Privacy Policy

Last Updated: 01 September 2026

We at Heavohealth [Arovex Healthcare Innovations Private Limited] ("Heavohealth," "We," "Us," or "Our") understand that You, as a user ("You," "Your," or "User(s)"), care about how Your personal information is collected, used, stored, disclosed, and otherwise processed. We respect Your privacy and are committed to protecting Your personal data.

This Privacy Policy explains how We collect, receive, use, process, store, disclose, and protect Your personal information when You visit or use Our website, heavohealth.com, Our mobile application, Heavohealth, and any other linked pages, features, content, mobile applications, products, or services offered by Us from time to time (collectively, the "Platform"), or when You use any medical, healthcare, wellness, diagnostic, consultation, or related services made available through the Platform (collectively, the "Services").

By accessing or using the Platform or Services, You acknowledge that You have read and understood this Privacy Policy and, where required under applicable law, provide Your consent to the collection and processing of Your personal data as described herein.

1

Applicable Laws

This Privacy Policy is published and maintained in accordance with applicable laws and regulations relating to privacy and protection of personal data, including, as applicable:

  • The Digital Personal Data Protection Act, 2023 ("DPDP Act"), and rules, regulations, notifications, circulars, and directions issued thereunder, as and when applicable;
  • The Information Technology Act, 2000, including Section 43A, to the extent applicable;
  • The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), to the extent applicable; and
  • The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent applicable to Our Platform or services.

Where the DPDP Act or any other applicable data protection law becomes applicable to the processing of Your personal data, We will process such data in accordance with the requirements applicable to Us under such law.

For the purposes of applicable data protection laws, Arovex Healthcare Innovations Private Limited may act as the relevant Data Fiduciary, where applicable, in respect of the personal data processed by Us in connection with the Platform and Services.

This Privacy Policy should be read together with Our Terms of Service and any other applicable policies, notices, or consent forms provided to You in connection with specific services.
2

Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

  • The Heavohealth website;
  • Heavohealth mobile applications and digital platforms;
  • Healthcare and wellness programs offered by Heavohealth;
  • Communications with Heavohealth;
  • Consultations, assessments and other services facilitated through Heavohealth;
  • Interactions with healthcare professionals, laboratories, pharmacies, technology providers and other service providers working with or through Heavohealth; and
  • Other services that expressly refer to this Privacy Policy.

This Privacy Policy does not apply to third-party websites, applications, products or services that are not controlled by Heavohealth. Such third parties may have their own privacy policies.

3

Personal Data We Collect

Depending on the Services you use, we may collect the following categories of personal data.

3.1

Information You Provide

This may include:

  • Full name;
  • Email address;
  • Mobile number;
  • Date of birth or age;
  • Gender, where relevant to the Services;
  • Location or address;
  • Account credentials;
  • Profile information;
  • Payment and billing information;
  • Information provided when communicating with our team;
  • Information submitted through forms, assessments, surveys or questionnaires.
3.2

Health and Wellness Information

Because Heavohealth may provide healthcare, metabolic health, wellness and related services, we may process information that is necessary to provide those Services, including:

  • Medical history;
  • Current and past health conditions;
  • Symptoms and health concerns;
  • Family medical history, where relevant;
  • Medication and supplement information;
  • Diagnostic reports and laboratory results;
  • Blood glucose and other metabolic measurements;
  • Body weight, body composition and related measurements;
  • Nutrition and dietary information;
  • Physical activity and exercise information;
  • Sleep-related information;
  • Lifestyle information;
  • Information relating to healthcare consultations;
  • Clinical assessments and progress records;
  • Treatment or care-related information;
  • Prescriptions and relevant prescription history;
  • Adverse events or safety-related information; and
  • Other health information necessary for the Services.
Health information is particularly sensitive in nature. We process such information only for specified and lawful purposes and with appropriate safeguards.
3.3

Information From Devices and Health Platforms

Where you choose to connect a supported device, application or health platform to Heavohealth, we may receive information from that source. Depending on the integration, this may include:

  • Activity data;
  • Step counts;
  • Heart rate;
  • Sleep information;
  • Exercise information;
  • Weight and body composition;
  • Blood glucose or other health measurements; and
  • Other information that you specifically authorise the connected platform to share.

We will process information received from third-party health platforms in accordance with this Privacy Policy and the permissions you provide.

