Privacy policy

1. About This Policy

This Privacy Policy describes how Hisvitals Private Limited (“Hisvitals”, “we”, “us”, or “our”) — the entity that operates both the HisVitals and HerVitals brands — collects, uses, discloses, retains, and protects your personal data when you:


  • visit or use our websites, including hisvitals.com and any associated domains or subdomains (the “Site”);
  • purchase our products, including supplement and wellness products sold online or through marketplace platforms such as Amazon, Flipkart, and Tata 1mg (the “Products”);
  • use our AI-powered wellness tool, which uses Ayurvedic principles and health inputs to generate personalised wellness recommendations (the “AI Tool”);
  • book a free consultation with our wellness experts through our website;
  • subscribe to our newsletter or promotional communications;
  • interact with us in any other way, including through customer support, social media, surveys, or research.


Together, the Site, Products, AI Tool, consultations, and all related features are referred to as the “Services.” The terms “you” or “your” refer to you as the user of the Services.


By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use or access the Services.


This Policy is also intended to serve as the required “Notice” under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India, informing you of the personal data we collect, the purposes for which it is processed, and your rights as a Data Principal.


2. Who We Are

Legal Entity: Hisvitals Private Limited

Brands Operated: HisVitals (hisvitals.com) and HerVitals

Registered Address: C/o Narayan Singh Rajput, AshokWard, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh, India – 461775

Contact Email: contact.hisvitals@gmail.com

Grievance Officer: [Name of Grievance Officer] — contact.hisvitals@gmail.com


We strongly recommend dedicating a separate email address (e.g., privacy@hisvitals.com) for all privacy-related requests, as required under the DPDP Act. Update this field before publishing.


3. Personal Data We Collect

The types of personal data we collect depend on how you interact with our Services. We only collect data that is necessary for the stated purpose.


3.1 Data You Provide Directly

  • Contact details: Contact details:

Name, email address, phone number, billing address, and shipping address, provided when you create an account, place an order, or contact us.


  • Account information: Account information:

Username, password, security questions, and profile preferences.


  • Order and transaction data: Order and transaction data:

Products purchased, order history, payment status, return and refund requests, and preferences such as loyalty points, referrals, gift cards, and product reviews.


  • Customer support data: Customer support data:

Information you include in communications with us via email, WhatsApp, contact forms, or other channels, including complaints, feedback, and queries.


3.2 Health, Wellness & AI Tool Data

Our AI-powered wellness tool collects health-related inputs to generate personalised recommendations. This data is treated as sensitive personal data under the DPDP Act and will only be processed with your explicit consent. This includes:


  • Age or date of birth
  • Health conditions, symptoms, or medical history that you choose to disclose
  • Lifestyle inputs such as sleep patterns, stress levels, dietary habits, and exercise routines
  • Wellness goals such as weight management, stamina improvement, energy levels, or reproductive health


You are not required to provide health data to use our website or purchase Products. Providing this data is voluntary and only needed to use the AI Tool or participate in consultations.


3.3 Free Consultation Data

When you book a free consultation with our wellness experts, we collect:


  • Your name, phone number, and email address (for scheduling and follow-up)
  • Health concerns or goals you choose to share before or during the consultation


Consultation booking may be facilitated through third-party scheduling tools (such as Calendly or Google Forms). Please review the respective privacy policies of those platforms.


3.4 Payment Data

Payments are processed through our third-party payment gateway partners: Razorpay, PayU, Cashfree, and Stripe, depending on your chosen payment method. We also accept Cash on Delivery (COD). We do not store your full card number, CVV, or bank account credentials. We retain only masked payment identifiers, transaction IDs, and billing addresses as needed for order fulfilment and accounting.


3.5 Usage & Technical Data

When you use our Site or Services, we automatically collect:


  • Device and browser information: device type, operating system, browser type and version, screen resolution, language settings
  • Network data: IP address, approximate geographic location (derived from IP), internet service provider
  • Usage data: pages visited, time spent on pages, links clicked, referral URLs, search queries on site, cart interactions, and session duration
  • Cookies and tracking data: as described in Section 5 below


3.6 Newsletter & Marketing Data

If you subscribe to our newsletter or promotional communications, we collect your email address and, where applicable, your communication preferences. You can unsubscribe at any time.


