Privacy Policy

Version 1.1 · Effective 15 August 2026 · Last updated 15 August 2026

1. Introduction

Welcome to Simply Blood.
This Privacy Policy explains how Change With One Foundation ("Simply Blood", "we", "our", or "us") collects, uses, stores, shares, protects, and otherwise processes your Personal Information when you use the Simply Blood Platform.
The Platform includes:

Mobile Applications
Website
Progressive Web Application (PWA)
Community Features
AI-powered Services
Partner Services
Communication Services
Future Simply Blood Services

This Privacy Policy applies to all users regardless of their country of residence unless a separate jurisdiction-specific privacy notice expressly applies.
By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Our Privacy Principles

Privacy is fundamental to Simply Blood.
Our Platform is built around the following principles:

Privacy by Design
Data Minimization
Purpose Limitation
Transparency
User Control
Security by Default
Accountability
Compliance with Applicable Laws

We only collect information reasonably necessary to provide and improve our Services.

3. Who We Are

The Simply Blood Platform is owned and operated by:

Change With One Foundation
General Support
support@simplyblood.com
Legal Contact
legal@simplyblood.com
Privacy Contact
Grievance Officer to be formally designated prior to public launch. Interim contact: legal@simplyblood.com

4. Scope of this Policy

This Privacy Policy applies whenever you:

create an account
browse the Platform
submit a blood request
register as a donor
upload documents
communicate through the Platform
participate in events
use AI-powered features
interact with community content
visit our website.

This Privacy Policy does not apply to third-party services that maintain their own independent privacy policies.

5. Information We Collect

Depending on how you use the Platform, we may collect the following categories of information.

Identity Information

Examples include:

Full name
Profile photograph
Date of birth
Gender (where applicable)
User role
Contact Information

Examples include:

Mobile number
Email address
Blood Donation Information

Examples include:

Blood group
Donation history
Donation frequency
Donation eligibility declarations
Blood request participation
Health-Related Information

Where you voluntarily provide it or where required to deliver a specific Service, we may process information such as:

health reports uploaded by you
self-declared medical conditions relevant to blood donation
donation certificates
eligibility declarations.
Simply Blood does not provide medical diagnosis or treatment.
Identity Verification Information

Where verification is required, we may process:

identity verification documents
organization registration documents
blood bank or hospital verification documents
supporting evidence.
Location Information

We may process:

current city
district
approximate location
hospital location
event location
GPS coordinates where required for Platform functionality.
We do not continuously track your precise location.
Communication Information

Including:

messages
support requests
feedback
reports
appeals.
Community Information

Including:

stories
comments
ratings
reviews
uploaded media
reactions.
Technical Information

Examples include:

device model
operating system
browser information
IP address
device identifiers
crash logs
application version.
Usage Information

Examples include:

login activity
feature usage
notification interactions
navigation events
referral activity
content interactions.
AI Processing Information

Where AI-powered features are used, we may process:

uploaded documents
uploaded images
text submissions
certificate information
stories
translations
health report summaries.

AI processing is limited to providing the requested functionality and improving Platform safety and reliability.

6. Information We Do Not Intentionally Collect

Simply Blood does not intentionally collect:

payment card information (unless future payment services are introduced)
passwords for third-party services
unrelated medical records
unrelated biometric information
unnecessary government-issued identity information
information unrelated to Platform Services.

If such information is inadvertently submitted, we may remove or securely delete it where appropriate.

7. How We Collect Information

We collect information:

Directly from you

For example:

account registration
profile completion
blood requests
uploaded documents
messages
support requests.
Automatically

For example:

device information
analytics
cookies
application logs.
From Authorized Third Parties

Examples include:

identity verification providers
hospitals
blood banks
partner organizations
analytics providers
communication providers.
We collect only information necessary for authorized Platform purposes.

8. Why We Process Your Information

We process information to:

provide Platform Services
match blood donors and seekers
verify users and organizations
improve Platform safety
prevent fraud
communicate with users
provide customer support
improve Simply Blood's own AI systems and safety features (this does not include allowing third-party AI providers to train their general-purpose models on your data)
generate analytics
comply with legal obligations
protect users
improve accessibility
personalize user experience
recognize donor achievements.