3.4

Information Collected Automatically

When you use our website or digital platforms, certain information may be collected automatically, including:

  • IP address;
  • Browser and device information;
  • Operating system;
  • Device identifiers;
  • Pages or screens accessed;
  • Date and time of access;
  • Usage and interaction information;
  • Cookies and similar technologies; and
  • Technical information required to maintain security and functionality.
4

How We Use Your Personal Data

We may process your personal data for the following purposes:

4.1

Providing Our Services

To:

  • Create and manage your account;
  • Provide healthcare, wellness and related Services;
  • Conduct assessments;
  • Coordinate consultations;
  • Review relevant health information;
  • Support personalised care or recommendations;
  • Monitor progress;
  • Communicate with healthcare professionals involved in your care;
  • Facilitate diagnostic testing, where applicable;
  • Facilitate pharmacy or other healthcare services, where applicable; and
  • Provide customer and operational support.
4.2

Safety and Clinical Governance

Where applicable, we may use relevant health information to:

  • Assess eligibility for particular Services;
  • Identify potential safety concerns;
  • Support clinical decision-making by appropriately qualified healthcare professionals;
  • Monitor outcomes;
  • Maintain appropriate healthcare records;
  • Conduct quality assurance;
  • Investigate adverse events; and
  • Meet applicable reporting or regulatory requirements.
4.3

Payments and Administration

We may process personal data to:

  • Process payments;
  • Generate invoices;
  • Maintain financial records;
  • Manage subscriptions or purchases;
  • Resolve payment issues; and
  • Prevent fraud or misuse.
4.4

Service Improvement and Analytics

We may analyse information to understand how our Services are used, improve our products and services, identify trends, measure outcomes and develop new features.

Where feasible and appropriate, information used for analytics, research or product development will be aggregated, anonymised or de-identified so that individuals cannot reasonably be identified.

4.5

Communications

We may use your contact information to:

  • Send service-related communications;
  • Respond to enquiries;
  • Provide appointment or program updates;
  • Send important notices;
  • Communicate changes to our Services; and
  • Where permitted by law and based on your preferences, send marketing or promotional communications.

You may opt out of promotional communications at any time.

4.6

Legal and Regulatory Compliance

We may process or disclose personal data where necessary to:

  • Comply with applicable laws;
  • Respond to lawful requests from government or regulatory authorities;
  • Prevent, detect or investigate fraud, security incidents or unlawful activity;
  • Protect the rights, safety and property of Heavohealth, our users or others; or
  • Establish, exercise or defend legal claims.
5

Legal Basis for Processing

Depending on the circumstances and applicable law, we may process personal data:

  • With your consent;
  • To provide Services requested by you;
  • To comply with a legal obligation;
  • For certain legitimate uses permitted under applicable law;
  • To protect vital interests where permitted by law; or
  • For other lawful purposes permitted under applicable legislation.

Where processing is based on consent, you may withdraw your consent subject to applicable law and contractual or legal requirements. Withdrawal of consent may affect our ability to provide certain Services that require the relevant information.

6

Your Rights Under the DPDP Act

Subject to the provisions of applicable law and the phased commencement of the DPDP Act, you may have rights including:

  • Right to Access Information: You may have the right to obtain information about the personal data being processed by us and other information prescribed under applicable law.
  • Right to Correction: You may request correction of inaccurate or misleading personal data and completion of incomplete personal data, subject to applicable law.
  • Right to Erasure: You may request deletion of your personal data where permitted under applicable law. Certain information may need to be retained where required by law, for legal claims, regulatory requirements, safety purposes or other lawful purposes.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent through available mechanisms.
  • Right to Grievance Redressal: You may raise a privacy-related grievance with us using the contact details provided below.
  • Right to Nominate: Where applicable under the DPDP Act, you may have the right to nominate another individual to exercise your rights in accordance with the Act.

These rights are subject to applicable legal limitations and may not apply in every circumstance.

7

How We Share Personal Data

We do not sell your personal data in personally identifiable form. We may share personal data where necessary with:

  • Healthcare Professionals: Doctors, clinicians, dietitians, coaches or other qualified professionals involved in providing the Services.
  • Laboratories and Diagnostic Providers: Where necessary to facilitate diagnostic testing, reporting or related healthcare services.
  • Pharmacies and Healthcare Suppliers: Where applicable to fulfill prescriptions, medicines, healthcare products or other Services requested by you.
  • Technology and Service Providers: Third-party vendors that provide services such as cloud hosting, data storage, software infrastructure, analytics, communication, payment processing, customer support, security, identity verification, and other operational services. Such service providers may process personal data only for purposes permitted by their engagement with us and applicable law.
  • Legal and Regulatory Authorities: We may disclose information where required or permitted by applicable law, regulation, court order or lawful governmental request.
  • Business Transfers: If Heavohealth undergoes a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.
  • Research and Analytics: We may use or disclose aggregated, anonymised or de-identified information for research, analytics, product development and other lawful purposes where individuals cannot reasonably be identified.
8

Data Processing by Third Parties

Some Services may rely on third-party technology or service providers.