3.7 User-Generated Content

If you submit a product review, rating, or testimonial on our Site or any marketplace platform, this content may be publicly visible. Do not include sensitive personal information in public reviews.


4. How We Use Your Personal Data

We use your personal data for the following purposes, each grounded in a lawful basis under the DPDP Act:


4.1 Order Fulfilment & Service Delivery

  • Process and fulfil your orders, including packaging and shipping
  • Send order confirmations, shipment tracking, and delivery notifications
  • Handle returns, refunds, and exchanges
  • Create and maintain your account
  • Provide post-purchase customer support


Legal basis: Performance of contract with you.


4.2 AI Tool & Personalised Wellness Recommendations

  • Analyse the health and lifestyle inputs you provide to generate personalised wellness recommendations, product suggestions, or guidance
  • Improve the AI Tool's accuracy and relevance over time using aggregated, anonymised insights


Legal basis: Your explicit consent, which you may withdraw at any time (see Section 9).


4.3 Consultation Management

  • Schedule and manage your free consultation appointments
  • Allow our wellness experts to prepare relevant guidance based on your stated goals or concerns
  • Follow up on consultations where you have requested it


Legal basis: Your consent and performance of the service you requested.


4.4 Marketing & Communications

  • Send promotional emails, SMS, or WhatsApp messages about our Products, offers, new launches, and wellness content, where you have consented or have an existing customer relationship
  • Personalise marketing content shown to you on our Site or on third-party platforms based on your browsing and purchase behaviour
  • Run targeted advertising campaigns on Meta (Facebook/Instagram) and Google, including Custom Audience and lookalike targeting


Legal basis: Your consent for direct marketing communications. You may opt out at any time by using the unsubscribe link in emails, replying STOP to SMS/WhatsApp, or contacting us directly.


4.5 Analytics & Service Improvement

  • Measure Site performance and user behaviour using Google Analytics and Meta Pixel
  • Understand which products, pages, and features are most useful
  • Conduct internal research to improve our Products and Services
  • Generate aggregated, anonymised reports that do not identify any individual


Legal basis: Legitimate interests in improving and operating our Services.


4.6 Legal, Compliance & Security

  • Detect, investigate, and prevent fraudulent transactions, account abuse, or illegal activity
  • Comply with applicable laws, including the DPDP Act, FSSAI regulations, GST obligations, and any other regulatory requirements
  • Respond to lawful requests from government or regulatory authorities
  • Enforce our Terms of Service and other policies


Legal basis: Legal obligation and legitimate interests in protecting our business and users.


5. Cookies & Tracking Technologies

We use cookies, pixels, web beacons, and similar technologies on our Site. Here is a plain-language breakdown of what we use and why:


5.1 Essential Cookies

Required for the Site to function. These include Shopify’s session cookies that remember your cart, login status, and basic preferences. You cannot opt out of these without breaking the Site.


5.2 Analytics Cookies

Google Analytics places cookies to help us understand how visitors interact with our Site — which pages are visited, how long sessions last, and where users drop off. This data is aggregated and does not identify you personally. You can opt out via the Google Analytics Opt-Out Browser Add-On.


5.3 Advertising & Remarketing Cookies

Meta Pixel and Google Ads tags are active on our Site. These technologies track whether you visited our Site after seeing one of our ads, and help us build Custom Audiences to show relevant ads to people with similar profiles. If you prefer not to be tracked for advertising purposes, you can:


  • Opt out via Meta Ad Preferences at facebook.com/ads/preferences
  • Opt out via Google’s My Ad Center at myadcenter.google.com
  • Use a browser extension such as uBlock Origin or Privacy Badger
  • Enable “Do Not Track” in your browser settings (note: this is not universally honoured)


5.4 WhatsApp Business API

We use WhatsApp Business API to send transactional messages (order updates, support replies) and, where you have consented, promotional messages. If you contact us via WhatsApp, your number and message content are accessible to us and to our WhatsApp Business Solution Provider. You may opt out of promotional WhatsApp messages by replying STOP.


