Privacy Policy

Beet.Health is operated by FORTYATSIXTY HEALTH TECH PRIVATE LIMITED, a company incorporated under the laws of India ("Beet.Health", "we", "us", or "our"). Our registered office is at 5th Floor, Plot No. 7, Gayatri Enclave, Gandipet Main Rd, Narsingi, Rajendranagar, K.V. Rangareddy, 500075, Telangana, India.

This Privacy Policy applies exclusively to the Beet.Health Client App (available on iOS and Android), used by individuals to manage their nutrition and wellness with the support of a nutritionist.

For privacy questions or to exercise your rights, contact us at help@beet.health.

2.1 Account & Identity Information

• Registration data: your full name, email address, and phone number when you create an account. You sign in with your phone number and a one-time passcode; we do not ask you to create or store a password.
• Profile data: date of birth, gender, address, occupation, and a profile photo if you choose to add one.

2.2 Health & Dietary Data

• Dietary logs: meals, food items, calorie intake, macronutrient breakdown, and eating patterns you record.
• Health metrics: body weight, height, body measurements, BMI, and health goals you enter.
• Medical context: dietary restrictions, food allergies, and any health conditions you choose to share.
• Medical reports: lab reports and medical documents you choose to upload.
• Progress data: weight logs and goal tracking over time.
• Nutritionist inputs: meal plans, recommendations, and consultation notes entered by your assigned nutritionist.

2.3 Android Health Connect Data

On Android devices, Beet.Health integrates with Android Health Connect to read health and fitness data you have already stored on your device. We request only the permissions necessary to deliver the features you use. All Health Connect data is read-only, processed locally or on our secure servers, and is never sold or used for advertising.

2.4 Camera and Food Photographs

Beet.Health lets you photograph a meal so it can be identified and logged automatically rather than entered by hand. This is optional; you can always enter meals manually.

When you take or upload a food photograph, the image is sent to our servers and passed to a third-party AI provider — Anthropic (Claude) or OpenAI, depending on availability — which identifies the foods and estimates portion sizes and nutritional values. Only the image is sent for analysis. Your name, contact details, and account identifiers are not included in that request.

A photograph sent only for analysis is held in memory for the duration of the request and is not stored. If you choose to attach a photograph to a meal entry, or upload a progress photograph, it is stored with that entry in your health log and is visible to the practitioners described in section 5.1.

Stored images are kept in private cloud storage and are never publicly accessible. They are served through short-lived signed links that expire automatically.

Camera access is requested the first time you use this feature and can be withdrawn at any time in your device settings.

2.5 Microphone and Voice Input

Beet.Health lets you log meals, activity, sleep, and other health information by speaking instead of typing. This is optional, and every voice feature has an equivalent text or manual entry path.

When you start a voice session, the app requests microphone access and streams your audio in real time to our voice service. The audio connection is carried by LiveKit. Your speech is transcribed by Deepgram, interpreted by OpenAI to identify what you are logging, and a spoken reply is generated by Cartesia. The entries produced are saved to your Beet.Health account.

Your audio is used only to fulfil that request. We do not retain voice recordings as audio files once a session has been transcribed, and these providers do not use your audio to train their models. The text derived from your speech is kept as part of your health log, in the same way as anything you type.

Microphone access is requested the first time you start a voice session and can be withdrawn at any time in your device settings. Beet.Health continues to work without it.

4.1 India: DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023, we process your data on the following bases:

• Consent: you give explicit consent at registration and before accessing Health Connect data or entering health data. You may withdraw consent at any time by deleting your account or revoking Health Connect permissions in your device settings.
• Contractual necessity: processing is required to deliver the nutrition service you have subscribed to.
• Legitimate interest: for platform security and anonymous product analytics, where your rights are not overridden.
• Legal obligation: where required by Indian law, including court orders or regulatory directions.