We do not sell your Personal Information, as that term is defined under applicable privacy laws (including the CCPA/CPRA).

9. Legal Bases for Processing

Where required under applicable law, we process information based on one or more of the following:

your consent
performance of our agreement with you
compliance with legal obligations
protection of vital interests
legitimate interests, provided such interests are balanced against your rights.

Where consent is required, you may withdraw it at any time, subject to legal or operational limitations.

9A. Special Category and Sensitive Data (Health, Blood Group, Biometric)

Blood group, health-related information, and other sensitive data described in this Privacy Policy are treated as “special category data” under the EU/UK GDPR and as sensitive data under other applicable laws.
Where the EU/UK GDPR applies, Simply Blood processes such data only where one of the following applies: (a) you have given explicit consent; (b) processing is necessary to protect your vital interests or those of another person where you are physically or legally incapable of giving consent (for example, an urgent blood request); (c) processing relates to data manifestly made public by you, such as a story or donation post you choose to publish; or (d) another Article 9 GDPR condition applies.
Where the Indian Digital Personal Data Protection Act, 2023 (“DPDP Act”) applies, such data is processed on the basis of your consent or another ground permitted under the DPDP Act, and you may withdraw consent at any time using the mechanisms described in this Privacy Policy.

10. Data Minimization

Simply Blood follows the principle of collecting only the minimum amount of information reasonably necessary to:

operate the Platform
verify users
improve safety
comply with legal obligations
deliver requested Services.

We regularly review our data collection practices to reduce unnecessary collection.

11. Accuracy of Information

Users are responsible for ensuring that the information they provide remains accurate and current.
Where feasible, users may update their information directly through the Platform.
Knowingly providing false information may result in suspension or termination of Platform access.

12. Children's Privacy

Simply Blood is not intended for children under the minimum age required under applicable law for account registration.
We do not knowingly collect Personal Information from children in violation of applicable law.
If we become aware that such information has been collected, we will take reasonable steps to delete it or otherwise comply with applicable legal requirements.

12A. Notice to Parents (COPPA – United States)

Simply Blood does not knowingly collect Personal Information from children under 13 years of age in the United States. If a parent or guardian believes a child under 13 has provided Personal Information to Simply Blood, they may contact us using the details in this Privacy Policy to request that the information be reviewed and deleted.

13. Updates to this Policy

We may update this Privacy Policy from time to time to reflect:

changes in law
Platform improvements
new Services
security requirements
technological developments.

Material updates will be communicated through appropriate channels where required by applicable law.
Continued use of the Platform after such updates become effective constitutes acknowledgment of the revised Privacy Policy.

Contact Information
Change With One Foundation
General Support
support@simplyblood.com
Legal
legal@simplyblood.com
Privacy Contact

Grievance Officer to be formally designated prior to public launch. Interim contact: legal@simplyblood.com.

14. How We Use Your Information

Simply Blood uses your information only for legitimate purposes consistent with this Privacy Policy and applicable law.
We may use your information to:

create and manage your account
verify your identity or organization
facilitate blood donation requests
match compatible donors and seekers
improve donor and seeker safety
enable communication between authorized users
provide customer support
process reports and complaints
detect and prevent fraud
improve Platform performance
personalize user experience
recognize donation milestones and achievements
conduct internal analytics
comply with legal obligations
protect the security and integrity of the Platform.

We do not use your Personal Information for purposes that are incompatible with those described in this Privacy Policy unless permitted or required by applicable law.

15. How Information Is Shared

Simply Blood does not sell your Personal Information.
We may share information only where reasonably necessary to provide the Services, protect users, comply with legal obligations, or operate the Platform.
Information may be shared with:

other Platform users where necessary for blood request coordination
verified hospitals
verified blood banks
verified NGOs
authorized event organizers
technology service providers
cloud infrastructure providers
communication service providers
analytics providers
verification providers
regulatory authorities where required by law.

All recipients are expected to process information only for authorized purposes.

16. Information Shared with Other Users

Certain information is intentionally visible to other users to enable the Platform to function.
Depending on your role, Platform features, and privacy settings, other users may see information such as:

display name
profile photograph
blood group
donation achievements
community badges
district or city
public biography
donation stories or community posts.

