Privacy policy

Last updated: 18 August 2026

1. About This Policy

This Privacy Policy explains how Hisvitals Private Limited (“HisVitals”, “we”, “us”, “our”) collects, uses, shares, retains, and protects your personal data.

It applies when you:

• visit or use hisvitals.com and any associated domains or subdomains (the “Site”);
• purchase or use our blood testing and health programme, including home sample collection, laboratory testing, report analysis, doctor consultation, and coaching (the “Programme”);
• use Circle by HisVitals, our iOS application (the “App”);
• subscribe to our newsletter or promotional communications;
• contact us through WhatsApp, email, or any other support channel.

Together, the Site, the Programme, and the App are referred to as the “Services”. “You” and “your” refer to you as a user of the Services.

This Policy also serves as the Notice required under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), informing you what personal data we collect, why we process it, and what rights you have as a Data Principal.

By using the Services you confirm you have read this Policy. If you do not agree with it, please do not use the Services.

2. Who We Are

Legal entity	Hisvitals Private Limited
CIN	U86900MP2023PTC068850
Registered office	C/o Narayan Singh Rajput, Ashok Ward, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh – 461775, India
Correspondence address	B-901, Maxblis White House, Sector 75, Noida, Dist. Gautam Buddha Nagar, Uttar Pradesh – 201301, India
Privacy contact	privacy@hisvitals.com
Grievance Officer	Tushar Rokade, Co-Founder — privacy@hisvitals.com

We are the Data Fiduciary for the personal data described in this Policy.

3. Personal Data We Collect

We collect only what is necessary for the purposes described in Section 4.

3.1 Contact and account data

Name, email address, phone number, billing and shipping address, account credentials, and profile preferences.

3.2 Order and transaction data

Programme purchased, order history, payment status, and refund or cancellation requests.

3.3 Health assessment inputs

Before or during onboarding you may provide age, gender, height, weight, and a derived body mass index, along with health goals, symptoms, lifestyle information (sleep, stress, diet, activity), and any medical history you choose to disclose.

3.4 Blood sample and diagnostic data

For the Programme we arrange home collection of a blood sample through our laboratory partner (see Section 6.1) and receive the resulting test report, which includes biomarker values across the panel you have purchased.

We receive and store the report. We do not take custody of the physical sample at any point.

3.5 Consultation and coaching data

Notes from your consultation with our doctor, the diet and workout plan prepared for you, any supplement or lifestyle recommendations made, and your ongoing check-ins with your assigned health coach (typically over WhatsApp), including self-reported meals, sleep, water intake, activity, and weight.

3.6 Circle app data

When you use the App we collect:

• Workout and progress logs — exercises completed, weight entries, consistency data;
• Meal photographs you capture for AI nutrition logging, and the nutritional analysis derived from them;
• Blood report files you upload, and the analysis derived from them;
• Step count read from Apple Health, where you grant permission (see Section 3.7);
• Account identifiers — user ID, email address.

3.7 Apple Health data

If you grant permission, the App reads your daily step count from Apple Health. We commit to the following, consistent with Apple’s HealthKit requirements:

• We read only. We do not write data back to Apple Health.
• We collect step count only, and no other Apple Health data type.
• Apple Health data is never used for advertising or marketing, never sold, and never shared with any advertising or analytics platform.
• Within HisVitals it is visible only to you and your assigned health coach, to track daily progress.
• You can revoke access at any time in iOS Settings → Privacy & Security → Health.

3.8 Usage and technical data

Device and browser type, operating system, IP address and approximate location derived from it, pages visited, referral URLs, session duration, cart interactions, and cookie data as described in Section 5.

4. How We Use Your Data, and On What Basis

Under the DPDP Act, our processing rests on either your consent or one of the certain legitimate uses recognised in Section 7 of that Act — principally, data you voluntarily provide for a purpose you have approached us for.

4.1 Delivering the Programme

Scheduling your home blood collection; instructing our laboratory partner to perform the tests you purchased; receiving and analysing your report; preparing your consultation; producing your diet, workout, and supplement recommendations; and providing coaching support.

Basis: your consent, and performance of the service you have requested.

4.2 Health data processing

Analysing your blood report, health assessment inputs, and app-logged data to identify relevant findings and personalise your plan.

Basis: your explicit consent, which you may withdraw at any time (Section 9).