4.2 International Users: GDPR (EEA & UK)

For users in the European Economic Area or United Kingdom, we additionally rely on:

• Article 6(1)(a) Consent: for processing personal data.
• Article 9(2)(a) Explicit consent: specifically for health data and biometric data, which are special category data under GDPR.
• Article 6(1)(b) Contract: for processing necessary to deliver the service.

EEA/UK users have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with your local supervisory authority.

5.1 With Your Care Team

Beet.Health is a practitioner-led service, so the health information you record is visible to the people delivering your care:

• Your assigned nutritionist, who can see your health and fitness data, dietary logs, food and progress photographs, body measurements, uploaded medical reports, messages, and appointment history, together with your name and contact details.
• Another nutritionist, where your assigned nutritionist or a clinic administrator has granted them access to your record. Access can be withdrawn at any time, and a record of who was granted access and when is kept.
• Administrators of the clinic your nutritionist practises under, for the purpose of managing your care and their practice.

This is the core function of the service and requires your consent at onboarding.

5.2 With Essential Service Providers

We use trusted third-party providers who act as data processors under our instructions only. They process your content solely to return a result to us, and do not use it to train their models.

• Cloud hosting & database: Google Cloud Platform, servers located in Mumbai, India. Your data is stored in encrypted form.
• Firebase (Google): powers push notifications (FCM) and crash reporting (Crashlytics). Firebase processes your device token and anonymised crash data.
• Anthropic (Claude) and OpenAI: analyse food photographs and text descriptions of meals to identify foods and estimate nutrition.
• OpenAI: extracts results from medical reports and lab documents you upload, and powers the in-app assistant.
• Deepgram: converts your speech to text during voice sessions.
• Cartesia: generates the spoken responses you hear during voice sessions.
• LiveKit: carries the real-time audio connection during voice sessions.
• Diagnostics and monitoring services: receive technical logs of app activity, which can include the content of assistant requests, so that we can diagnose faults and monitor quality.
• Email delivery: for transactional emails such as account verification.
• Android Health Connect: a Google platform through which you grant Beet.Health permission to read health data stored on your device.

All service providers are contractually bound to process your data only as directed by Beet.Health and to maintain appropriate security standards.

5.3 Legal Disclosures

We may disclose your data if required by law, court order, or a government authority in India or another applicable jurisdiction, or to protect the rights, safety, or property of Beet.Health, our users, or others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to a successor entity. We will give you at least 14 days' notice before such a transfer and your rights under this policy will continue to apply.

5.5 International Data Transfers

If your data is transferred outside India (e.g., to cloud servers in another country, or to the AI providers listed in section 5.2), we ensure such transfers comply with the DPDP Act and, for EEA users, GDPR. We use contractual safeguards including Standard Contractual Clauses where required.

• Account & profile data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Health, dietary & biometric data: retained for the duration of your active use, plus up to 12 months for continuity of care. Deleted within 30 days of an account deletion request.
• Health Connect data: read at the time of your request and used to generate insights. We do not store raw Health Connect data beyond the current session unless you explicitly save a record in the app.
• Food photographs sent only for analysis: not retained once the analysis is complete.
• Progress photos and photographs attached to a meal entry: retained only while your account is active. Deleted immediately upon account deletion.
• Voice audio: not retained as an audio file once a session has been transcribed. The resulting text is kept as part of your health log.
• Payment transaction references: retained for 7 years as required by Indian financial regulations (GST and accounting law). No card data is held by us.
• Crash logs (Firebase Crashlytics): retained for 90 days, after which they are automatically deleted by Firebase.
• Anonymised & aggregated data: may be retained indefinitely for research and product improvement. This data cannot identify any individual.

