Privacy Policy

Zocto is a healthcare newsroom published at zocto.in. For the purposes of the EU/UK General Data Protection Regulation we act as the data controller; under India's Digital Personal Data Protection Act, 2023 (DPDP) we act as the Data Fiduciary. You can reach our privacy contact and Grievance Officer at info@zocto.in.

Reading the site. If — and only if — you accept analytics, we record the page you viewed, page title, time on page, scroll depth, referring site, campaign (UTM) parameters, a random browser-generated visitor and session identifier, approximate location, device type, browser, OS, screen size, language and time zone.

IP addresses are masked before storage. The final octet of an IPv4 address is zeroed (e.g. 203.0.113.0) and IPv6 addresses are truncated to the /48 prefix. We never write a full IP address to our database, and the masked value cannot be reversed to identify a household or individual device.

Newsletter. Your email address, the date you subscribed and your subscription status.

Editorial accounts. For staff and contributors: email, display name and role.

We do not collect health data about you, and we do not run advertising or cross-site tracking.

• Analytics — to understand which stories are read and improve the newsroom. Legal basis: your consent (GDPR Art. 6(1)(a); DPDP s.6). No analytics is recorded before you accept.
• Newsletter — to send the daily digest you asked for. Legal basis: consent, withdrawable from the unsubscribe link in every email.
• Running and securing the site — strictly necessary logs and session cookies. Legal basis: legitimate interests (GDPR Art. 6(1)(f)); under DPDP, a legitimate use for providing the service.

Under GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. Under the DPDP Act you have the right to access a summary of your personal data, to correction and erasure, to nominate another person to exercise your rights, and to grievance redressal.

For analytics data you can act instantly and without contacting us — use Privacy choices to withdraw consent and permanently delete everything tied to your browser.

For anything else, email info@zocto.in. We respond within 30 days. If you are unhappy with our response you may complain to your local supervisory authority, or in India to the Data Protection Board.

• Masked analytics records: retained for up to 26 months, then deleted.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record so we don't re-add you.
• Editorial accounts: for as long as the account is active.

We use a small set of processors: our managed database and hosting provider (application data and analytics), Cloudflare (content delivery and edge security), and Brevo (newsletter delivery). Each acts only on our instructions under a data-processing agreement. Some are located outside India and the EEA; transfers rely on standard contractual clauses or equivalent safeguards.

Zocto is written for healthcare professionals and general adult readers. We do not knowingly process the personal data of children as defined under the DPDP Act, and we do not carry out behavioural tracking or targeted advertising directed at children.

Data sits behind authentication and row-level security policies; analytics tables are readable only by staff accounts. Editorial tooling requires sign-in and role-based access. If you believe you have found a vulnerability, email info@zocto.in. This page describes our practices; it is not an independent certification or audit.

We update this policy when our practices change and revise the date at the top. Material changes are announced on the site.