Privacy Policy

Last updated: 29 August 2026

1. About This Policy

This Privacy Policy explains how Hisvitals Private Limited collects, uses, shares, retains, and protects personal data.

It applies when you visit hisvitals.com, purchase blood testing services, use the Circle app, subscribe to newsletters, or contact support through various channels.

The policy serves as notice under the Digital Personal Data Protection Act, 2023, detailing what data is collected, why it’s processed, and your rights as a Data Principal.

2. Who We Are

Legal entity: Hisvitals Private Limited
CIN: U86900MP2023PTC068850
Registered office: C/o Narayan Singh Rajput, Ashok Ward, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh – 461775, India
Correspondence address: B-901, Maxblis White House, Sector 75, Noida, Dist. Gautam Buddha Nagar, Uttar Pradesh – 201301, India
Privacy contact: [email protected]
Grievance Officer: Tushar Rokade, Co-Founder

The company functions as the Data Fiduciary for described personal information.

3. Personal Data We Collect

3.1 Contact and account data

Name, email, phone number, billing/shipping address, account credentials, and profile preferences.

3.2 Order and transaction data

Programme purchased, order history, payment status, and refund/cancellation requests.

3.3 Health assessment inputs

Age, gender, height, weight, BMI, health goals, symptoms, lifestyle information, and medical history. Providing health data is voluntary and only required to use the Programme or app features.

3.4 Blood sample and diagnostic data

Home collection arranged through our laboratory partner; test reports with biomarker values received and stored. Physical sample custody is never held by HisVitals.

3.5 Consultation and coaching data

Doctor consultation notes, diet/workout plans, supplement recommendations, and health coach check-ins including self-reported meals, sleep, water intake, activity, and weight.

3.6 Circle app data

Workout logs, meal photographs for AI nutrition analysis, uploaded blood reports, step count from Apple Health (where permitted), and account identifiers.

3.7 Apple Health data

Step count only is read when permission is granted. This data is never used for advertising or marketing, never sold, and never shared with advertising platforms.

Visibility is limited to you and your assigned coach. Access is revocable via iOS Settings.

3.8 Usage and technical data

Device type, browser, OS, IP address, approximate location, pages visited, referral URLs, session duration, cart interactions, and cookie data.

4. How We Use Your Data, and On What Basis

Processing relies on consent or the legitimate uses recognised in Section 7 of the DPDP Act.

4.1 Delivering the Programme

Scheduling collection, instructing laboratory testing, analysing reports, preparing consultations, and providing coaching support. Basis: consent and service performance.

4.2 Health data processing

Analysing blood reports and health inputs to identify findings and personalise plans. Basis: explicit consent, withdrawable anytime.

4.3 Operating the Circle app

Generating plans, analysing meal photographs, parsing reports, tracking progress, and enabling coach support. Basis: consent.

4.4 Orders and payments

Processing payments, issuing invoices, handling refunds, and maintaining accounting records. Basis: service performance and legal compliance.

4.5 Support and service communication

Responding to queries and sending appointment reminders, report notifications, and transactional messages. Basis: consent and service performance.

4.6 Marketing

Sending promotional communications and measuring advertising performance. Marketing is based on non-health data only – blood results, health inputs, and app data do not target advertising. Basis: consent; opt-out available anytime.

4.7 Legal and security

Detecting fraud, complying with regulations, responding to lawful authority requests, and enforcing Terms. Basis: legal obligation.

5. Cookies, Tracking, and Advertising Measurement

5.1 Essential cookies and storage

This site does not require an account and does not maintain a shopping cart, so no login or cart cookies are set. Where you arrive from an advertisement, the click identifier in the link is held in your browser’s session storage for the duration of that tab session so an enquiry can be attributed to the advertisement that led to it.

5.2 Analytics

No separate third-party analytics platform, such as Google Analytics, is operated on this site. Aggregate traffic information is derived from server logs and from the advertising tags described below.

5.3 Advertising measurement

Meta Pixel with Conversions API and Google Ads tag determine whether visits or purchases followed an advertisement. Limited data sent includes conversion events and hashed identifiers. These identifiers are also used to build and suppress advertising audiences, as described in section 6.8.

We do not send health data to advertising platforms. Blood results, biomarkers, BMI, health answers, consultation notes, or app data are never transmitted to Meta, Google, or advertising services.

Tracking can be limited through Meta Ad Preferences, Google My Ad Center, browser settings, or content blockers.

5.4 WhatsApp

WhatsApp Business sends transactional and promotional messages. Your number and message content are accessible to HisVitals and Zepic (our solution provider). Reply STOP to opt out of promotional messages.

6. How We Share Your Data

We do not sell your personal data.

6.1 Laboratory partner

Thyrocare Technologies Limited collects blood samples and performs diagnostic tests. It receives name, contact details, address, age, gender, and the test panel ordered.

Thyrocare stores and processes data under its own privacy policy at thyrocare.com, which indicates possible use for quality checks, teaching, reference ranges, and cloud storage via AWS/Google Cloud.

HisVitals does not take physical custody of samples; retention and disposal are governed by Thyrocare’s own procedures.

6.2 Our medical and coaching team

Blood reports, health inputs, and consultation notes are accessible to your assigned doctor and health coach on a need-to-know basis.

All doctors and coaches with access to your health data are employees of HisVitals, bound by confidentiality. Independent trainers cannot access health data.

6.3 AI processing providers

Meal photographs are sent to Google (Gemini API, paid tier) for food identification and nutritional estimation. Uploaded reports are sent to OpenAI to convert them into readable insights.

