India Privacy Notice

Appy + Yaar is operated by Her Holistic Health Ltd ("HHH Ltd"), a company registered in the United Kingdom. Under DPDPA Section 2(i), HHH Ltd is the Data Fiduciary determining the purpose and means of processing your personal data.

For general questions: info@herholistichealth.co.uk. For data-protection matters: divpreetsacha@herholistichealth.co.uk.

Information you share about your menstrual cycle, fertility treatment, symptoms, wellbeing scores, and reproductive history is treated as sensitive personal data under DPDPA Schedule 2.

We ask for this data only with your free, specific, informed, and unambiguous consent, given by a clear affirmative action at the point you enter it. Your consent for health data is separate from your consent to our general terms. You are never required to share health information to use the app, you choose what to enter and what to leave blank.

You can withdraw your consent at any time from Your Data Choices. Withdrawal stops further processing but does not undo processing that already happened lawfully before withdrawal.

Account data: your email address and a hashed password (we use Supabase for authentication, your password never reaches us in plain text).

Profile data (optional): pillar choice (Appy / Yaar / Apni), language preference, generation, location, fertility goals, and any conditions you choose to record.

Health and fertility data (sensitive, explicit consent only): cycle tracking, symptom logs, fertility treatment history, wellbeing check-ins, reflection entries, GP / clinic summaries you generate.

Chatbot messages: sent to Anthropic for processing and returned to you. Not retained by us beyond your active session.

Technical data: basic usage events (article read, pathway completed) to improve the product.

You have the following rights under Section 11–14 of DPDPA. We will action any request within 30 days:

• • Right of access, a summary of the personal data we hold about you, and the categories of processing.
• • Right of correction, ask us to fix anything inaccurate or incomplete.
• • Right of erasure, ask us to delete your data. We will action within 30 days unless retention is required by law.
• • Right to withdraw consent, you can revoke consent for any purpose at any time, including for sensitive health data and any research participation.
• • Right to grievance redressal, raise a complaint with our Grievance Officer (below) or escalate to the Data Protection Board of India.
• • Right of nomination, nominate another person to exercise your rights in the event you are unable to (DPDPA Section 14).

To exercise any of these, use Your Data Choices or email divpreetsacha@herholistichealth.co.uk.

We commit to acknowledging any grievance within 72 hours and resolving it within 30 days, as required by DPDPA Section 8(10). If you are not satisfied with our response, you have the right to escalate to the Data Protection Board of India.

Because HHH Ltd is based in the United Kingdom, your personal data is processed outside India. Specifically:

• • Supabase, our database and authentication provider, EU-hosted.
• • Vercel, our hosting and edge-network provider, global infrastructure with data-residency controls.
• • Anthropic, our chatbot AI provider, United States-hosted. Messages you send to the chatbot are processed under Anthropic's data-processing terms and are not used to train their models.

India and the United Kingdom currently have no adequacy agreement for personal data transfers. Where required, we rely on Standard Contractual Clauses and the individual data-processing terms of each provider to keep your data protected to a level equivalent to UK GDPR. The Indian government may, in future, designate countries to or from which transfers are restricted under DPDPA Section 16, and we will update this notice if our processing locations change.

Account and profile data: as long as your account is active, plus 30 days after deletion to handle recovery and any legal obligations. Health and fertility data: same retention as your account. Usage events: anonymised after 12 months. Chatbot messages: not stored by us beyond the active session. Full detail in our Data Retention Policy.

We do not knowingly collect data from anyone under 18 years of age in India. Under DPDPA Section 9, processing children's data requires verifiable parental consent and we do not offer the service to under-18s in India at this time. If you believe a child has created an account, contact our Grievance Officer and we will delete it.

All traffic to the app is encrypted in transit (TLS). Passwords are hashed by Supabase with industry-standard algorithms. Database access is restricted by Row-Level Security, other users cannot see your data. We will notify you and the Data Protection Board of India of any personal data breach affecting your information without undue delay, as required by DPDPA Section 8(6).

We will notify you in-app and by email of any material changes, with at least 14 days' notice. The date at the top of this page shows when it was last updated.