5.5 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Site, including your ability to complete purchases. For Shopify-specific cookies, see shopify.com/legal/cookies.


6. How We Share Your Personal Data

We do not sell your personal data. We share data only in the following circumstances:


6.1 Service Providers & Vendors

We engage trusted third-party service providers who process data on our behalf and are bound by confidentiality and data processing obligations:


  • E-commerce infrastructure: Shopify (website and store hosting)
  • Payment processing: Razorpay, PayU, Cashfree, Stripe (payment gateway services)
  • Shipping & logistics: third-party courier and fulfilment partners
  • Marketing & advertising: Meta (Facebook/Instagram), Google Ads
  • Analytics: Google Analytics
  • Communication: WhatsApp Business API provider
  • Consultation scheduling: Calendly, Google Forms, or similar tools
  • Cloud storage and IT infrastructure: as used to operate our backend systems


6.2 Healthcare & Wellness Partners

If you participate in a consultation or any future integrated wellness program, we may share relevant health information you have provided with the wellness expert or professional assigned to your consultation. Such sharing is limited to the minimum information necessary and is done with your knowledge at the time of booking.


6.3 Group Entities & Affiliates

As HisVitals and HerVitals operate under the same legal entity (Hisvitals Private Limited), data collected across both brands may be used for integrated operations, cross-brand marketing (where you have consented), and internal analysis.


6.4 Marketplace Platforms

If you purchase our Products through Amazon, Flipkart, Tata 1mg, or other marketplace platforms, those platforms collect and process your data independently under their own privacy policies. We may receive limited order-related data from these platforms to handle returns, refunds, or support queries.


6.5 Legal & Regulatory Disclosure

We may disclose your data to government authorities, courts, law enforcement agencies, or regulators when required by law or when we believe in good faith that disclosure is necessary to protect rights, prevent fraud, or comply with a legal obligation.


6.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections and notice to you where required by law.


7. International Data Transfers

Our service providers (including Shopify, Google, Meta, Razorpay, Stripe, and Calendly) may store or process your data on servers located outside India. Where such transfers occur, we ensure appropriate contractual safeguards are in place, consistent with the requirements of the DPDP Act and any restrictions that may be notified by the Central Government of India regarding cross-border data transfers.


If you have concerns about where your data is stored, please contact us using the details in Section 11.


8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Our general retention approach is:


  • Account and profile data: retained for as long as your account is active. If your account is deleted, we retain minimal data for up to 3 years for fraud prevention and legal compliance purposes.
  • Order and transaction data: retained for 7 years from the date of transaction, consistent with GST and accounting obligations under Indian law.
  • Health and wellness data from the AI Tool: retained for as long as your account is active. Upon account deletion or withdrawal of consent, this data is deleted or irreversibly anonymised within 30 days, subject to any legal obligations.
  • Consultation records: retained for 2 years from the date of consultation, unless you request earlier deletion.
  • Marketing and communication preferences: retained until you unsubscribe or withdraw consent, after which we retain a suppression record to ensure we do not contact you again.
  • Usage and analytics data: aggregated and anonymised data may be retained indefinitely for research purposes.


When retention periods expire, data is securely deleted or anonymised. Anonymised data that cannot be linked back to any individual is not subject to this Policy.


9. Your Rights as a Data Principal

Under the DPDP Act, 2023, and other applicable law, you have the following rights in relation to your personal data. You may exercise these rights by contacting us at the details provided in Section 11.


