Privacy Policy

Effective: 3 July 2026 · Version 1.0

This policy explains what data Uvva AI ("we", "us" — operated by BRIDGEGAPS CONSULTING (OPC) PRIVATE LIMITED, India) collects, why, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Privacy is the product here, so we've written this in plain language.

What we collect, and why

Data	Why we collect it
Phone number	Sign-in only (OTP). Never shown anywhere, never shared, never used for marketing calls.
Nickname, age, gender, language	To personalise your coaching. A real name is never required.
Health & lifestyle inputs (symptoms you select, daily check-ins, habits)	To build your plan, track your progress, and detect warning signs that should be seen by a doctor. This is sensitive personal data and is collected only with your explicit consent, taken before the first question.
Payment status	To operate your subscription. Payments are processed by our payment gateway; we never see or store your UPI PIN or bank credentials.

What we never do

We never sell your data, to anyone, for anything.
We never show ads or share data with advertisers.
We never put health information into notifications, SMS, or email subject lines.
We never collect photos, contacts, or location.
Our analytics see app usage events only — never the content of your health data or conversations.

Where your data lives

Your data is stored encrypted (in transit and at rest) on servers located in Mumbai, India. Conversations with the coach are processed by AI service providers under contractual safeguards; they are not used to train third-party models.

Your rights (DPDP Act)

Access: you can view everything you've logged, in the app.
Correction: you can edit your profile and logs anytime.
Erasure: Settings → "Apna data delete karein" permanently deletes your profile, health data, check-ins, and conversations within 72 hours — self-serve, no questions, no friction.
Consent withdrawal: deleting your data withdraws consent. You can also just stop using the app and request erasure by email.

What we must retain (and for how long)

Record	Retention after erasure	Legal basis
Billing & invoice records	8 years	Companies Act / tax law
Consent records (that you consented, when, to what)	8 years	Proof of lawful processing
Safety audit events (e.g., "see-a-doctor guidance was shown and acknowledged" — event and timestamp only, no health detail)	3 years, pseudonymised	Establishment/defence of legal claims

Backups age out on a rolling cycle of up to 30 days after erasure.

Accounts inactive for 24 months have their health data erased automatically, with 30 days' notice.

Breach notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

Grievances

Grievance Officer, BRIDGEGAPS CONSULTING (OPC) PRIVATE LIMITED — reachable at support@uvva.life. We respond within 7 days.