Privacy Policy

Beet.Health is operated by FORTYATSIXTY HEALTH TECH PRIVATE LIMITED, a company incorporated under the laws of India ("Beet.Health", "we", "us", or "our"). Our registered office is at 5th Floor, Plot No. 7, Gayatri Enclave, Gandipet Main Rd, Narsingi, Rajendranagar, K.V. Rangareddy, 500075, Telangana, India.

This Privacy Policy applies exclusively to the Beet.Health Client App (available on iOS and Android), used by individuals to manage their nutrition and wellness with the support of a nutritionist.

For privacy questions or to exercise your rights, contact us at help@beet.health.

2.1 Account & Identity Information

• Registration data: your full name, email address, phone number, and password when you create an account.
• Profile data: date of birth, gender, and a profile photo if you choose to add one.

2.2 Health & Dietary Data

• Dietary logs: meals, food items, calorie intake, macronutrient breakdown, and eating patterns you record.
• Health metrics: body weight, height, body measurements, BMI, and health goals you enter.
• Medical context: dietary restrictions, food allergies, and any health conditions you choose to share.
• Progress data: weight logs and goal tracking over time.
• Nutritionist inputs: meal plans, recommendations, and consultation notes entered by your assigned nutritionist.

2.3 Android Health Connect Data

On Android devices, Beet.Health integrates with Android Health Connect to read health and fitness data you have already stored on your device. We request only the permissions necessary to deliver the features you use. All Health Connect data is read-only, processed locally or on our secure servers, and is never sold or used for advertising.

4.1 India: DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023, we process your data on the following bases:

• Consent: you give explicit consent at registration and before accessing Health Connect data or entering health data. You may withdraw consent at any time by deleting your account or revoking Health Connect permissions in your device settings.
• Contractual necessity: processing is required to deliver the nutrition service you have subscribed to.
• Legitimate interest: for platform security and anonymous product analytics, where your rights are not overridden.
• Legal obligation: where required by Indian law, including court orders or regulatory directions.

4.2 International Users: GDPR (EEA & UK)

For users in the European Economic Area or United Kingdom, we additionally rely on:

• Article 6(1)(a) Consent: for processing personal data.
• Article 9(2)(a) Explicit consent: specifically for health data and biometric data, which are special category data under GDPR.
• Article 6(1)(b) Contract: for processing necessary to deliver the service.

EEA/UK users have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with your local supervisory authority.

5.1 With Your Nutritionist

Your health data, dietary logs, progress photos, body measurements, and appointment history are shared with your assigned nutritionist through the Platform. This is the core function of the service and requires your consent at onboarding.

5.2 With Essential Service Providers

We use trusted third-party providers who act as data processors under our instructions only:

• Cloud hosting & database: Google Cloud Platform, servers located in Mumbai, India. Your data is stored in encrypted form.
• Firebase (Google): powers push notifications (FCM) and crash reporting (Crashlytics). Firebase processes your device token and anonymised crash data.
• Email delivery: for transactional emails such as account verification and password reset.
• Apple & Google: process payments and subscription management on our behalf. Beet.Health does not access your card details.
• Android Health Connect: a Google platform through which you grant Beet.Health permission to read health data stored on your device. Health Connect data is never transferred outside our secure infrastructure or shared with any third party beyond what is described in this policy.

All service providers are contractually bound to process your data only as directed by Beet.Health and to maintain appropriate security standards.

5.3 Legal Disclosures

We may disclose your data if required by law, court order, or a government authority in India or another applicable jurisdiction, or to protect the rights, safety, or property of Beet.Health, our users, or others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to a successor entity. We will give you at least 14 days' notice before such a transfer and your rights under this policy will continue to apply.

5.5 International Data Transfers

If your data is transferred outside India (e.g., to cloud servers in another country), we ensure such transfers comply with the DPDP Act and, for EEA users, GDPR. We use contractual safeguards including Standard Contractual Clauses where required.

