding checklist.
Student pickup and dropoff GPS coordinates — used locally on the device for proximity calculations. These coordinates are not transmitted back to any server by the driver app.
Student photos are downloaded from the scan2help server and cached on the device's local storage for offline display. The cache is cleared when the app is uninstalled.

Drivers cannot view student data outside their assigned route. Access is restricted by the school admin and the driver's verified login credentials.

19. Data Sharing — Vehicle App

Parents of enrolled students: Real-time vehicle location (lat/lng, speed) and their child's boarding / dropping status are accessible via Firebase Realtime Database while a trip is active. Each parent sees only their own child's status.
School admins: Trip logs, boarding events, and route summaries are accessible to the school's authorised admin users.
Google: Location data is processed by Google Maps APIs and Firebase as described in Section 17.
MSG91: Driver phone number used solely for OTP login.

We do not share vehicle location data, driver data, or student data with any advertising network, data broker, or unrelated third party.

20. Trip Data Retention — Vehicle App

Real-time GPS data in Firebase Realtime Database is retained for the duration of the active school year and purged at the end of the academic year, or earlier at the school admin's request.
Trip logs and boarding event records on the scan2help server are retained for the duration of the school's active subscription plus 12 months, consistent with Section 8 above.
JWT tokens stored on the driver's device are invalidated on logout and are removed when the app is uninstalled.
Student photo cache is stored on the driver's device and is automatically cleared when the app is uninstalled.

Questions or concerns?

Reach our team at info@vidhilekhalab.com

Vidhilekha Lab LLP · Lucknow, Uttar Pradesh, India