Privacy Policy

Diet2Fit Pvt. Ltd. · Version 1.0 · Effective 13 May 2026

Diet2Fit Pvt. Ltd. ("Diet2Fit", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect about you when you use the Diet2Fit mobile application (the "App") and related services (collectively, the "Service"), how we use and share it, how long we keep it, and the rights you have over it. This Policy should be read together with our Terms & Conditions and forms part of those Terms.

At a glance We collect the profile, logging, and feedback data you give us; we use it to generate personalised recommendations and operate the Service; we store it in AWS Mumbai (India); we do not sell it; you can access, correct, or delete it at any time by writing to contact@diet2fit.com.

1. Who We Are & Scope of this Policy

Diet2Fit Pvt. Ltd. is a company incorporated under the Companies Act, 2013 (contact: contact@diet2fit.com). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable laws, Diet2Fit is the Data Fiduciary (controller) in respect of the personal data described in this Policy.

This Policy applies to all personal data that you provide to us or that we collect about you when you use the App. It does not apply to data collected by third-party services that the App integrates with — those providers operate under their own privacy policies (see Section 5).

2. Data We Collect

We collect the following categories of personal data:

Category	Examples	Sensitive?
Identity & account	Full name, mobile number (for OTP login), age, gender, country, optional address	No
Health & lifestyle profile	Height, weight, BMI, fitness goal, diet preference (VEG / NON_VEG / EGG), activity level	Yes — health-related
Photos	Profile picture (avatar) you choose to upload	Potentially identifying
Activity logs	Meals consumed, workouts and sequences completed, cardio sensor data (steps, distance, cadence, calorie-burn estimates, perceived-exertion ratings), supplement / medicine intake, water consumption, weight measurements over time	Yes — health-related
Feedback	Messages you submit through the in-app Feedback option, and screenshots you choose to attach (these may incidentally include other parts of the App that were on screen)	Depends on content
Subscription & payment	Plan tier, billing cycle, transaction reference IDs from Razorpay. We do not store your full card number, CVV, or UPI PIN — Razorpay handles those directly.	No (we don't see the card data)
Device & technical	Device identifier (used for OTP session binding), platform (Android / iOS), app version, IP address visible to the backend during API calls, basic crash diagnostics	No

Some data is essential — without it the App cannot work (e.g., your age, weight, and goal are needed to calculate calorie targets). Other data is optional and you can use the App without providing it (e.g., the profile picture).

3. How We Collect It

Directly from you — during signup, profile setup, daily logging, feedback submission, and avatar upload.
Automatically — when you use the App, your device sends us API requests that include device identifier, IP address, and timestamps. Cardio sensor readings (steps, cadence) are gathered by the App from your device's motion sensors and sent to our servers only when you finish a workout.
From third parties — payment confirmation events from Razorpay; push notification delivery receipts from Firebase Cloud Messaging.

4. Why We Use It (Purposes & Legal Basis)

We process your personal data only where we have a lawful basis to do so. The table below summarises our purposes and bases under the DPDP Act and other applicable law.

Purpose	Data used	Legal basis
Authenticate you and operate your account	Mobile number, OTP, device identifier	Contract / consent
Generate personalised meal, workout, and nutrition recommendations	Profile (age, weight, height, diet pref, goal, activity), logging history	Contract
Provide the reminder, logging, and progress-tracking features	Activity logs, supplement schedule, water schedule, weight history	Contract
Process subscription payments	Payment instrument tokens (handled by Razorpay), plan choice	Contract
Investigate and respond to feedback / bug reports	Feedback messages, screenshots, account context	Consent + legitimate interest
Send service notifications (e.g., water reminder, supplement reminder)	FCM device token, reminder schedules	Consent (you enable reminders) / contract
Improve the Service via aggregate, anonymised analytics	Logging trends with personal identifiers removed	Legitimate interest
Comply with legal obligations (tax, accounting, lawful requests)	Account & transaction records	Legal obligation

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not engage in profiling beyond the personalised recommendations described above.

5. Who We Share It With

We share personal data only with a small set of service providers ("Data Processors") that process it on our behalf strictly to operate the Service. Each is bound by contract to use the data only for the agreed purpose, maintain appropriate security, and assist us with your data rights requests.

Recipient	What we share	Purpose
Amazon Web Services (AWS)	All categories (hosted in their infrastructure)	Hosting compute, database, and object storage
Razorpay	Payment instrument data (entered by you on Razorpay's screens, not handled by us), transaction reference IDs	Subscription billing
Firebase Cloud Messaging (Google)	Your device's push-notification token and notification payload	Delivering reminders and service notifications
Atlassian Jira	The feedback message and optional screenshot you submit, your user ID and mobile number, and the page you were on when you submitted	Routing feedback to our support team for triage

We do not sell your personal data. We do not share it with advertisers. We do not share it with third parties for their own marketing purposes.

