Privacy Policy

1. Who We Are

Ovyacare ("we", "us", "our"), based in Coimbatore, Tamil Nadu, India, is the Data Fiduciary responsible for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This policy covers the Ovyacare website and the Ovyacare mobile application, which provide menstrual cycle tracking, period and fertility predictions, symptom and wellness logging, personal health-record management, and optional connections to hospitals and healthcare providers (together, the "Services").

2. Who Can Use Ovyacare — Users Under 18

Our Services are intended for adult women and for adolescent girls who have reached menarche (their first period). Under the DPDP Act, every person under 18 years of age is a child, and we may process a child's personal data only with the verifiable consent of her parent or lawful guardian, obtained before any personal data is collected.

• If you are under 18, your parent or legal guardian must provide verifiable consent before you create an account or log any data.
• Parents and guardians may review, correct, export, or request deletion of their child's data by contacting us at admin@ovyacare.com.
• We do not undertake tracking or behavioural monitoring of children, and we do not direct targeted advertising at children.
• Cycle predictions and reminders for users under 18 are generated solely to provide the health features requested — never for advertising or monetisation.

3. Information We Collect

We collect only the information needed to provide the Services. In plain terms:

4. How We Use Your Information

Each purpose below is tied to the data it uses:

• Generate your period, ovulation, and fertile-window predictions, symptom insights, and reminders — from the cycle and health data you log.
• Create and maintain your account, sync your data across devices, and deliver in-app content — from your account information.
• Respond to care, class, or support requests you submit — from the contact details you provide with the request.
• Understand aggregate usage and fix crashes so we can improve the Services — from pseudonymous technical and usage data.
• Protect against fraud, unauthorized access, and security threats, and comply with legal obligations.
• We never use your health data — including menstrual, fertility, sexual-activity, or pregnancy data — for advertising or marketing, and we never sell it or share it with advertisers, ad networks, or data brokers.

5. Legal Basis and Consent

We process your personal data on the basis of your consent, given by a clear affirmative action before we collect your health data. For users under 18, we rely on the verifiable consent of a parent or lawful guardian. In limited cases we process data without consent only for the legitimate uses recognised by Section 7 of the DPDP Act, such as complying with a law or court order or responding to a medical emergency. You may withdraw your consent at any time — withdrawing is as easy as giving it: delete your account in the app, or write to admin@ovyacare.com. After withdrawal we stop processing your data, except where retention is required by law.

6. How We Share Information

We do not sell, trade, or rent your personal data, and we never share your health data with advertisers or data brokers. Your data is shared only:

• With people you choose — for example, when you export a cycle report or share a test result with a doctor or a person you name. For users under 18, sharing controls also rest with the parent or guardian.
• With the hospital or clinic you choose to connect your account to — your reports, appointments, and visit records sync with their system so your care team can treat you; they handle that data under their own policies (see our Terms, Section 8).
• With service providers that run the platform under our instructions and data-protection agreements: Amazon Web Services (Mumbai, India — hosting, storage, authentication, email and SMS delivery), Expo (USA — push-notification delivery), Mixpanel (USA — product analytics under a pseudonymous identifier), Sentry (USA — crash reporting), Contentful (Germany/USA — educational content delivery), and Brevo (Europe — email delivery for website contact-form enquiries). Our website uses Google Analytics and Vercel Analytics (usage data only — never your health data). We remain responsible for their processing of your data.
• With our care-operations team when you request a care service or enrol in a class — your name, phone number, and city are shared to fulfil that request.
• When required by law, court order, or to protect safety and rights.
• Your health records are stored in India (AWS Mumbai region). Limited technical and usage data is processed by the providers named above in the United States and Europe, in compliance with Section 16 of the DPDP Act.

7. Data Security Measures

We protect your data with:

• Encryption in transit (TLS) and encryption at rest on our servers (industry-standard AES-256 server-side encryption).
• Role-based access controls limiting data to authorized personnel on a need-to-know basis.
• Regular security audits and vulnerability assessments.
• Secure authentication mechanisms for user accounts.

8. Data Retention

Health data you record is retained while your account is active and is deleted when you delete your account. Uploaded medical files are retained for a maximum of 10 years, or until you delete them or your account, whichever comes first; residual copies in versioned storage and backups are purged on scheduled cycles. After account deletion we keep only a minimal internal deletion record (an internal identifier and the deletion date) for audit purposes, and any records we are legally required to retain. Analytics and crash logs are retained by our providers for limited periods under their agreements with us. One-time passwords and temporary uploads are deleted within minutes to one day.

9. Account and Data Deletion

You can delete your account and associated personal data at any time from within the app (Profile → Data & privacy → Delete account), by visiting ovyacare.com/delete-account for instructions, or by emailing admin@ovyacare.com from your registered email address. Upon a verified request we delete your account and personal data within 30 days, except records we must retain under applicable law. Parents and guardians may request deletion of a child's data the same way.

10. Your Rights

Under the DPDP Act you have the right to:

• Access your personal and health data, including a summary of processing — you can export your data from within the app (the in-app export currently covers your profile, cycle settings, period, symptom and tracker logs, medications, appointments, and medical records) or request a complete copy of all your data by emailing us.
• Correct, complete, or update inaccurate or incomplete information.
• Erase your personal data, subject to legal retention requirements.
• Nominate another individual to exercise your rights in the event of your death or incapacity (Section 14, DPDP Act).
• Raise a grievance with our Grievance Officer, and — if unresolved — complain to the Data Protection Board of India.
• To exercise any right, use the in-app controls or email admin@ovyacare.com from your registered email; we respond within the timelines prescribed by law.

11. Data Breach Notification

If a personal data breach affects your data, we will notify you without delay in clear and plain language — describing the breach, its likely consequences, the measures we are taking, and steps you can take to protect yourself — and we will notify the Data Protection Board of India within the timelines prescribed under the DPDP Rules, 2025.

12. Cookies and Analytics

Our website uses cookies and analytics tools (Google Analytics, Vercel Analytics) to understand aggregate usage; you can refuse cookies in your browser settings, though some features may not function properly. Our mobile app does not use cookies; it includes analytics (Mixpanel) and crash-reporting (Sentry) software that collect usage events and device information under a pseudonymous identifier — never the content of your health logs for advertising. We do not use cookies or analytics for behavioural tracking, profiling, or targeted advertising of users under 18.

13. Changes to This Policy

We will notify you of material changes by email and in-app notice at least 15 days before they take effect. Where a change involves new or expanded purposes for processing your personal data, we will seek your fresh consent — and, for users under 18, the verifiable consent of a parent or guardian — before applying the change to you. Non-material updates take effect on posting with a revised effective date.

14. Grievance Officer

Grievance Officer, Ovyacare, Coimbatore, Tamil Nadu, India — email admin@ovyacare.com. We acknowledge complaints within 24 hours and resolve them within 15 days, and in any event within the periods prescribed under applicable law. The Grievance Officer is also the designated contact for questions about the processing of your personal data under the DPDP Act. If you are not satisfied with our response, you may complain to the Data Protection Board of India.