Effective date: 30 July 2026
This Privacy Policy explains how ZYVAA AI (“ZYVAA”, “we”, “us”) collects, uses, stores, shares and deletes information when you use the ZYVAA AI mobile and web application — an AI-powered Personal Health Intelligence platform that reads your health reports, analyses the food you eat, and turns both into personalised, explained guidance.
ZYVAA is operated from India and is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian IT rules. By creating an account you consent to the processing described below.
1. Information we collect
a. Account data. Email address, password hash (managed by Firebase Authentication — we never see or store your plaintext password), display name, profile photo if you upload one, email-verification state and sign-in timestamps.
b. Health profile. Name, age, sex, height, weight, health goals, medical conditions or health stages you select or confirm, dietary preferences, and your chosen interface language (English, Hindi or Hinglish).
c. Health reports and biomarkers. Blood-test and other lab report files (PDF or image) that you upload, plus the biomarker values, units, reference ranges and report dates that ZYVAA extracts from those documents using AI, along with the trends we compute across successive reports.
d. Food and product scans. Photographs of meals and nutrition labels you capture, packaged-product identifiers you scan or enter, the ingredient and nutrition breakdown derived from them, the compatibility score ZYVAA assigns against your health profile, and whether you marked an item as eaten or skipped.
e. AI-generated content and health memory. Daily Health Briefs, “what ZYVAA learned” entries, health-target records, coaching conversations with the ZYVAA assistant, doctor-report exports, and the persistent “health memory” we build from your activity so guidance stays contextual over time.
f. Payment data. If you subscribe to ZYVAA Pro, our payment gateway Razorpay Software Private Limited processes your card, UPI, netbanking or wallet details. ZYVAA never receives or stores your full card number, CVV, UPI PIN or bank credentials. We store only the Razorpay subscription ID, payment ID, invoice ID, amount, currency, payment status, method type and billing dates.
g. Technical data. Device and browser type, app version, crash and error logs, and coarse usage events needed to keep the service reliable. ZYVAA does not run third-party advertising or cross-site tracking pixels.
2. How we use your information
We use your data solely to operate ZYVAA: to build and maintain your health profile and health memory; to extract biomarkers from uploaded reports and chart their trends; to score food and packaged products for compatibility with your conditions and goals; to generate daily briefs, insights, lifestyle suggestions and doctor-ready report exports; to power the ZYVAA AI coach in your chosen language; to process subscription payments and provide support; and to detect abuse and secure the platform.
We do not sell, rent or trade your personal or health data. We do not use your health data for advertising or for profiling unrelated to your own health guidance.
3. AI processing and third-party sub-processors
Generating insights requires sending relevant health context — for example biomarker values, recent meals, your goals and conditions — to our AI model provider (Google Gemini, accessed through the Lovable AI Gateway). These requests are transient: content is processed to return a response and is not used by us or by the model provider to train foundation models. Uploaded report files and food photos may be sent to the same provider for optical extraction and image analysis.
Our sub-processors are:
• Google Firebase (Authentication, Cloud Firestore, Cloud Storage) — account, health data and file storage.
• Google Gemini via Lovable AI Gateway — AI extraction, scoring, briefs and coaching.
• Razorpay — subscription billing and payment processing.
• Cloudflare / Lovable hosting — application delivery and serverless backend execution.
Firebase Analytics. We use Firebase Analytics to understand how the app is used — which screens and features people interact with, and app performance and stability. This never includes your health data: no biomarker values, meal contents, chat messages, or report contents are ever collected. Analytics data is anonymized and aggregated.
We share data with these providers only to the extent required to deliver the feature you requested. We may also disclose data where legally compelled by a valid Indian court order or statutory demand.
4. Storage, location and security
Your data is stored in Google Firebase infrastructure. Access is enforced by per-user Firestore security rules and per-user Storage paths, so records are readable only by the signed-in account that created them. Subscription and payment records are write-protected and can only be modified by our verified backend after a signature-verified Razorpay event. All traffic is encrypted in transit (TLS) and at rest by the storage provider. Backend credentials are held as encrypted server-side secrets and are never shipped to the app.
No system is perfectly secure. If a breach affecting your personal data occurs, we will notify affected users and the relevant authority as required by the DPDP Act.
5. Data retention
We retain your health profile, reports, biomarkers, scans and health memory for as long as your account is active, because ZYVAA’s value depends on longitudinal history. Items you archive remain retrievable until you delete them. Deleted reports, scans and biomarkers are removed from live systems immediately and purged from encrypted backups within 30 days.
When you delete your account, all health data, files and AI-generated records are permanently deleted. Payment and invoice records are retained for up to eight (8) financial years in a minimised form (amount, date, payment ID, tax fields) because Indian tax and accounting law requires it.
6. Your rights
You can, at any time from within the app: access and correct your profile and health data; export a complete JSON copy of every record we hold about you; archive or permanently delete individual reports, biomarkers and scans; withdraw consent by deleting your account, which erases all associated health data irreversibly; and manage or cancel your subscription. To raise a grievance or a data-principal request that the app cannot handle, use the in-app Feedback screen; we respond within 30 days. If you don’t have the app installed, you can request deletion at zyvaai.in/delete-account.
7. Children
ZYVAA is intended for individuals aged 18 and above. We do not knowingly collect data from children. If we learn that a minor has created an account, we will delete it and its data.
8. Not medical advice
ZYVAA is an educational personal-health intelligence tool. It is not a medical device, does not provide diagnosis or treatment, and does not replace consultation with a qualified healthcare professional. See the medical disclaimer in our Terms & Conditions.
9. Changes to this policy
We may update this policy as the product evolves. Material changes will be announced in the app before they take effect, and the effective date above will be revised. Continued use after a change constitutes acceptance.
10. Contact
For privacy questions, data requests or grievances, use the in-app Feedback screen or email us at zyyvaa.ai@gmail.com. Our grievance officer responds to verified requests within the statutory timeline.