Privacy Policy

Nmami Life (“we”, “us” or “our”) is operated by Nmami Life Pvt Ltd, a company incorporated in India. We are committed to protecting your privacy and handling your personal and health information responsibly. This Privacy Policy describes what information we collect, how we use it, who we share it with, and the choices and rights available to you.

By creating an account, booking a consultation, or otherwise using our website or mobile application (collectively, the “Platform”), you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Platform.

1. Information We Collect

We collect information you provide directly, information generated by your use of the Platform, and information from third-party sources.

Account & identity information: Name, email address, mobile number, date of birth, gender, and profile photograph (optional) when you register.

Health & lifestyle information:Height, weight, body-mass index, food preferences and allergies, medical conditions, medications, lifestyle habits, and health goals — provided by you during onboarding questionnaires or consultations. This constitutes sensitive personal data or information (“SPDI”) under applicable Indian law and is processed solely to deliver your nutrition programme.

Consultation & chat data: Messages exchanged with your assigned dietitian, AI-assisted chat interactions, consultation notes, diet plans, and progress updates shared on the Platform.

Payment information: Transaction amounts, order IDs, and payment status processed through Razorpay. We do not store your card numbers, UPI credentials, or banking details — these are handled entirely by Razorpay on their PCI-DSS-compliant infrastructure.

Usage & device data: IP address, browser type, operating system, pages visited, session duration, click paths, and crash reports to help us improve reliability and performance.

Cookies & similar technologies:We use cookies and similar tools for authentication (keeping you signed in), analytics, and personalisation. You can manage cookie preferences through your browser settings; however, disabling certain cookies may affect Platform functionality. See Section 8 for more details.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: Creating and managing your account, matching you with a suitable dietitian, generating personalised nutrition plans, and facilitating follow-up consultations.
• AI-assisted features: Powering in-app chat and content recommendations. Conversations may be processed by AI models to generate responses; these interactions are retained and may be reviewed by your dietitian or our team to ensure quality and safety.
• Payments & billing: Processing subscription fees and one-time purchases, issuing receipts, and managing refunds in accordance with our Refund Policy.
• Communication: Sending appointment reminders, plan updates, service announcements, and promotional messages (you may opt out of marketing emails at any time).
• Safety & compliance: Detecting and preventing fraud, abuse, and security incidents; complying with legal and regulatory obligations.
• Research & improvement: Analysing aggregated, de-identified usage patterns to improve our services, develop new features, and conduct internal research. Individual-level health data is never used for this purpose without explicit consent.

3. Legal Basis for Processing

We process your information under the following grounds recognised by the Digital Personal Data Protection Act, 2023 (“DPDPA”) and its associated rules:

• Consent:You consent to the processing of your health and lifestyle information when you complete our onboarding questionnaire. You may withdraw consent at any time (see Section 6).
• Contractual necessity: We process account, payment, and consultation data to perform the agreement between us when you purchase a programme or book a consultation.
• Legitimate interests: We process usage and device data to maintain the security and performance of the Platform.
• Legal obligation: We may retain certain records as required by Indian tax, corporate, or health regulations.

4. Sharing Your Information

We do not sell your personal data. We share it only in the following circumstances:

• Your assigned dietitian: Your health profile, diet history, chat messages, and progress data are visible to the dietitian responsible for your plan, and to authorised administrators who oversee platform quality.
• Service providers: We engage trusted third-party processors to operate the Platform, including cloud hosting (Supabase / AWS), payment processing (Razorpay), error monitoring (Sentry), and analytics. Each provider is bound by data-processing agreements that restrict them from using your data for any purpose other than providing services to us.
• Legal requirements: We may disclose information if required by a court order, government authority, or applicable law, or to protect the safety, rights, or property of Nmami Life, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

5. Data Retention

We retain your account information for as long as your account is active or as needed to provide services to you. Health and consultation data is retained for a minimum of three (3) years following your last active consultation, or as required by applicable regulations, whichever is longer. Anonymised, aggregated data may be retained indefinitely for research and analytics.

When you request account deletion, we will delete or anonymise your personal data within thirty (30) days, except for data we are legally required to retain.

6. Your Rights

Subject to the DPDPA and applicable law, you have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your account and personal data (subject to legal retention requirements).
• Withdrawal of consent: Withdraw consent for processing your health data at any time. Withdrawal will not affect the lawfulness of prior processing. Note that withdrawal may limit or prevent us from delivering certain services.
• Grievance redressal: Lodge a complaint with our Grievance Officer if you believe your data has been handled unlawfully.

To exercise any of these rights, email us at ask@nmami.in. We will respond within thirty (30) days of receiving a valid request.

7. Data Security

We implement appropriate technical and organisational measures to protect your information, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Row-level security in our database ensuring that users can only access their own records, and dietitians can only access records of their assigned clients.
• Role-based access controls so that only authorised personnel can access personal or health data.
• Automated monitoring and alerting for unusual access patterns or security incidents.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in risk to you, we will notify affected users and relevant authorities as required by law.

8. Cookies & Tracking Technologies

We use the following categories of cookies:

• Strictly necessary: Authentication tokens and session management. These cannot be disabled without breaking core Platform features.
• Analytics: Aggregated, anonymised data on how users navigate the Platform (e.g., page views, feature usage) to improve the product.
• Functional: Remembering your preferences such as language or notification settings.

We do not use third-party advertising or tracking cookies. You can manage cookie preferences in your browser settings. Removing authentication cookies will sign you out of the Platform.

9. Children’s Privacy

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with their data, please contact us immediately at ask@nmami.in and we will take steps to delete the information.

10. Links to Third-Party Websites

The Platform may contain links to external websites or social media profiles. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or by email at least fourteen (14) days before the changes take effect. Your continued use of the Platform after that date constitutes acceptance of the updated Policy.

12. Grievance Officer & Contact

In accordance with the Information Technology Act, 2000 and rules made thereunder, the name and contact details of the Grievance Officer are:

Grievance Officer: Nmami Life Pvt Ltd
Email: ask@nmami.in
Response time: We will acknowledge your grievance within 24 hours and resolve it within 30 days of receipt.