Privacy Policy

Diet2Fit Pvt. Ltd. · Version 2.0 · Effective 16 July 2026 (supersedes v1.0 of 13 May 2026)

Diet2Fit Pvt. Ltd. ("Diet2Fit", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect about you when you use the Diet2Fit mobile application (the "App") and related services (collectively, the "Service"), how we use and share it, how long we keep it, and the rights you have over it. This Policy should be read together with our Terms & Conditions and forms part of those Terms.

At a glance We collect the profile, health-tracking, and feedback data you give us; we use it to generate personalised recommendations and operate the Service; our primary storage is in AWS Mumbai (India); some features send data to AI and voice providers outside India (see Sections 5, 6 and 13); we do not sell your data or use it for advertising; and you can access, correct, or delete it at any time from the app or by writing to contact@diet2fit.com.

1. Who We Are & Scope of this Policy

Diet2Fit Pvt. Ltd. is a company incorporated under the Companies Act, 2013 (contact: contact@diet2fit.com). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable laws, Diet2Fit is the Data Fiduciary (controller) in respect of the personal data described in this Policy.

This Policy applies to all personal data that you provide to us or that we collect about you when you use the App. It does not apply to data collected by third-party services that the App integrates with — those providers operate under their own privacy policies (see Section 5).

2. Data We Collect

We collect the following categories of personal data:

Category	Examples	Sensitive?
Identity & account	Full name, mobile number (for OTP login), age, gender, country, optional address	No
Health & lifestyle profile	Height, weight, BMI, fitness goal, diet preference (VEG / NON_VEG / EGG), activity level	Yes — health-related
Photos	Profile picture (avatar) you choose to upload	Potentially identifying
Activity logs	Meals consumed, workouts and sequences completed, cardio sensor data (steps, distance, cadence, calorie-burn estimates, perceived-exertion ratings), supplement / medicine intake, water consumption, weight measurements over time	Yes — health-related
Wellbeing & body-signal check-ins	Optional daily self-reported entries used by the premium "Insights" dashboards — mood and stress ratings and mindfulness minutes (Mind & Body); resting heart rate and, if you enter it, heart-rate variability (Heart); and sleep duration, quality and bed/wake times (Sleep). You enter these manually; the app does not read them from a wearable.	Yes — health-related (incl. mental-wellbeing)
Location (city)	The city you select, or that we resolve once from a coarse (approximate) device-location reading if you choose "auto-detect" during setup. We store only the resolved city name — not your precise coordinates — and we do not request precise or background location.	Approximate location
AI & coaching content	Your messages to the in-app AI coach (stored as conversation history) and, if you use the human-nutritionist feature, your consultation chat messages and call booking details. See Section 13.	Yes — may contain health details
Feedback	Messages you submit through the in-app Feedback option, and screenshots you choose to attach (these may incidentally include other parts of the App that were on screen)	Depends on content
Subscription & payment	Plan tier, billing cycle, transaction reference IDs from Razorpay. We do not store your full card number, CVV, or UPI PIN — Razorpay handles those directly.	No (we don't see the card data)
Device & technical	Device identifier (used for OTP session binding), platform (Android / iOS), app version, IP address visible to the backend during API calls, basic crash diagnostics	No

Some data is essential — without it the App cannot work (e.g., your age, weight, and goal are needed to calculate calorie targets). Other data is optional and you can use the App without providing it (e.g., the profile picture).

3. How We Collect It

Directly from you — during signup, profile setup, daily logging, feedback submission, and avatar upload.
Automatically — when you use the App, your device sends us API requests that include device identifier, IP address, and timestamps. Cardio sensor readings (steps, cadence) are gathered by the App from your device's motion sensors and sent to our servers only when you finish a workout.
Device location (only if you allow it) — if you tap "auto-detect" during city setup, the App requests a coarse-location permission and takes a single one-off reading to suggest your nearest city. You can decline and pick your city manually instead; either way, only the city name is stored.
From third parties — payment confirmation events from Razorpay; push notification delivery receipts from Firebase Cloud Messaging.

4. Why We Use It (Purposes & Legal Basis)

We process your personal data only where we have a lawful basis to do so. The table below summarises our purposes and bases under the DPDP Act and other applicable law.