Certain information may only be shared after specific actions, such as accepting or coordinating a blood request.
Simply Blood is designed to minimize unnecessary disclosure of Personal Information and to provide users with appropriate controls where feasible.

17. Information Shared with Verified Organizations

Where necessary to facilitate Platform Services, Simply Blood may share limited information with verified organizations including hospitals, blood banks, and NGOs.
Examples include:

contact information necessary for coordination
blood request details
donor participation information
event participation information
organization-related communications.

Information shared is limited to what is reasonably necessary for the relevant Service.

18. Service Providers

Simply Blood relies on trusted third-party service providers to operate the Platform.
These providers may assist with:

cloud hosting
data storage
authentication
messaging
push notifications
email delivery
mapping services
analytics
artificial intelligence
customer support
fraud prevention
security monitoring
system reliability.

Service providers are contractually required to protect Personal Information and may process information only on our documented instructions or as otherwise permitted by applicable law.

19. Artificial Intelligence Processing

Simply Blood may use artificial intelligence technologies to improve Platform functionality and safety.
AI processing may include:

document analysis
certificate verification
image analysis
language translation
text summarization
fraud detection
duplicate detection
content moderation
notification optimization
accessibility improvements
recommendation systems.

AI-assisted processing is designed to support—not replace—human judgment in appropriate cases.
Consistent with the AI Usage Policy, significant decisions that materially affect a user (such as verification rejection or account suspension) are subject to human review before a final adverse action is taken.

20. Automated Decision-Making

Some Platform features may rely on automated systems to assist with operational decisions, including:

donor-request matching
fraud detection
duplicate request detection
notification prioritization
content moderation
spam detection
account security.

These automated processes are intended to improve user safety, operational efficiency, and Platform integrity.
Where required by applicable law, users may have the right to request review of certain automated decisions.

21. AI Limitations

Artificial intelligence technologies are continuously evolving and may occasionally generate inaccurate, incomplete, or inappropriate outputs.
Accordingly:

AI-generated summaries may contain errors
AI translations may not be perfect
AI verification is probabilistic
AI-generated content should not be interpreted as professional advice
AI outputs should not replace qualified medical judgment.

Users remain responsible for reviewing AI-generated information before relying upon it.

22. Cookies and Similar Technologies

Simply Blood uses cookies and similar technologies to:

authenticate users
maintain user sessions
remember preferences
improve Platform performance
understand usage patterns
enhance security
provide accessibility features.
Additional details are provided in the Cookie Policy.

23. Analytics

Simply Blood uses analytics technologies to better understand how the Platform is used.
Analytics may include information such as:

pages visited
features used
application performance
crash reports
engagement metrics
notification interactions
referral activity.
Where possible, analytics data is aggregated, pseudonymized, or de-identified.

We do not intentionally include unnecessary Personal Information in analytics events.

24. Communications

Simply Blood may communicate with users regarding:

blood requests
donation opportunities
verification
account security
legal notices
community updates
Platform improvements
customer support
emergency notifications.

Certain communications are essential to the operation and security of the Platform and cannot be disabled while maintaining an active account.
Marketing or promotional communications may be managed through available preference settings where applicable.

25. Push Notifications

Where enabled by the user or permitted by applicable law, Simply Blood may send push notifications relating to:

nearby blood requests
request status updates
donation reminders
event reminders
achievement notifications
security alerts
important Platform announcements.

Users may disable certain push notifications through Platform settings or device settings, except where notifications are essential for security or legal compliance.

26. International Data Transfers

Simply Blood may process or store information in jurisdictions outside the user's country of residence where necessary to operate the Platform.
Where international transfers occur, Simply Blood will implement reasonable safeguards appropriate to the applicable legal requirements, including contractual, organizational, and technical measures designed to protect Personal Information.

26A. Transfer Mechanisms

Where Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of data protection, the transfer is carried out under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognized transfer mechanism, together with any additional safeguards required by applicable law. A summary of the relevant safeguards is available on request using the contact details in this Privacy Policy.

27. Cross-Border Services

Simply Blood supports users across multiple countries.
Accordingly, information necessary to facilitate cross-border Platform Services may be processed by approved service providers or infrastructure located in different jurisdictions.
Regardless of where information is processed, Simply Blood seeks to apply consistent privacy and security standards appropriate to the nature of the information.