Where such providers process personal data on our behalf, we take reasonable steps to require appropriate confidentiality, security and data protection measures.

Third parties may independently process information where you interact directly with their services. Their processing will be governed by their own privacy policies.

9

Cookies and Similar Technologies

We may use cookies, pixels, SDKs and similar technologies to:

  • Operate our website and applications;
  • Remember preferences;
  • Understand usage patterns;
  • Improve performance;
  • Measure engagement;
  • Maintain security; and
  • Support permitted analytics and marketing activities.

You may be able to control cookies through your browser or device settings. Disabling certain cookies may affect the functionality of our Services.

10

Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction. Depending on the nature of the information and the risks involved, safeguards may include:

  • Access controls;
  • Authentication mechanisms;
  • Encryption or other security technologies where appropriate;
  • Secure infrastructure;
  • Monitoring and logging;
  • Internal access restrictions; and
  • Security and incident-response procedures.

No method of electronic transmission or storage can be guaranteed to be completely secure. We therefore continuously review and improve our security practices.

11

Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or for the period required or permitted under applicable law. The retention period may depend on:

  • The nature of the information;
  • The purpose for which it was collected;
  • Whether you continue to use our Services;
  • Clinical or healthcare record requirements;
  • Legal and regulatory obligations;
  • Accounting and tax requirements;
  • Dispute resolution; and
  • Security and fraud-prevention requirements.

When personal data is no longer required, we will take reasonable steps to delete, anonymise or otherwise dispose of it in accordance with applicable law.

12

Data Storage and International Transfers

Your personal data may be stored or processed in India or in other jurisdictions where Heavohealth or its authorised service providers operate, subject to applicable law.

Where personal data is transferred outside India, we will comply with applicable requirements under the DPDP Act, DPDP Rules and other applicable laws.

13

Children's Privacy

Our Services are not intended for children unless expressly stated otherwise.

We do not knowingly collect personal data from children in violation of applicable law. Where processing of a child's personal data is permitted or required, we will comply with applicable requirements relating to parental or lawful guardian consent and other safeguards.

Under the DPDP Act, a "child" means an individual who has not completed eighteen years of age.
14

Your Choices

You may choose not to provide certain personal data. However, some information may be necessary to:

  • Create an account;
  • Provide healthcare or other Services;
  • Conduct assessments;
  • Process payments;
  • Maintain legally required records; or
  • Meet safety or regulatory requirements.

If you do not provide such information, we may not be able to provide certain Services. You may also manage certain communications and marketing preferences through the mechanisms we provide.

15

Account and Data Updates

You may request access to or correction of personal data associated with your account.

Where available, you may update certain information directly through your account.

If you believe that information we hold about you is inaccurate or incomplete, you may contact us using the details below.

16

Data Breaches and Security Incidents

If a personal data breach occurs, we will take reasonable steps to contain, assess, investigate and remediate the incident.

Where required under applicable law, we will notify affected individuals, regulatory authorities or other relevant parties within the prescribed timelines and in the prescribed manner.

17

Grievance Redressal

If you have questions, requests or complaints regarding the processing of your personal data, you may contact our Grievance department.

Email Us
hello@heavohealth.com
Address

846/7 Lane no 7 Govindpuri Kalkaji

Please provide sufficient information to enable us to understand and address your request or grievance. We will handle grievances in accordance with applicable law and within the timelines prescribed by applicable law.

18

Third-Party Links

Our Services may contain links to websites, applications or services operated by third parties.

Heavohealth is not responsible for the privacy practices of such third parties. We recommend reviewing their respective privacy policies before providing them with personal data.

19

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, business practices or applicable law.

When we make material changes, we may notify you through our website, application, email or other appropriate means, where required by law. The updated Privacy Policy will indicate its effective or "Last Updated" date.

20

Contact Us

Get in touch

For questions regarding this Privacy Policy or the handling of your personal data, contact:

Heavohealth [Arovex Healthtech Innovations Private Limited]

hello@heavohealth.com
846/7 Lane no 7 Govindpuri Kalkaji