Purpose	Data used	Legal basis
Authenticate you and operate your account	Mobile number, OTP, device identifier	Contract / consent
Generate personalised meal, workout, and nutrition recommendations	Profile (age, weight, height, diet pref, goal, activity), logging history	Contract
Provide the reminder, logging, and progress-tracking features	Activity logs, supplement schedule, water schedule, weight history	Contract
Process subscription payments	Payment instrument tokens (handled by Razorpay), plan choice	Contract
Investigate and respond to feedback / bug reports	Feedback messages, screenshots, account context	Consent + legitimate interest
Send service notifications (e.g., water reminder, supplement reminder)	FCM device token, reminder schedules	Consent (you enable reminders) / contract
Improve the Service via aggregate, anonymised analytics	Logging trends with personal identifiers removed	Legitimate interest
Comply with legal obligations (tax, accounting, lawful requests)	Account & transaction records	Legal obligation

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not engage in profiling beyond the personalised recommendations described above.

5. Who We Share It With

We share personal data only with a small set of service providers ("Data Processors") that process it on our behalf strictly to operate the Service. Each is bound by contract to use the data only for the agreed purpose, maintain appropriate security, and assist us with your data rights requests.

Recipient	What we share	Purpose
Amazon Web Services (AWS)	All categories (hosted in their infrastructure)	Hosting compute, database, and object storage
Anthropic (Claude AI)	Only the specific input a given AI feature needs: your typed message and relevant profile / log context (AI coach); a meal photo (Meal Scanner); a typed food name (custom food); or your numeric metrics for a period (Insights coaching line). See Section 13.	Powering the AI features (chat coaching, meal-photo recognition, nutrition estimates, insight summaries)
Agora	The real-time audio of a nutritionist call between you and your assigned coach, and call session metadata. Applies only if you book a call.	Carrying in-app audio calls with a human nutritionist
Razorpay	Payment instrument data (entered by you on Razorpay's screens, not handled by us), transaction reference IDs	Subscription billing
Firebase Cloud Messaging (Google)	Your device's push-notification token and notification payload	Delivering reminders and service notifications
Atlassian Jira	The feedback message and optional screenshot you submit, your user ID and mobile number, and the page you were on when you submitted	Routing feedback to our support team for triage

We do not sell your personal data. We do not share it with advertisers. We do not share it with third parties for their own marketing purposes.

We may disclose your personal data when required by law (e.g., in response to a valid court order or law-enforcement request), to protect our legal rights, or in connection with a merger, acquisition, or sale of our business (in which case we will notify you).

6. Where We Store It & International Transfers

Our primary databases and object storage are hosted on AWS in the Mumbai (ap-south-1) region in India, and that is where your account and health-tracking data are stored.

Some features necessarily transfer specific data outside India to the service providers listed in Section 5:

Anthropic (United States) — receives the input for any AI feature you use (see Section 13), which can include health-related content.
Agora (United States) — carries the audio of a nutritionist call, if you book one.
Firebase and Atlassian — process limited operational metadata (push tokens and notification content; feedback tickets) outside India.

We transfer this data only to the extent needed to provide the feature, under contracts that require each provider to protect it and to use it only to perform the service for us, and subject to safeguards consistent with the DPDP Act and other applicable law. Where a feature that sends data abroad is optional, you can choose not to use it.

7. How Long We Keep It

Account & profile data — kept for as long as your account is active.
Activity logs — kept for the lifetime of your account so the progress-tracking features work; you can request earlier deletion of specific entries.
Avatar images — kept until you replace them or delete your account. Past versions remain in object storage but are no longer linked to your profile.
Feedback messages & screenshots — kept for the lifetime of the related Jira ticket plus retention of our support records, typically up to 2 years.
Consultation chats — if you use the human-nutritionist feature, your consultation messages are kept for the life of your account so you and your coach retain the history; call audio is not recorded.
Subscription & payment records — kept for at least 8 years where required by tax and accounting laws.
Deleting your account — you can delete your account yourself from Settings. Deletion is a two-stage process: your account is first deactivated and signed out on every device, and remains recoverable for 30 days if you simply log back in; after that window it is permanently deleted. If you decline the data-collection consent shown at profile setup, your account and data are deleted immediately with no recovery window.
Post-deletion — after deletion we retain residual personal data for up to 90 days in production systems for fraud-prevention and refund handling, after which it is securely deleted. Backup snapshots are purged according to our rolling backup cycle (currently 30 days).

8. Security Measures

We protect your personal data through a layered set of technical and organisational measures:

Transport encryption — all API traffic uses HTTPS (TLS 1.2 or higher).
At-rest encryption — AWS S3 and database storage use AES-256 server-side encryption.
Access control — internal access is role-based and limited to engineering staff who need it; production access is logged.
Authentication — short-lived JWT access tokens (~2 hours) with refresh tokens; OTP-based phone authentication for login.
Avatar uploads — performed via short-lived presigned URLs (15 minutes) scoped to your own user namespace; image bytes never pass through our application servers.
Vulnerability management — dependencies are tracked and patched on a regular cycle.

No system is perfectly secure. We will notify you and the relevant authorities promptly if a personal-data breach materially affecting you occurs, in accordance with the DPDP Act.

