Privacy

This is written to meet India's Digital Personal Data Protection Act, 2023. In its language, you are the Data Principal and Poshan Nutrition Pvt Ltd is the Data Fiduciary: the rights below are yours, and the duties are ours.

What we store

If you use Poshan without an account, your height, weight, goal, diet and region stay in your own browser's local storage. They are never sent to us.

If you create an account, we store against your user id:

• Your email address, for signing in.
• Height, weight, date of birth or age, sex, activity level, goal, diet, region and preferred language.
• Any health conditions you select.
• Any biomarker and lab values you enter.
• Meals you log, plates you scan, weights, symptoms and pantry items.
• Your messages to Ask Poshan and Health Companion.
• Payment records, if you subscribe.
• Profiles you create for family members — see below, because those are somebody else's data.

A note on wording: this policy used to call health data sensitive personal data. That phrase comes from the older SPDI Rules and from GDPR. The DPDP Act deliberately has no separate tier for sensitive data — it applies the same standard to all personal data — so we have stopped implying a distinction the statute does not make. The practical effect is that health data gets the same protection as everything else here, which is to say: the strongest we have.

How long we keep it

Your profile and health records are kept while your account exists, and erased when you delete it. Some things expire sooner on their own:

• Chat messages — 180 days. They exist to give the assistant context within a course of questions, not to build a permanent health record.
• Scan corrections — 365 days.
• Payment webhook records — 90 days.
• Abuse counters — 7 days.
• Clinician access grants — whatever expiry you set when granting.

Who can see it

Every table uses row-level security, so a query can only return rows belonging to the signed-in account. We do not sell your data, and we do not share it with advertisers. A clinician sees your data only if you grant them access, only the categories you pick, and only until the expiry you set — and every time one opens anything, it is recorded in your Privacy centre.

Processors, and where they are

The DPDP Act permits personal data to be processed outside India except in countries the Central Government restricts by notification. Several of ours are outside India, so here is the list with locations rather than a line about “global vendors”:

• Supabase — Database, sign-in and file storage. Outside India.
• Anthropic — Powers Ask Poshan and Health Companion. Your message and any conditions you have selected are sent to generate a reply.. United States.
• OpenAI — Identifies dishes in a scanned plate photograph. United States.
• Razorpay — Payments. India.
• Resend — Sends clinic enquiry notifications and guardian-consent emails. United States.

Card details go to Razorpay directly; we never see or store them. When you ask Ask Poshan or Health Companion something that needs current information, your question may also be sent to a web search tool to answer it.

Meal photos

Photographs you scan are sent to our vision model to identify what is on the plate, then discarded — we do not save the photo itself anywhere. Only the dishes it recognised are stored against your account, the same as if you had picked them from the list by hand.

Children under 18

The Act requires a parent or guardian's verifiable consent before a child's data may be processed, and separately forbids tracking, behavioural monitoring and targeted advertising directed at children.

If you are under 18, or you add a family member who is, we ask for a guardian's email and send them a request. Until they confirm, we do not build a plan from that child's details — the profile stays visible to whoever entered it, marked as awaiting permission, but it is not used. Streaks, badges and leaderboards stay switched off for anyone under 18 regardless of what the guardian answers — that is not a setting either of you can change, because it is not ours to offer.

Family profiles

Poshan Home lets you add up to five family members. Their name, age, height, weight and dietary details are their personal data, not yours, and under the Act each of them is a Data Principal with the same rights you have. We cannot send them a notice — they have no account — so when you add someone you confirm that you are either their guardian or that you have told them. If a family member asks us to remove their data, we will, and we will tell you that we have.

Your rights

All of these are in the Privacy centre, and each is one click. The Act requires that withdrawing consent be as easy as giving it, so none of them is an email to us:

• See and download everything we hold about you, with the list of who it has been shared with.
• Correct anything wrong — your profile is editable, and we will fix anything you cannot reach yourself.
• Withdraw consent for usage measurement, or for any clinician's access.
• Delete your account and everything attached to it.
• Nominate someone to exercise these rights if you die or become unable to act for yourself.
• Complain — to our Grievance Officer first, and to the Data Protection Board of India if we do not resolve it.

One thing deletion does not remove: the record of which clinicians opened your data. Those entries stay, stripped of anything identifying you, so that past access to a patient's records remains auditable. That is a deliberate choice and we would rather say so than quietly do it.

If there is a data breach

If we become aware that your personal data has been accessed, disclosed or lost without authorisation, we will notify you at the email address on your account without undue delay once the breach is confirmed, describing what happened, what was affected, and what we are doing about it. We will also notify the Data Protection Board of India as the Act requires.

Grievance Officer

As required under India's Digital Personal Data Protection Act, 2023, complaints or grievances about how your data is handled can be raised with:

Daksh, Grievance Officer
Email: dakshg2233@gmail.com
Phone: +91 85956 07565

If we do not resolve your complaint, you may take it to the Data Protection Board of India.

Contact

Poshan Nutrition Pvt Ltd, Delhi, India — the Data Fiduciary responsible for the data described above.
Email: dakshg2233@gmail.com
Phone: +91 85956 07565

Data protection queries go to the same address. Full contact details: /contact.

Not medical advice

Poshan gives general nutrition information based on published Asian-Indian BMI cutoffs. It does not diagnose, treat or replace advice from a doctor or registered dietitian.