Privacy Policy
Last Updated: July 8, 2026 • Version 2.0
1Introduction
Welcome to Vytafix (“we”, “us”, or “our”), a digital health intelligence platform. We are committed to safeguarding your personal data in strict compliance with the **Digital Personal Data Protection Act 2023 (DPDP Act)** of India.
As a **Data Fiduciary**, we determine the purposes and means of processing the personal data of our users (referred to as **Data Principals** under the DPDP Act). This Privacy Policy transparently explains what data we collect, how it is used, stored, and shared, and how you can exercise your statutory rights over your personal data.
2Consent Management
Under the DPDP Act, all collection and processing of personal data is based on your explicit, specific, granular, and freely given consent.
Consent Safeguards
- No Pre-ticked Boxes: We never use pre-checked checkboxes during onboarding or usage. Consent must be an active, affirmative action.
- Granular Consents: We request separate consent for distinct tasks (e.g., separate consents for lab report upload, WhatsApp reminders, and family profile creation).
- Easy Withdrawal: You can revoke your consent at any time. A single-click consent withdrawal is available in your account Settings under “Privacy & Data”.
3Personal Data We Collect
We only collect personal data that is strictly necessary for providing Vytafix services. This includes:
| Data Category | Specific Data Fields | Purpose |
|---|---|---|
| Account Credentials | Mobile number, OTP credentials. | Secure authentication & registration. |
| Profile Information | First name, last name, email address. | Personalizing your health dashboard and sending communications. |
| Health Data (Sensitive) | Blood test reports (PDFs/Images) and extracted biomarkers (e.g. cholesterol, HbA1c). | AI extraction and health trend tracking over time. |
| Family Profiles | Names, age/gender, and health data of family members. | Managing health reports for dependants (subject to active permissions). |
| Communication Info | WhatsApp contact number, notification status logs. | Sending reminders for health tests and updates. |
| Technical Identifiers | IP address, device ID, cookies, and app usage logs. | Security, service performance monitoring, and analytics. |
4Purpose & How We Use Data
We process your personal data for the following specific purposes:
AI-Powered Lab Report Extraction
We use AI models to extract blood markers from uploaded reports so you can track trends. You can choose whether we store the original report image or delete it after data extraction.
WhatsApp Health Reminders
With your explicit consent, we send reminders for upcoming tests. We only store delivery statuses (delivered/not delivered) — never the message content.
Family Profiles Management
Enables you to act as a fiduciary representant for family members, provided you warrant that you have obtained their explicit permission beforehand.
Security & Integrity
IP address and session logging are used to prevent unauthorized access, rate-limit authentication queries, and audit access controls.
5Data Processors & Transfers
To run our platform, we engage third-party **Data Processors**. All cross-border transfers are to countries permitted by the Central Government of India, protected by **Data Processing Agreements (DPAs)**:
- Hosting & AuthFirebase (Google LLC, USA) & Supabase (USA): Secure hosting, authentication, database storage, and file storage.
- DeploymentVercel (USA) & AWS (USA): Application deployment infrastructure and static resource caching.
- PaymentsStripe (USA) & Razorpay (India): Payment processing gateways.
- NotificationsTwilio (USA / WhatsApp API): Gateway for sending secure notifications and alerts.
6Your Rights (DPDP Act)
As a Data Principal, you have the following enforceable statutory rights:
Right to Information
Get a summary of your collected personal data, categories shared, and retention logic.
Right to Correction
Update, edit, or correct your name, email, or mobile number self-serve via settings.
Right to Erasure
Delete your account and associated reports at any time. Cleared across all data processors within 30 days.
Right to Nominate
Nominate another individual to exercise your data rights in the event of death or incapacity.
7Children's Data (Under 18)
Vytafix does not target or knowingly collect data from children under the age of 18 without verifiable parental or legal guardian consent.
- We perform age validation during sign up.
- We conduct Zero behavioral tracking or session recordings on identified children.
- We show no targeted advertisements of any kind to minors.
8Data Retention & SLA
We store your personal data only as long as your account remains active or as required to fulfill the stated purposes.
- Report Deletion: You can delete any lab report at any time from your dashboard.
- Original Report Images: In settings, you can choose whether we keep the original report image for viewing/downloading or delete it immediately after extracting biomarker values.
- Deletion SLA: Once you trigger an account deletion request, your primary profile and all associated health reports, including family member profiles managed by you, will be permanently deleted across all databases and third-party integrations within 30 days of request.
9Grievance Redressal
If you have any questions, concerns, or complaints regarding your privacy, consent withdrawal, or data rights, please contact our designated Grievance Officer:
Name: Ravi Shankar
Designation: Data Protection Officer & Co-Founder
Address: Vytafix Technologies, Bangalore, Karnataka, India
Email: grievance@vytafix.com
Under the DPDP Act, we will acknowledge your grievance immediately and resolve it within a statutory period of 30 days.