28. Business Transfers

If Change With One Foundation undergoes:

restructuring
merger
acquisition
reorganization
asset transfer
insolvency proceedings

Personal Information may be transferred as part of the transaction, subject to applicable law and appropriate safeguards.
Users will be notified where required by law.

29. Legal Disclosures

Simply Blood may disclose Personal Information where disclosure is reasonably necessary to:

comply with legal obligations
respond to lawful requests
protect users
investigate fraud
enforce these Terms
prevent unlawful activity
protect public safety
establish or defend legal claims.

We evaluate requests carefully and disclose only the information reasonably necessary under the circumstances.

30. Data Minimization in Sharing

Whenever Personal Information is shared, Simply Blood seeks to apply the principle of data minimization.
Accordingly:

only the minimum information reasonably necessary will be shared
access is limited based on role and purpose where practicable
unnecessary disclosure is avoided

appropriate technical and organizational safeguards are implemented where feasible.
Simply Blood continually reviews its data-sharing practices to reduce unnecessary exposure of Personal Information.

31. Protection of Your Information

Simply Blood is committed to protecting the confidentiality, integrity, and availability of the information entrusted to us.
We implement reasonable administrative, technical, physical, and organizational safeguards designed to protect Personal Information against:

unauthorized access
unauthorized disclosure
alteration
accidental loss
misuse
destruction
theft
unlawful processing.

Our security program is regularly reviewed and updated to address evolving threats and technological developments.

32. Security Measures

Depending on the nature of the Service, Simply Blood may implement safeguards including:

encryption of data during transmission
encryption of sensitive data where appropriate
secure authentication mechanisms
role-based access controls
least-privilege access principles
activity logging
infrastructure monitoring
vulnerability management
secure software development practices
backup and disaster recovery procedures.

Security controls may change over time as technology and industry practices evolve.

33. User Responsibilities for Security

Users also play an important role in protecting their information.
Users are responsible for:

maintaining strong passwords where applicable
protecting OTPs and verification codes
safeguarding devices used to access the Platform
keeping contact information current
promptly reporting suspected unauthorized access
avoiding sharing account credentials with others.

Simply Blood is not responsible for losses resulting from a user's failure to maintain the security of their account or device.

34. Security Incidents

If Simply Blood becomes aware of a security incident affecting Personal Information, we will take reasonable steps to:

investigate the incident
contain and remediate the issue
assess potential risks
notify affected users where required by applicable law
notify regulatory authorities where legally required
implement corrective measures to reduce the likelihood of recurrence.

Not every security event results in unauthorized disclosure of Personal Information.

35. Data Retention

Simply Blood retains Personal Information only for as long as reasonably necessary to:

provide the Services
maintain Platform functionality
comply with legal obligations
resolve disputes
investigate fraud
enforce our legal rights
maintain business records
protect users and the Platform.

Retention periods vary depending on the nature of the information and applicable legal requirements.

36. Account Deletion

Users may request deletion of their Account through the Platform or by contacting Simply Blood.
Following a valid deletion request, we will take reasonable steps to delete or anonymize Personal Information, subject to:

applicable legal obligations
ongoing investigations
fraud prevention
dispute resolution
financial or audit requirements
security obligations
backup and disaster recovery processes.

Deletion of an Account does not necessarily result in immediate deletion of all associated information where retention is legally or operationally required.

36A. Deleting Your Account In-App

Users can initiate deletion of their Account directly within the Simply Blood mobile application, without needing to contact customer support, through the account settings menu. Deletion requests submitted in-app are processed in the same manner as requests submitted by email.

37. Content After Account Deletion

Where permitted by applicable law:

community contributions may remain visible after Account deletion in anonymized or de-identified form
comments or stories that cannot reasonably be removed without affecting the integrity of discussions may remain while no longer identifying the former user

certificates, historical donation statistics, and aggregated community metrics may continue to be included in anonymous or statistical reporting.
Personally identifiable information will be handled in accordance with applicable law and this Privacy Policy.

38. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

access your Personal Information
correct inaccurate information
update incomplete information
request deletion of eligible information
withdraw consent where processing is based on consent
request restriction of processing
object to certain processing activities
request portability of eligible information
request information regarding how your data is processed
lodge a complaint with a competent supervisory authority.
Certain rights may be subject to legal limitations or exceptions.

39. Exercising Your Rights

Requests relating to your privacy rights may be submitted through the Platform or by contacting Simply Blood using the contact details provided in this Privacy Policy.
To protect user privacy, we may request additional information to verify your identity before responding to certain requests.
We will respond within the timeframes required by applicable law.

39A. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what Personal Information Simply Blood collects, to request deletion or correction of that information, to opt out of any “sale” or “sharing” of Personal Information, and to limit the use of sensitive Personal Information. Simply Blood does not sell or share Personal Information for cross-context behavioral advertising. You will not receive discriminatory treatment for exercising these rights. Requests may be submitted using the contact details in this Privacy Policy, and we will verify your identity before responding.

39B. Data Protection Officer / Grievance Officer (India)

In accordance with the Digital Personal Data Protection Act, 2023, Simply Blood will designate a Grievance Officer (and, where applicable, a Data Protection Officer) responsible for addressing questions or grievances relating to the processing of Personal Information. The name and contact details of the Grievance Officer will be published on the Platform and in this Privacy Policy prior to public launch.

39C. Response Timeframes

Simply Blood aims to acknowledge privacy requests within 7 days and to substantively respond within 30 days, or such other period as required under applicable law (for example, the DPDP Act, GDPR, or CCPA/CPRA), which may be extended where permitted by law for complex requests.

40. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.
Please note that withdrawing consent may prevent Simply Blood from providing certain Services or Platform features.

41. Marketing Preferences

Where Simply Blood sends promotional or marketing communications, users may opt out using available unsubscribe mechanisms or communication preferences.
Certain communications cannot be disabled because they are necessary for:

account security
legal compliance
operational notices
blood request coordination
fraud prevention
essential Service functionality.

42. Complaints

If you have concerns regarding the way Simply Blood processes your Personal Information, we encourage you to contact us first so that we may investigate and attempt to resolve the matter promptly.
Complaints should include sufficient detail to enable us to understand and investigate the issue.

43. Regulatory Authorities

Where applicable, users may have the right to lodge a complaint with the relevant data protection or privacy regulator in their jurisdiction if they believe their rights have been violated.
Nothing in this Privacy Policy limits rights granted under applicable law.

44. International Users

Simply Blood is designed for users in multiple jurisdictions.
Privacy rights, legal obligations, and available remedies may vary depending on applicable local laws.
Where required by applicable law, Simply Blood will take reasonable steps to comply with jurisdiction-specific privacy requirements.

45. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes in law
new Platform features
operational improvements
security enhancements
technological developments
organizational changes.

Material updates will be communicated through appropriate channels where required by applicable law.
The updated Privacy Policy will include a revised Last Updated date.

46. Governing Law

This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, without regard to conflict of law principles, except where mandatory local privacy or consumer-protection laws require otherwise.

47. Contact Information

Owner & Operator
Change With One Foundation
General Support
Email: support@simplyblood.com
Legal Contact
Email: legal@simplyblood.com
Privacy Contact

Grievance Officer / Data Protection Officer – to be formally designated under the DPDP Act, 2023 prior to public launch. Interim contact: legal@simplyblood.com

48. Interpretation

Headings used in this Privacy Policy are provided for convenience only and do not affect interpretation.
Where the context requires, words in the singular include the plural and vice versa.
References to applicable law include amendments, replacements, and successor legislation unless the context requires otherwise.

49. Severability

If any provision of this Privacy Policy is determined to be invalid or unenforceable, the remaining provisions shall continue in full force and effect to the maximum extent permitted by applicable law.

50. Acknowledgement

By accessing or using the Simply Blood Platform, you acknowledge that:

you have read this Privacy Policy
you understand how your Personal Information is processed
you understand your available privacy rights
you consent to processing where consent is required by applicable law

you agree to the collection, use, disclosure, and protection of your information as described in this Privacy Policy.
If you do not agree with this Privacy Policy, you should discontinue use of the Platform and may request deletion of your Account in accordance with this Policy.