4.3 Operating the Circle app

Generating workout and diet plans; analysing meal photographs for nutritional content; parsing uploaded blood reports into readable insights; tracking your progress; and enabling your assigned coach to review that progress and support you.

Basis: your consent.

4.4 Orders and payments

Processing payments, issuing invoices, handling refunds, and maintaining accounting records.

Basis: performance of your order and compliance with tax and accounting law.

4.5 Support and service communication

Responding to your queries by email or WhatsApp; sending appointment reminders, report-ready notifications, and other transactional messages.

Basis: your consent and performance of the service.

4.6 Marketing

Sending promotional email, SMS, or WhatsApp messages about our Services, and measuring the performance of our advertising.

Basis: your consent. You may opt out at any time — see Section 9.

4.7 Legal and security

Detecting and preventing fraud; complying with the DPDP Act, GST and Companies Act obligations, and applicable healthcare regulation; responding to lawful requests from authorities; and enforcing our Terms.

Basis: legal obligation.

5. Cookies, Tracking, and Advertising Measurement

5.1 Essential cookies

Shopify session cookies that maintain your cart, login state, and preferences. The Site cannot function without these.

5.2 Analytics

We use Shopify’s built-in store analytics to understand how visitors move through the Site in aggregate — pages viewed, sessions, and checkout progress. We do not currently operate Google Analytics or any separate third-party analytics platform.

5.3 Advertising measurement

We operate the Meta Pixel with the Conversions API and the Google Ads tag on the Site. These tell us whether a visit or purchase followed one of our ads.

What we send to these platforms is limited to conversion events — for example that a lead was submitted or a purchase completed — together with identifiers such as a hashed email address or phone number used to match the event to an ad click.

You can limit advertising tracking through Meta Ad Preferences, Google My Ad Center, your browser settings, or a content blocker.

5.4 WhatsApp

We use WhatsApp Business to send transactional messages and, with your consent, promotional messages. Your number and message content are accessible to us and to Zepic, our WhatsApp Business Solution Provider. Reply STOP to opt out of promotional messages.

6. How We Share Your Data

We do not sell your personal data. We share it only as set out below.

6.1 Laboratory partner

We use Thyrocare Technologies Limited to collect your blood sample at your home and perform the diagnostic tests you have purchased. To do this we share your name, contact details, address, age, gender, and the test panel ordered.

Thyrocare collects, transports, and processes the physical sample and generates your report. Thyrocare also stores and processes your data on its own systems under its own privacy policy, which you should review at thyrocare.com. Their policy indicates that data may be used in connection with quality checks, teaching, and the development of reference ranges for diagnostic tests, and that data may be stored on cloud infrastructure including AWS and Google Cloud.

We do not take custody of your physical sample. Retention and disposal of the sample itself is governed by Thyrocare’s own procedures.

6.2 Our medical and coaching team

Your blood report, health inputs, and consultation notes are accessible to the doctor assigned to your consultation and to your assigned health coach, on a need-to-know basis, so that they can prepare and deliver your plan.

All doctors and coaches with access to your health data are employees of HisVitals, bound by confidentiality obligations. Independent or third-party trainers cannot access your health data.

6.3 AI processing providers

To produce the analysis you have asked for, we send certain data to specialist AI providers:

Data	Provider	Purpose
Meal photographs	Google (Gemini API, paid tier)	Identifying food and estimating nutritional content
Uploaded blood reports	OpenAI	Converting report values into readable insights

We use paid, commercial API tiers with both providers. Under those terms, your data is not used to train their models. Outputs and stored copies remain on HisVitals-controlled servers.

6.4 Operational service providers

• Shopify — website and store hosting
• Razorpay — our sole payment gateway, handling card, UPI, and netbanking payments. We never receive or store your full card number, CVV, or banking credentials. We do not offer cash on delivery.
• Zepic — WhatsApp Business messaging delivery
• DigitalOcean — cloud hosting for our backend systems, including stored blood report analysis and app data
• Apple — App Store distribution and app analytics

Each is bound to process data only on our instructions and to protect it appropriately.

6.5 Legal disclosure

We may disclose data to courts, regulators, or law enforcement where required by law, or where necessary to prevent fraud or protect the rights and safety of any person.

6.6 Business transfers

If HisVitals is involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction, subject to confidentiality protections and notice where the law requires it.