  • Right to Access: You may request a summary of the personal data we hold about you and how it is being used.
  • Right to Correction: You may request that inaccurate or incomplete personal data be corrected or updated.
  • Right to Erasure: You may request deletion of your personal data. We will comply unless we are required to retain it by law or for a legitimate legal purpose.
  • Right to Grievance Redressal: You may raise a complaint or grievance about how we handle your data. We will respond within 30 days (see Section 10).
  • Right to Nominate: You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
  • Right to Withdraw Consent: Where processing is based on your consent (including for the AI Tool or marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
  • Right to Opt Out of Marketing: You may opt out of promotional emails by clicking “Unsubscribe” in any email, or of WhatsApp/SMS by replying STOP. Non-promotional communications (order updates, account notices) will continue.


We may need to verify your identity before fulfilling certain requests. We will not discriminate against you for exercising any of these rights. Response times are subject to applicable law, and in complex cases, we may request an extension of up to 30 additional days.


10. Grievance Officer

As required under the DPDP Act, 2023, we have designated a Grievance Officer to address privacy-related complaints:


Name: [Insert Name of Grievance Officer]

Designation: Grievance Officer – Data Protection

Email: contact.hisvitals@gmail.com

Address: Hisvitals Private Limited, C/o Narayan Singh Rajput, AshokWard, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh, India – 461775

Response Time: We will acknowledge your complaint within 48 hours and resolve it within 30 days.


If you are not satisfied with the resolution provided by our Grievance Officer, you may escalate your complaint to the Data Protection Board of India once it is constituted and operational under the DPDP Act.


11. Children & Minors

Our Services are intended exclusively for individuals aged 18 years and above. We do not knowingly collect personal data from anyone under the age of 18. Under the DPDP Act, processing of personal data of children requires verifiable parental consent, and we have chosen not to offer our Services to minors at this time.


If you believe that a person under 18 has provided us with their personal data, please contact us immediately at contact.hisvitals@gmail.com. We will take prompt steps to delete such data.


12. Data Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration, or destruction. These include:


  • Encryption of data in transit using HTTPS/TLS across all Site interactions
  • Access controls and role-based permissions so that only authorised personnel access personal data on a need-to-know basis
  • Secure payment processing through PCI-DSS compliant payment gateways (Razorpay, PayU, Cashfree, Stripe) — we never handle raw card data directly
  • Shopify’s enterprise-grade security infrastructure for our store
  • Periodic review of our data handling practices


No security system is completely impenetrable. We cannot guarantee absolute security of your data. We encourage you to use strong passwords, keep your login credentials confidential, and notify us immediately if you suspect unauthorised access to your account.


13. Third-Party Websites & Links

Our Site may contain links to third-party websites, marketplace listings, social media platforms, or payment portals. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any external sites before providing your personal data. We are not responsible for the privacy practices or content of third-party sites.


14. Future Services & Expanding Scope

Hisvitals Private Limited is actively developing new Services, including but not limited to:


  • HerVitals — a women’s nutrition and wellness brand operated under the same legal entity
  • Anti-obesity and metabolic health supplement lines
  • Advanced AI wellness features and expanded health tracking capabilities


As new Services launch, we will update this Privacy Policy to reflect any new categories of data collected or processed. Material updates will be communicated as described in Section 15.


15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, business practices, or applicable law. When we make changes:


  • The “Last Updated” date at the top of this Policy will be revised
  • For material changes (such as new categories of data being collected or new purposes for processing), we will provide advance notice via email or a prominent notice on our Site at least 15 days before the change takes effect
  • Your continued use of the Services after the effective date constitutes your acceptance of the updated Policy


If you do not accept the changes, you may discontinue use of the Services and request deletion of your data as described in Section 9.


16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:


Email: contact.hisvitals@gmail.com

Postal Address: Hisvitals Private Limited, C/o Narayan Singh Rajput, AshokWard, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh, India – 461775


We recommend designating a dedicated privacy email (e.g., privacy@hisvitals.com) to handle data requests efficiently and demonstrate DPDP compliance. Update this before publishing.


Legal Disclaimer

This document has been drafted for operational planning purposes and reflects the information provided by Hisvitals Private Limited. It does not constitute legal advice. Before publishing, this policy should be reviewed by qualified legal counsel familiar with the DPDP Act 2023, FSSAI regulations, and applicable consumer protection laws in India.