9. Your Rights

Under the DPDP Act and other applicable laws, you have the following rights over your personal data:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate or incomplete data.
Erasure — request deletion of your personal data, subject to legal retention obligations (see Section 7).
Portability — request your data in a structured, commonly used, machine-readable format.
Withdraw consent — for purposes where we relied on your consent. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Nominate — nominate another person to exercise your rights on your behalf in the event of your death or incapacity (DPDP Act, Section 14).
Object — to processing based on legitimate interest, where applicable.
Lodge a complaint — with the Data Protection Board of India if you believe our processing of your data infringes the DPDP Act.

To exercise any of these rights, email contact@diet2fit.com (see Section 14). We will respond within the timelines required by applicable law (and in any event within 30 days).

10. Children's Data

The Service is available to users aged 13 and above. Users below 18 years of age must have prior verifiable consent from a parent or legal guardian, who must also accept these Terms and this Policy on the minor's behalf. We do not knowingly collect personal data from a child below the age of 13. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data without consent should contact us immediately at contact@diet2fit.com.

For users between 13 and 18, we do not use their data for behavioural tracking or targeted advertising, and we apply additional safeguards consistent with the DPDP Act.

11. Cookies & Tracking

The App is a mobile-only product and does not use browser cookies. We do not embed third-party advertising or analytics SDKs that track you across other apps or websites. Within the App, we use the minimum local storage needed to keep you signed in (encrypted JWT in secure keychain) and to cache your profile for fast loading.

12. Health-Related Data

Because the Service involves nutrition, fitness, sleep, and weight management, much of the data we collect is health-related — your weight and body-fat history, BMI, supplement schedule, workout logs, and the optional wellbeing and body-signal check-ins that power the Insights dashboards (mood and stress, mindfulness minutes, resting heart rate and HRV, and sleep). Mood and stress entries are treated as mental-wellbeing data, which we handle with particular care. We treat all of this data with heightened protection:

It is encrypted in transit and at rest.
It is accessed by our staff only when strictly necessary (for example, when troubleshooting a bug you reported via the feedback option). If you use the human-nutritionist feature, your assigned nutritionist can view your profile and logs solely to advise you.
It is never sold, never disclosed to advertisers, and never used to make adverse decisions about you (e.g., insurance, employment).
You can delete your activity logs and check-ins at any time from the App. Bulk deletion requests can be made through contact@diet2fit.com.

Diet2Fit is not a healthcare provider and the App is not a medical record system. The recommendations and metrics it provides are educational only — see the Terms & Conditions for the full medical disclaimer.

13. AI Features & Third-Party AI Processing

Some features of the App use artificial intelligence provided by Anthropic (the "Claude" models) as our data processor. When you use one of these features, we send Anthropic only the input that feature needs, and Anthropic returns a result to us:

Feature	What is sent	Notes
AI coach (chat)	Your typed message, and relevant parts of your profile, plans, and logs needed to answer	Your conversation history is stored in your account so you can revisit it. This feature can be turned off at the service level.
Meal Scanner	The meal photo you take	The photo is used to identify foods and is not stored by us — it is sent, processed, and discarded; only the food names you choose to log are kept.
Custom food	The food name you type	Used to estimate nutrition for an item not in our catalogue.
Insights coaching line	Your numeric metrics for the period (scores, averages, and changes)	No free text and no name are sent; the generated one-line tip is not stored.

Anthropic processes this data only to perform the service for us, under contract; it is not permitted to use your data for its own marketing. This processing takes place in the United States (see Section 6). These AI features are optional or can be switched off, and where a feature reveals health details in your text, that content is treated as health-related data (Section 12).

Not medical advice. Outputs from the AI features and the Insights dashboards (including the "Heart Wellness" and sleep scores) are for general information and motivation only. They are not a medical diagnosis, treatment, or professional advice. Always consult a qualified professional for medical concerns.

14. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the Service, or in the law. The version you accepted is recorded against your account along with the date of acceptance. Material changes will be notified through the App with at least 14 days' prior notice, and you will be asked to re-accept before continued use. Non-material changes (clarifications, typographical corrections) take effect immediately upon publication.

15. Contact Us & Grievance Officer

For any data-protection requests, questions, or complaints about this Privacy Policy or our handling of your personal data, contact us at:

Email: contact@diet2fit.com

In accordance with the DPDP Act and the Information Technology Act rules, you may also raise concerns about the processing of your personal data with our Grievance Officer, by writing to contact@diet2fit.com with the subject line "Grievance Officer". We will route your request to the responsible person.

We will acknowledge complaints within 7 working days and resolve them within 30 days unless a longer period is justified and explained. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.