• Account & profile data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Health, dietary & biometric data: retained for the duration of your active use, plus up to 12 months for continuity of care. Deleted within 30 days of an account deletion request.
• Health Connect data: read at the time of your request and used to generate insights. We do not store raw Health Connect data beyond the current session unless you explicitly save a record in the app.
• Progress photos: retained only while your account is active. Deleted immediately upon account deletion.
• Payment transaction references: retained for 7 years as required by Indian financial regulations (GST and accounting law). No card data is held by us.
• Crash logs (Firebase Crashlytics): retained for 90 days, after which they are automatically deleted by Firebase.
• Anonymised & aggregated data: may be retained indefinitely for research and product improvement. This data cannot identify any individual.

7.1 Rights Under DPDP Act, 2023 (All Indian Users)

• Right to access: request a summary of personal data we hold about you.
• Right to correction: request that inaccurate or incomplete data be corrected.
• Right to erasure: request deletion of your account and all personal data. We will process this within 30 days.
• Right to withdraw consent: withdraw consent to data processing at any time, including Health Connect permissions via your Android device settings.
• Right to grievance redressal: raise a complaint with our Grievance Officer. You may also approach the Data Protection Board of India once established.
• Right to nominate: nominate a person to exercise your data rights on your behalf in the event of your death or incapacity.

7.2 Health Connect Permissions (Android)

You can review and revoke any Health Connect permission granted to Beet.Health at any time by going to:

Revoking a permission will immediately stop Beet.Health from reading that data type. Previously generated insights may remain visible in the app until they are refreshed.

7.3 Additional Rights for EEA / UK Users (GDPR)

• Right to data portability: receive your data in a structured, machine-readable format.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.
• Right to object: object to processing based on legitimate interest.
• Right to lodge a complaint: with your local data protection supervisory authority.

7.4 How to Exercise Your Rights

Email help@beet.health with the subject line "Privacy Request". We will respond within 30 days.

You can also delete your account directly in the app: Settings › Account › Delete Account. This permanently deletes your profile and all associated health data within 30 days.

You can request deletion of your Beet.Health account and all associated personal data at any time, in either of these ways:

• By email: send a request to help@beet.health with the subject line "Delete My Account".

What happens when you delete your account

• Your profile, health data, dietary logs, and progress photos are permanently deleted within 30 days.
• Payment transaction references are retained for 7 years as required by Indian financial regulations (GST/accounting law) — no card details are ever stored by us.
• Anonymised, aggregated data that cannot identify you may be retained for research and product improvement.

• Encryption in transit: all data between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: health data, biometric data, and account information stored in our databases are encrypted at rest.
• Health Connect access: data read from Health Connect is transmitted over encrypted channels and processed in our secure infrastructure.
• Access controls: only authorised personnel can access personal data, limited to what is necessary for their role.
• Secure authentication: sessions use secure, short-lived tokens. We recommend using a strong, unique password.
• Crash monitoring: Firebase Crashlytics monitors app stability without collecting identifiable health data.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at help@beet.health.

The Beet.Health Client App is intended for users aged 18 years and above. We do not knowingly collect personal data from anyone under 18.

If you are a parent or guardian and believe your child has registered without consent, contact us at help@beet.health and we will delete the account promptly.

The app integrates the following third-party services. Each has its own privacy policy:

The Beet.Health Client App does not use advertising cookies or third-party tracking pixels.

• Firebase Analytics: we use anonymised, aggregated app usage analytics via Firebase. No personally identifiable information is used for analytics.
• Session tokens: we use secure session tokens stored locally on your device to keep you logged in. These are not advertising cookies.
• Third-Party Integrations (e.g., Fitbit / Health Connect): when you choose to connect a third-party health service, the app opens a secure web portal or OS-level permissions screen hosted by that provider to authorise the data sync. That provider may place essential session cookies or tracking technologies on their own domain. Beet.Health does not control, store, or have access to these third-party cookies or your login credentials.
• Fonts and Asset Delivery: we use Google Fonts (fonts.gstatic.com) to deliver consistent typefaces within our web interfaces. While this service does not use tracking cookies, loading fonts requires your device to share its IP address with Google to request the asset.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, we have appointed a Grievance Officer:

We may update this policy from time to time. For material changes, we will:

• Notify you via an in-app banner or push notification at least 7 days before changes take effect.
• Update the Effective Date at the top of this document.
• Publish the updated policy at beet.health/privacy.

Continued use of the app after the effective date of changes means you accept the updated policy. If you disagree, you may delete your account before the effective date.