We may disclose your personal data when required by law (e.g., in response to a valid court order or law-enforcement request), to protect our legal rights, or in connection with a merger, acquisition, or sale of our business (in which case we will notify you).

6. Where We Store It & International Transfers

Our primary databases and object storage are hosted on AWS in the Mumbai (ap-south-1) region in India. We do not transfer your personal data outside India for primary storage. Some of our service providers (notably Firebase, Atlassian) may process limited operational metadata in jurisdictions outside India under appropriate safeguards consistent with the DPDP Act and other applicable law.

7. How Long We Keep It

Account & profile data — kept for as long as your account is active.
Activity logs — kept for the lifetime of your account so the progress-tracking features work; you can request earlier deletion of specific entries.
Avatar images — kept until you replace them or delete your account. Past versions remain in object storage but are no longer linked to your profile.
Feedback messages & screenshots — kept for the lifetime of the related Jira ticket plus retention of our support records, typically up to 2 years.
Subscription & payment records — kept for at least 8 years where required by tax and accounting laws.
Post-deletion — when you delete your account, we retain residual personal data for up to 90 days in production systems for fraud-prevention and refund handling, after which it is securely deleted. Backup snapshots are purged according to our rolling backup cycle (currently 30 days).

8. Security Measures

We protect your personal data through a layered set of technical and organisational measures:

Transport encryption — all API traffic uses HTTPS (TLS 1.2 or higher).
At-rest encryption — AWS S3 and database storage use AES-256 server-side encryption.
Access control — internal access is role-based and limited to engineering staff who need it; production access is logged.
Authentication — short-lived JWT access tokens (~2 hours) with refresh tokens; OTP-based phone authentication for login.
Avatar uploads — performed via short-lived presigned URLs (15 minutes) scoped to your own user namespace; image bytes never pass through our application servers.
Vulnerability management — dependencies are tracked and patched on a regular cycle.

No system is perfectly secure. We will notify you and the relevant authorities promptly if a personal-data breach materially affecting you occurs, in accordance with the DPDP Act.

9. Your Rights

Under the DPDP Act and other applicable laws, you have the following rights over your personal data:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate or incomplete data.
Erasure — request deletion of your personal data, subject to legal retention obligations (see Section 7).
Portability — request your data in a structured, commonly used, machine-readable format.
Withdraw consent — for purposes where we relied on your consent. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Nominate — nominate another person to exercise your rights on your behalf in the event of your death or incapacity (DPDP Act, Section 14).
Object — to processing based on legitimate interest, where applicable.
Lodge a complaint — with the Data Protection Board of India if you believe our processing of your data infringes the DPDP Act.

To exercise any of these rights, email contact@diet2fit.com (see Section 14). We will respond within the timelines required by applicable law (and in any event within 30 days).

10. Children's Data

The Service is available to users aged 13 and above. Users below 18 years of age must have prior verifiable consent from a parent or legal guardian, who must also accept these Terms and this Policy on the minor's behalf. We do not knowingly collect personal data from a child below the age of 13. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data without consent should contact us immediately at contact@diet2fit.com.

For users between 13 and 18, we do not use their data for behavioural tracking or targeted advertising, and we apply additional safeguards consistent with the DPDP Act.

11. Cookies & Tracking

The App is a mobile-only product and does not use browser cookies. We do not embed third-party advertising or analytics SDKs that track you across other apps or websites. Within the App, we use the minimum local storage needed to keep you signed in (encrypted JWT in secure keychain) and to cache your profile for fast loading.

12. Health-Related Data

Because the Service involves nutrition, fitness, and weight management, some of the data we collect (your weight history, BMI, supplement schedule, workout logs) qualifies as health-related personal data. We treat this data with heightened care:

It is encrypted in transit and at rest.
It is accessed by our staff only when strictly necessary (for example, when troubleshooting a bug you reported via the feedback option).
It is never sold, never disclosed to advertisers, and never used to make adverse decisions about you (e.g., insurance, employment).
You can delete your activity logs at any time from the App. Bulk deletion requests can be made through contact@diet2fit.com.

Diet2Fit is not a healthcare provider and the App is not a medical record system. The recommendations and metrics it provides are educational only — see the Terms & Conditions for the full medical disclaimer.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the Service, or in the law. The version you accepted is recorded against your account along with the date of acceptance. Material changes will be notified through the App with at least 14 days' prior notice, and you will be asked to re-accept before continued use. Non-material changes (clarifications, typographical corrections) take effect immediately upon publication.

14. Contact Us

For any data-protection requests, questions, or complaints about this Privacy Policy or our handling of your personal data, contact us at:

Email: contact@diet2fit.com

We will acknowledge complaints within 7 working days and resolve them within 30 days unless a longer period is justified and explained. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.