Draft for legal review. This page was drafted for the product team and must be reviewed by a qualified lawyer before launch. Text in purple brackets is a placeholder. Draft 0.1, 25 October 2026.
This Privacy Policy explains how [Legal entity name] ("Ayush", "we", "us") handles your personal data when you use the Ayush website at ayush.insightnexus.in and the Ayush apps. We wrote it to follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (the "DPDP law"), and the Information Technology Act, 2000 and its rules on sensitive personal data, which continue to apply during the transition.
1. Who we are
[Legal entity name] is the Data Fiduciary for Ayush. That means we decide why and how your personal data is processed. Registered office: [Registered office address], Mumbai, Maharashtra, India.
2. What this policy covers
It covers data you give us, data created when you use Ayush, and data from apps you choose to connect. It does not cover third-party websites we link to, such as the guideline publishers on our Sources page.
3. Data we collect
| Category | Examples | Why | Basis |
|---|---|---|---|
| Account | Name, date of birth, mobile number or email, Health ID, sign-in records | Create and secure your account | Consent |
| Health profile | Height, weight, waist, conditions, safety flags, whether you take regular medicines, test results you enter, goals | Build and adapt your plan | Consent ("Use my health information") |
| Lifestyle and food | Work type, sleep times, stress level, tobacco and alcohol use, diet type, cuisine, allergies | Build and adapt your plan | Consent |
| Logs | Readings (weight, BP, sugar, pulse), sleep, steps, mood, joint pain, symptoms, notes, checklist ticks | Track progress, safety alerts, weekly review, doctor report | Consent |
| Connected apps | Steps, sleep and heart rate from Google Health Connect or Apple Health | Fewer manual entries | Separate consent, off by default |
| Guardian details | Name, relationship and mobile number of a parent or guardian, and their consent record | Verifiable consent for users under 18 | Legal requirement |
| Payments | Plan, amount, payment status and a reference from the payment provider. We never see or store full card numbers. | Billing and tax records | Contract and legal obligation |
| Support | Messages you send us | Reply and resolve issues | Consent |
| Device and usage | App version, device type, crash reports, cookieless page counts | Keep the service working and secure | Legitimate use for security; consent for analytics |
We treat all health-related data as sensitive and collect only what your plan needs.
4. How we use your data
- To create your Health ID and keep your account secure.
- To build, explain and adjust your lifestyle plan, and to show safety alerts.
- To send reminders and weekly reviews, if you allow notifications.
- To produce reports you choose to share, such as the doctor report.
- With your separate consent, to provide AI coaching and to create de-identified statistics that improve Ayush.
- To meet legal obligations, such as tax records and responding to lawful requests.
We do not sell personal data, use health data for advertising, or run third-party advertising trackers on screens that show health information.
5. Consent and withdrawal
Each use of your data has its own switch in Profile: plan building, reminders, AI coaching, connected apps, research and marketing. Consent notices are available in English, Hindi and Marathi. You can withdraw any consent as easily as you gave it. Withdrawing consent stops future processing for that purpose; it does not affect processing already done. If you withdraw consent for plan building, we can no longer personalise your plan.
6. Children
Ayush is not available to children under 13. Users aged 13 to 17 can join only with verifiable consent from a parent or legal guardian, collected before we process their health data. We do not track children's behaviour for advertising or target ads at them. Plans for under-18s are age-appropriate and never include calorie restriction.
7. Who we share data with
We share personal data only with service providers (Data Processors) who work for us under written contracts, and only what they need:
- Cloud hosting and database services, on servers located in India: [Hosting provider]
- SMS and email delivery for sign-in codes and reminders: [Messaging provider]
- Payment processing: [Payment gateway], and Google Play or the App Store for in-app billing
- AI processing, only if you switch on AI coaching: Anthropic (Claude), receiving plan details without your name, contact details or Health ID
- Self-hosted, cookieless analytics that never runs on health screens
We share your doctor report only when you choose to. We may disclose data where the law requires it, for example to comply with a court order, and will tell you where the law allows.
8. Transfers outside India
Your account and health data are stored in India. If you switch on AI coaching, de-identified plan details may be processed outside India by our AI provider. We transfer data only to countries the Government of India has not restricted, under contracts that require equivalent protection.
9. Security
- Encryption in transit (TLS 1.2 or higher, with TLS 1.3 preferred) and at rest (AES-256), with an extra layer of field-level encryption on health data.
- Keys managed in a dedicated key-management service and rotated regularly.
- One-time-code sign-in, optional passkeys and multi-factor authentication, rate limiting and session controls.
- Role-based access for staff, least-privilege permissions and audit logs of access to personal data.
- Regular security testing, dependency scanning and an incident response plan.
10. How long we keep data
- While your account is active, we keep your data to provide the service.
- When you delete your account, we erase your personal data within 30 days, except records we must keep by law (such as payment invoices, kept for 8 years under tax rules).
- If you do not use Ayush for 3 years, we will notify you at least 48 hours before deleting your account and data.
- Security logs are kept for at least one year, as the DPDP Rules require.
- De-identified statistics that cannot identify you may be kept longer.
11. Your rights
Under the DPDP law you can:
- Get a summary of your personal data and how it is processed, and the identities of those we have shared it with.
- Correct, complete or update your data.
- Have your data erased when it is no longer needed or when you withdraw consent.
- Withdraw consent at any time.
- Have your grievances addressed.
- Nominate someone to exercise your rights if you die or become unable to do so.
Most of these work directly in the app (Profile, then Your data). You can also use our data request page. We respond as quickly as we can, and always within the time the DPDP Rules allow, which is at most 90 days. We aim for 30 days.
12. Data breaches
If a personal data breach occurs, we will inform affected users without delay, in plain language, explaining what happened, the likely impact, what we are doing and what you can do. We will also report the breach to the Data Protection Board of India within the timelines the DPDP Rules set, including a detailed report within 72 hours of becoming aware of it.
13. Grievances and contact
Questions or complaints about your data: write to our Grievance Officer at grievance@insightnexus.in, or see the Grievance Officer page. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Privacy contact: privacy@insightnexus.in. Data protection contact person: [Name of Data Protection contact].
14. Changes to this policy
If we make material changes, we will tell you in the app and by email before they take effect, and ask for fresh consent where the law requires it.