Privacy Policy

Effective: 13 July 2026 · Version 1.5

This policy explains what data Uvva AI ("we", "us" — operated by BRIDGEGAPS CONSULTING (OPC) PRIVATE LIMITED, India) collects, why, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Privacy is the product here, so we've written this in plain language.

What we collect, and why

Data	Why we collect it
Phone number (or Google sign-in)	Sign-in only. We send a one-time code to your phone, or verify your Google account if you choose that option. Never shown anywhere, never shared, never used for marketing calls.
Nickname, age, gender, language	To personalise your coaching. A real name is never required.
Health & lifestyle inputs (symptoms you select, daily check-ins, habits), and durable notes our AI keeps to personalise your coaching	To build your plan, track your progress, and flag things that may be worth discussing with a doctor. This is sensitive personal data and is collected only with your explicit consent, taken before the first question.
Payment status	To operate your subscription. Payments are processed by our payment gateway; we never see or store your UPI PIN or bank credentials.
Device & notification data (a push token, device type, app version, crash diagnostics)	To deliver reminders and coaching nudges, keep the app stable, and fix crashes. Notifications are always generic — we never put health details in them.
Voice & audio (only if you use the optional voice coach)	To let you speak with the coach and hear replies. Your speech is transcribed to text in real time and the audio itself is not stored; we never create a voiceprint. Full detail in "Voice & audio data" below.

What we never do

We never sell your data, to anyone, for anything.
We never show ads or share data with advertisers.
We never put health information into notifications, SMS, or email subject lines.
We never collect photos, contacts, or location.
Our own usage analytics see app events only (like "opened the app" or "completed a check-in") — never the content of your health data or conversations.

Where your data lives

Your account and health data are stored in an encrypted database hosted in the Mumbai, India region, and all data is encrypted in transit (HTTPS). The voice coach also stays in India: the real-time voice connection runs on Pipecat Cloud's Mumbai (Asia Pacific) region and speech-to-text is handled by Sarvam AI in India, and the audio itself is never stored. The one part of the service processed outside India is the coach's AI — your messages (typed, or spoken once transcribed to text) are sent to Google's Gemini AI, which runs on Google's global infrastructure. India's DPDP Act permits this cross-border processing with your consent and this disclosure.

Who else processes your data

We keep the circle of data-sharing as small as possible. To run the service we rely on a few trusted processors, each handling only what its job needs:

Google Firebase — secure phone sign-in (one-time code), push notifications, and crash diagnostics (release builds only).
Google (Gemini AI) — when you chat with the coach (by text, or by voice once it has been transcribed to text), your message and limited context (nickname, age, gender, recent check-ins) are sent to Google's Gemini AI to generate the reply — never your phone number, and only what's needed to answer you. Google may use this content to operate and improve its AI services; please avoid sharing anything you would not want processed by a third-party AI service.
Sarvam AI (India-hosted) — if you use the voice coach, converts your speech to text and the coach's text back to speech.
Pipecat Cloud (operated by Daily) (Mumbai, India region) — if you use the voice coach, carries the real-time in-app voice connection; it transports audio but does not store it.
Supabase — hosts our encrypted database in the Mumbai region.
PhonePe — processes your subscription payment when you subscribe; we never see or store your UPI PIN or bank credentials.

We never sell your data or share it with advertisers.

Voice & audio data

The voice coach is optional. It works entirely inside the app over a real-time connection (WebRTC) — there are no phone calls, no telephone numbers, and no PSTN telephony of any kind. When you use it:

We do not store your voice. Your speech is transcribed to text in real time and the audio is discarded immediately. There are no call recordings.
No voiceprint, ever. We do not create voice biometrics and do not use your voice to identify or authenticate you.
Transcripts are off by default. If you choose to turn them on, transcripts are stored only in our own India-hosted database, are covered by all the rights below (view, export, or delete anytime), and are kept only while your account is active.
Zero-retention voice providers. Our voice providers (Sarvam, Pipecat) are engaged on zero-data-retention terms — they process audio only in the moment and do not log, store, or train on it. The transcribed text is then handled by the coach's AI (Google Gemini) on the same terms as your typed chats.
Minimal safety log only. To evidence that safety guidance worked, we keep a small event record — a timestamp, a rule identifier, and the action taken — with no conversation content.

Using the voice coach requires its own specific consent — granting the microphone permission and confirming voice capture. This is never bundled into your general acceptance of these terms, and you can withdraw it anytime by turning voice off.

Cookies & tracking

The Uvva AI app is a native Android app and uses no cookies. It contains no advertising SDKs, no ad identifiers, and no third-party analytics or tracking tools — our usage analytics are our own and record only anonymous event counts. Our website (uvva.life) uses only strictly-necessary cookies set by our hosting provider to serve the pages securely, with no tracking or advertising cookies.

Your rights (DPDP Act)

Access: you can view everything you've logged, in the app.
Correction: you can edit your profile and logs anytime.
Erasure: Settings → "Apna data delete karein" permanently deletes your profile, health data, check-ins, conversations, and any voice transcripts within 72 hours — self-serve, no questions, no friction. Because raw audio is never stored and our voice providers retain nothing, there is nothing further to delete on their side.
Consent withdrawal: deleting your data withdraws consent. You can also just stop using the app and request erasure by email.
Nominate: you may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

What we must retain (and for how long)

Record	Retention after erasure	Legal basis
Billing & invoice records	8 years	Companies Act / tax law
Consent records (that you consented, when, to what)	8 years	Proof of lawful processing
Safety audit events (e.g., "see-a-doctor guidance was shown and acknowledged" — event and timestamp only, no health detail)	3 years, pseudonymised	Establishment/defence of legal claims

Backups age out on a rolling cycle of up to 30 days after erasure.

We aim to erase health data from accounts left inactive for a long period (around 24 months) after giving you notice — and you can delete everything yourself, anytime, from inside the app.

Breach notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

Grievance Officer

In accordance with the Information Technology Act, 2000, the rules made thereunder, and the Consumer Protection (E-Commerce) Rules, 2020, the name and contact details of the Grievance Officer are provided below. If you have any complaint or concern about how your data is handled, or about any content or transaction on the Platform, you may contact:

Name: Surabhi Minocha
Designation: Grievance Officer & Director
Company: BRIDGEGAPS CONSULTING (OPC) PRIVATE LIMITED
Address: 23, 80 Feet Road, HAL 3rd Stage, New Tippasandra, Indiranagar, Bengaluru, Karnataka 560075, India
Email: support@uvva.life
Phone: +91 81054 16612
Time: Monday – Friday (9:00 – 18:00 IST)

We acknowledge every grievance within 48 hours and endeavour to resolve it within 7 days of receipt. If you are not satisfied with our response, you may complain to the Data Protection Board of India.