7.1 Rights Under DPDP Act, 2023 (All Indian Users)

• Right to access: request a summary of personal data we hold about you.
• Right to correction: request that inaccurate or incomplete data be corrected.
• Right to erasure: request deletion of your account and all personal data. We will process this within 30 days.
• Right to withdraw consent: withdraw consent to data processing at any time, including Health Connect permissions via your Android device settings.
• Right to grievance redressal: raise a complaint with our Grievance Officer. You may also approach the Data Protection Board of India once established.
• Right to nominate: nominate a person to exercise your data rights on your behalf in the event of your death or incapacity.

7.2 Health Connect Permissions (Android)

You can review and revoke any Health Connect permission granted to Beet.Health at any time by going to:

Revoking a permission will immediately stop Beet.Health from reading that data type. Previously generated insights may remain visible in the app until they are refreshed.

7.3 Camera and Microphone Permissions

You can review and revoke camera and microphone access at any time in Android Settings › Apps › Beet.Health › Permissions. Photo logging and voice logging will stop working; the rest of the app continues to function, and manual entry remains available.

7.4 Additional Rights for EEA / UK Users (GDPR)

• Right to data portability: receive your data in a structured, machine-readable format.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.
• Right to object: object to processing based on legitimate interest.
• Right to lodge a complaint: with your local data protection supervisory authority.

7.5 How to Exercise Your Rights

Email help@beet.health with the subject line "Privacy Request". We will respond within 30 days.

You can request deletion of your Beet.Health account and all associated personal data at any time, in either of these ways:

• By email: send a request to help@beet.health with the subject line "Delete My Account".

Deletion applies to your account as a whole. We do not offer deletion of individual records while keeping your account open.

What happens when you delete your account

• Your profile, health data, dietary logs, and progress photos are permanently deleted within 30 days.
• Payment transaction references are retained for 7 years as required by Indian financial regulations (GST/accounting law) — no card details are ever stored by us.
• Anonymised, aggregated data that cannot identify you may be retained for research and product improvement.

• Encryption in transit: all data between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: health data, biometric data, and account information stored in our databases are encrypted at rest.
• Health Connect access: data read from Health Connect is transmitted over encrypted channels and processed in our secure infrastructure.
• Stored images and documents: kept in private cloud storage and served only through short-lived signed links.
• Access controls: only authorised personnel can access personal data, limited to what is necessary for their role.
• Secure authentication: sign-in uses a one-time passcode sent to your phone number, and sessions use secure, short-lived tokens.
• Crash monitoring: Firebase Crashlytics monitors app stability without collecting identifiable health data.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at help@beet.health.

The Beet.Health Client App is intended for users aged 18 years and above. We do not knowingly collect personal data from anyone under 18.

If you are a parent or guardian and believe your child has registered without consent, contact us at help@beet.health and we will delete the account promptly.

The app integrates the following third-party services. Each has its own privacy policy:

The Beet.Health Client App does not use advertising cookies or third-party tracking pixels.

• Firebase Analytics: we use anonymised, aggregated app usage analytics via Firebase. No personally identifiable information is used for analytics.
• Session tokens: we use secure session tokens stored locally on your device to keep you logged in. These are not advertising cookies.
• Third-Party Integrations (e.g., Fitbit / Health Connect): when you choose to connect a third-party health service, the app opens a secure web portal or OS-level permissions screen hosted by that provider to authorise the data sync. That provider may place essential session cookies or tracking technologies on their own domain. Beet.Health does not control, store, or have access to these third-party cookies or your login credentials.
• Fonts and Asset Delivery: we use Google Fonts (fonts.gstatic.com) to deliver consistent typefaces within our web interfaces. While this service does not use tracking cookies, loading fonts requires your device to share its IP address with Google to request the asset.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, we have appointed a Grievance Officer:

We may update this policy from time to time. For material changes, we will:

• Notify you via an in-app banner or push notification at least 7 days before changes take effect.
• Update the Effective Date at the top of this document.
• Publish the updated policy at beet.health/privacy.

Continued use of the app after the effective date of changes means you accept the updated policy. If you disagree, you may delete your account before the effective date.