6.7 What we never do

We do not share your blood results, health assessment data, consultation notes, or app health data with:

• insurance companies
• your employer
• advertising or marketing platforms
• data brokers
• any party seeking to use them for commercial profiling

7. Cross-Border Transfers

Some of our providers — including Shopify, Google, OpenAI, Apple, DigitalOcean, and Zepic — may store or process data on servers outside India. Razorpay, our payment gateway, processes payment data within India. Where this happens we rely on contractual safeguards with those providers, consistent with the DPDP Act and any restrictions notified by the Central Government.

If you have questions about where your data is held, contact privacy@hisvitals.com.

8. How Long We Keep Your Data

Data	Retention
Blood test reports and biomarker data	3 years from the date of the test
Consultation notes and health plans	3 years from the date of consultation
Health assessment inputs (age, weight, height, BMI, goals)	3 years, or until you withdraw consent
Circle app data (workouts, weight logs, meal photos and analysis)	While your account is active
Apple Health step data	While your account is active and permission is granted
Account and profile data	While your account is active
Order, invoice, and payment records	8 years from the end of the financial year, as required under the Companies Act, 2013 and GST law
Marketing preferences	Until you withdraw consent, after which we keep a suppression record so we do not contact you again
Aggregated, anonymised analytics	Indefinitely — this data cannot be linked back to you

When you delete your account or withdraw consent, we delete or irreversibly anonymise the associated data within 30 days, except where we are legally required to retain it (principally financial records).

9. Your Rights

As a Data Principal under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it is processed;
• Correction — have inaccurate or incomplete data corrected, and incomplete data completed;
• Erasure — request deletion of your data, which we will action unless retention is legally required;
• Withdraw consent — at any time, as easily as you gave it. Withdrawing consent for health data processing means we can no longer deliver the Programme or the App’s health features;
• Nominate — appoint someone to exercise your rights in the event of your death or incapacity;
• Grievance redressal — raise a complaint about our handling of your data (Section 10).

To exercise any of these rights, email privacy@hisvitals.com. We may need to verify your identity first. We will respond within 30 days.

In-app account deletion is available directly within Circle. Deleting your account there removes your app data in line with Section 8.

To opt out of marketing: use the unsubscribe link in any email, reply STOP to SMS or WhatsApp, or email privacy@hisvitals.com. Transactional messages about your orders, appointments, and reports will continue.

10. Grievance Officer

As required under the DPDP Act, we have designated a Grievance Officer:

We will acknowledge your complaint within 48 hours and resolve it within 30 days.

If you are not satisfied with our resolution, you may escalate to the Data Protection Board of India.

11. Children

Our Services are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18.

The DPDP Act requires verifiable parental consent for processing children’s data, and we have chosen not to offer our Services to minors.

If you believe someone under 18 has provided us with personal data, contact privacy@hisvitals.com and we will delete it promptly.

12. Security

We protect your data through:

• Encryption in transit using HTTPS/TLS across the Site and App
• Role-based access controls, so that only the doctor and coach assigned to you can see your health data
• PCI-DSS compliant payment gateways — we never handle raw card data
• Confidentiality obligations binding all employees with access to health data
• Periodic review of our data handling practices

No system is perfectly secure. If you suspect unauthorised access to your account, contact us immediately at privacy@hisvitals.com.

Where a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act.

13. Third-Party Links

The Site and App may link to third-party websites and services. This Policy does not cover them. Review their privacy policies before providing personal data.

14. Medical Disclaimer

Information provided through the Services — including blood report analysis, AI-generated insights, diet and workout plans, and supplement recommendations — supports your health decisions but does not replace independent medical advice, diagnosis, or treatment.

Any supplements recommended following your consultation are suggestions only. We do not sell supplements. You are free to purchase any recommended product from any source you choose, or not at all.

Always consult a qualified medical practitioner about a medical condition, and never disregard professional medical advice because of something provided through the Services.

15. Changes to This Policy

We may update this Policy to reflect changes to our Services or the law.

• The “Last updated” date above will change.
• For material changes — new categories of data, or new purposes for processing — we will give at least 15 days’ notice by email or a prominent notice on the Site before the change takes effect.
• Continuing to use the Services after the effective date means you accept the updated Policy. If you do not, you may stop using the Services and request deletion of your data under Section 9.

16. Contact Us