Medius Earth · Hasten Forestry India Private Limited
Privacy Policy
This Privacy Policy explains how Medius Earth (Hasten Forestry India Private Limited) collects, uses, stores, shares, and protects personal and project data through the Platform. It applies to all Authorized Users: internal (employees, field teams, supervisors, corporate office) and external (partner developers, ground operators, funders, auditors/VVBs, registries, financing and rating organizations, and other approved third parties). It is Part B of the Platform Access Agreement.
B.1 Scope and applicability
This Policy applies to personal data and project data processed through or in connection with the Platform, including data captured in the field (via mobile devices, WhatsApp-based tools, or voice input in local languages), data uploaded to dashboards or the data room, and data generated by the Platform's geospatial and AI analysis modules. It is designed to align with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where a User is located outside India, applicable international data protection principles.
B.2 Information we collect
B.2.1 Account and identity data
Name, role, organization, email address, phone number, login credentials, and authentication records.
B.2.2 Field and project data
Planting and survival counts, species and biodiversity data, geolocation coordinates, site photographs, drone/satellite imagery references, voice recordings and transcriptions (currently supported in multiple Indian languages, with further languages planned), labour and material usage records, and other operational data entered by field teams.
B.2.3 Financial and commercial data
Where relevant to a User's role (e.g., project developers, funders), budget, disbursement, milestone, and carbon credit/revenue data.
B.2.4 Usage and technical data
Device information, IP address, log-in timestamps, access logs, and audit trail records of actions taken on the Platform.
B.2.5 AI-processed data
Outputs generated by the Platform's AI tools when processing multi-modal inputs (text, voice, image) submitted by Authorized Users.
B.3 How we use information
- To operate, maintain, and improve the Platform and its features;
- To generate monitoring, verification, and impact reports (including carbon sequestration models, Shannon Diversity Index and biodiversity metrics, and regulatory submissions);
- To support due diligence by funders, project financing organizations, lenders, and rating providers;
- To support engagement with Verification and Validation Bodies (VVBs) and carbon registries (e.g., Verra/VCS, Isometric, India's national carbon registry);
- To maintain audit logs and data integrity records required for carbon credit issuance and verification;
- To communicate with Authorized Users regarding their access, projects, and Platform updates;
- To comply with applicable legal, regulatory, and contractual obligations.
B.4A Artificial intelligence and your data
The Platform uses AI to transcribe and translate voice notes, read photos and documents, extract field data from messages, and draft summaries and reports. AI outputs are decision-support tools and are reviewed by people before they are relied on (see Part C, Section C.5).
External AI service providers
- Some of this processing uses AI services from third-party providers. We use them for inference only: data is sent to process a specific request and return the result to the Platform.
- We do not sell or share any data with these providers, or with anyone else, for the training of AI models.
- For each service we use, we always choose the option with the best available data protection, such as the provider's enterprise or API terms under which customer data is not used to train its models.
- These providers act as our service providers under the obligations described in B.4.
Medius Earth's own models
- Medius Earth may use data only in anonymized, de-identified, and/or aggregated form, from which no User, individual, site, or project can reasonably be re-identified, to train and improve its own AI models and the Platform (Part A, Section A.4.2).
- We do not use identifiable data for this purpose without your separate consent.
- Information about your site or project, including its location, boundaries, land ownership or tenure, baseline and monitoring data, credit volumes, pricing, or commercial terms, is not disclosed to third parties except with your written consent or where required by law.
Face matching for attendance
Where a project uses photo attendance, face matching runs on Medius Earth's own servers and is applied only to staff who have given consent.
B.5 Data security
The Platform encrypts data in transit and at rest, encrypts sensitive personal fields, applies role-based access controls, and keeps audit logs of user actions. Access to sensitive data sets is restricted according to the Authorized User's assigned role. While Medius Earth maintains industry-standard security measures, no system can guarantee absolute security, and Users are responsible for safeguarding their own login credentials.
B.6 Data retention
Personal and project data is retained for as long as necessary to fulfil the purposes described in this Policy, including the retention periods required by carbon registries and verification standards (which may extend for the life of a carbon project and its crediting period, often 10–30+ years), and thereafter as required by applicable law. Account data is retained for the duration of the User's access and for a reasonable period thereafter for audit and legal purposes.
B.7 Your rights
Subject to applicable law (including the DPDP Act, 2023, where applicable), Authorized Users may request to:
- access the personal data Medius Earth holds about them;
- correct inaccurate or incomplete personal data;
- request deletion of personal data, subject to Medius Earth's legitimate need to retain records for audit, verification, legal, or contractual purposes (in particular, field and project data forming part of a carbon project's audit trail generally cannot be deleted while the project remains active or under registry review);
- withdraw consent for optional processing, where consent is the basis for that processing;
- raise a grievance with Medius Earth's designated contact point (Section B.11).
B.8 Cross-border data transfer
Where Medius Earth engages cloud infrastructure or service providers located outside India, or shares data with international registries, funders, or verification bodies, such transfers will be made under appropriate contractual safeguards and in compliance with applicable data transfer requirements.
B.9 Children’s privacy
The Platform is intended for use by adult professionals in connection with their employment, contractual, or partnership role. It is not directed at, and Medius Earth does not knowingly collect personal data from, individuals under the age of 18.
B.10 Changes to this Policy
Medius Earth may update this Privacy Policy from time to time to reflect changes in the Platform, legal requirements, or business practices. Material changes will be notified to Authorized Users through the Platform or by email, and continued use of the Platform after such notice constitutes acceptance of the updated Policy.
B.11 Contact and grievance officer
Questions, requests, or grievances relating to this Privacy Policy may be directed to contact@mediusearth.com, or in writing to Hasten Forestry India Private Limited, No. 19, 4th C Cross, Koramangala Industrial 5th Block Area, Bengaluru, Karnataka 560095, India.