Paid, commercial API tiers are used; data is not used to train models. Outputs remain on HisVitals servers.

6.4 Operational service providers

Razorpay (payment), Zepic (WhatsApp), Resend (transactional and notification email), DigitalOcean (cloud hosting), and Apple (App Store). Each is bound to process data only per our instructions with appropriate protection.

6.5 Legal disclosure

Data is disclosed to courts, regulators, or law enforcement where legally required or necessary to prevent fraud or protect rights and safety.

6.6 Business transfers

If HisVitals merges, is acquired, or sells assets, personal data may transfer subject to confidentiality protections and notice where required.

6.7 What we never do

Blood results, health assessment data, consultation notes, or app health data are never shared with insurance companies, employers, advertising platforms, data brokers, or commercial profiling entities.

6.8 Advertising platforms

We share limited contact data – email address and phone number, hashed before transmission – with Google (Google Ads, including Customer Match) and Meta, to measure advertising performance and to build and suppress advertising audiences. These platforms act as processors on our behalf under their respective data processing terms.

Blood results, biomarkers, health assessment answers, consultation notes, and app data are never shared with these platforms. To opt out, contact [email protected], or use Google My Ad Center and Meta Ad Preferences.

7. Cross-Border Transfers

Providers including Google, OpenAI, Apple, DigitalOcean, Resend, and Zepic may store or process data outside India. Razorpay processes payment data within India.

Contractual safeguards consistent with the DPDP Act and Central Government restrictions are applied.

Contact [email protected] for data location questions.

8. How Long We Keep Your Data

• Blood test reports/biomarker data: 3 years from test date
• Consultation notes/health plans: 3 years from consultation date
• Health assessment inputs: 3 years or until consent withdrawn
• Circle app data: while account active
• Apple Health step data: while account active with permission granted
• Account/profile data: while account active
• Order/invoice/payment records: 8 years from financial year end (Companies Act, GST requirement)
• Marketing preferences: until consent withdrawn; suppression record maintained
• Aggregated, anonymised analytics: indefinitely

Account deletion or consent withdrawal results in deletion or irreversible anonymisation within 30 days, except where retention is legally required.

9. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• Access – obtain a summary of held personal data and its processing
• Correction – have inaccurate or incomplete data corrected or completed
• Erasure – request deletion unless legally required retention applies
• Withdraw consent – anytime, as easily as given. Withdrawing health data consent means Programme/app features become unavailable
• Nominate – appoint a representative to exercise your rights upon death or incapacity
• Grievance redressal – raise a complaint about how your data is handled

Exercise your rights by emailing [email protected]. Identity verification may be required. Response within 30 days.

In-app account deletion, available in Circle, removes app data per the Section 8 retention guidelines.

Marketing opt-out: use the unsubscribe link in an email, reply STOP to SMS/WhatsApp, or email [email protected]. Transactional order, appointment, and report messages continue.

10. Grievance Officer

Name: Tushar Rokade
Designation: Co-Founder and Grievance Officer
Email: [email protected]
Address: Hisvitals Private Limited, B-901, Maxblis White House, Sector 75, Noida, Dist. Gautam Buddha Nagar, Uttar Pradesh – 201301, India

Acknowledgement within 48 hours; resolution within 30 days. Unsatisfied parties may escalate to the Data Protection Board of India.

11. Children

Our services are intended for individuals 18 and above. We do not knowingly collect personal data from anyone under 18.

Verifiable parental consent is required under the DPDP Act; services are not offered to minors.

Contact [email protected] if under-18 data provision is suspected, for prompt deletion.

12. Security

Data protection through:

• HTTPS/TLS encryption in transit across the Site and App
• Role-based access controls limiting doctor/coach visibility to assigned users
• PCI-DSS compliant payment gateways; raw card data is never handled by us
• Confidentiality obligations binding employees with health data access
• Periodic review of data handling practices

No system is perfectly secure. Suspected unauthorised account access should be reported immediately to [email protected].

Personal data breaches trigger notification to the Data Protection Board of India and affected Data Principals per DPDP Act requirements.

13. Third-Party Links

The Site and App link to third-party websites and services not covered by this policy. Review third-party privacy policies before providing personal data to them.

14. Medical Disclaimer

Our services – blood report analysis, AI insights, diet/workout plans, supplement recommendations – support health decisions but do not replace independent medical advice, diagnosis, or treatment.

Supplement recommendations are suggestions only. HisVitals does not sell supplements; where you purchase them from, or whether you purchase them at all, is your choice.

Always consult qualified medical practitioners about medical conditions; never disregard professional advice based on information from our services.

15. Changes to This Policy

Policy updates reflect service changes or legal requirements. The “Last updated” date changes with updates.

Material changes (new data categories or processing purposes) receive at least 15 days’ notice via email or a prominent Site notice before taking effect.

Continued use of our services after the effective date indicates acceptance of the policy. If you don’t accept, you may discontinue use and request data deletion per Section 9.

16. Contact Us

Privacy and data protection: [email protected]
General enquiries: [email protected]
WhatsApp: +91 74772 29903
Postal: Hisvitals Private Limited, B-901, Maxblis White House, Sector 75, Noida, Dist. Gautam Buddha Nagar, Uttar Pradesh – 201301, India
Registered office: C/o Narayan Singh Rajput, Ashok Ward, Opp. PPS School, Piparia, Hoshangabad, Pipariya, Madhya Pradesh – 461775, India
CIN: U86900MP2023PTC068850