How we handle your health data

We use your data to: compute food grades adjusted for your conditions, power the AI coach with relevant context, calculate your Vitaliq Score, surface medication-food interaction alerts, and generate health reports.

We do not use your health data for advertising targeting, profiling for third-party sale, or any purpose not described in this policy.

Affiliate links (Zepto, Blinkit, BigBasket, insurance, lab tests) are surfaced based on your scan results, not your demographic profile. We earn a commission when you transact — we have no financial interest in what you buy beyond that.

We share your data with: Neon PostgreSQL (our database provider), Upstash Redis (our cache provider), Cloudflare R2 (image storage), MSG91 (OTP delivery), Razorpay (payments), Firebase (push notifications), Meta (if you use our WhatsApp bot).

All providers are bound by data processing agreements. None of these providers receive your health profile — they receive only the minimum data required for the service they provide.

We do not sell your data. We do not share your data with food brands, insurers, or any third party for commercial use.

We may disclose data in response to a lawful order from an Indian court or government authority. We will notify you of any such order unless prohibited from doing so by law.

Scan history is retained for a minimum of 90 days. AI coach conversations are retained for a minimum of 1 year. Score and wellness data is retained for the lifetime of your account. Higher-tier plans extend these limits; Elite provides unlimited retention.

On account deletion, all personal data is permanently deleted within 30 days. Anonymised aggregate statistics (used for product grading and research) may be retained indefinitely.

Vitaliq is compliant with India's Digital Personal Data Protection Act 2023. We are a Data Fiduciary as defined under the Act.

Consent: We collect explicit consent for health data processing at the time you first enter a condition or medication. You can withdraw consent at any time from Settings → Privacy.

Data localisation: All personal health data is stored in India (Neon PostgreSQL, Asia-Pacific region).

Data Principal rights: You have the right to access, correct, and erase your data. See Section 6 for how to exercise these rights.

Grievance officer: For DPDP Act complaints, contact our Grievance Officer at privacy@vitaliq.co.in with the subject line "DPDP Grievance". We will acknowledge within 48 hours and resolve within 30 days.

You have the right to: access a copy of all data we hold about you, correct inaccurate data, delete your account and all associated data, export your data in machine-readable format, and withdraw consent for health data processing.

To exercise any of these rights, go to Settings → Privacy in the app, or email privacy@vitaliq.co.in.

We do not charge for data access requests. We respond within 30 days.

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Our API requires JWT authentication on every request. OTP codes expire in 10 minutes and are single-use.

We conduct periodic security reviews. We do not store payment card numbers — Razorpay handles all card processing in their PCI-DSS certified environment.

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of it, as required under DPDP Act 2023.

You can export all your Vitaliq data at any time from Settings → Privacy → Export my data. The export includes your scan history, AI coach conversations, score history, and health profile in JSON format.

Exports are generated within 24 hours and sent to your email or available for download in the app for 7 days.

For privacy questions, data requests, or complaints: