Privacy Policy

Bye Bye Diabetes & Obesity ("BBDO", "we", "us") respects your privacy. This policy explains what we collect, why, how long we keep it, who we share it with, and how you can delete it. It applies to our website, our Android app, and our iOS app.

1. Information we collect

Account & identity

• Name, phone number, email, date of birth, gender, profile photo.
• Authentication data: OTP verification records (via our SMS provider MSG91), session tokens. Passwords, where used, are stored only as salted hashes.
• Role and subscription/package details.

Health & wellness data (sensitive personal data)

• Body stats: height, weight, waist, BMI history.
• Clinical data: blood glucose / HbA1c, blood pressure, lipid and other lab-report markers, medications, medical conditions, symptoms and allergies.
• Lab reports you or your coach upload (PDF/images), plus reports we retrieve on your behalf from our diagnostics partner (Thyrocare) when you book a test through the app.
• Lifestyle logs: meals and meal photos, water intake, fasting sessions, supplements, exercise, yoga, breathing and stress sessions, sleep and mood.
• Fitness data read from Google Health Connect (Android) and Apple Health (iOS) — steps, active energy, heart rate, sleep — only after you explicitly grant permission in the app.

Device & permission-based data

• Camera and photo picker: images you capture or select for meal photos, lab reports, profile pictures and chat attachments. We access only the specific files you choose; we do not scan your gallery.
• Push notification tokens (Firebase Cloud Messaging on Android, APNs on iOS).
• Biometric unlock (Face ID / fingerprint) is handled entirely by your device's secure hardware — we never receive or store biometric templates.

Communications & community

• Chat messages with your coach and our team, including attachments.
• Community posts, comments, likes and reviews/ratings you leave for coaches.

Usage & technical data

• Device model, OS version, app version, IP address, crash and diagnostic logs, in-app activity analytics, audit logs of security-relevant actions.

Payments

• Payments are processed by Razorpay. We receive order IDs, payment status, amount, invoice and coupon details. We never receive or store your full card number, UPI PIN or bank credentials.

2. How we use your information

• Deliver the BBDO programme: personalised diet plates, supplement plans, exercise/yoga protocols, fasting protocols and lab-test interpretation.
• Let your assigned coach view your logs and progress in order to guide you.
• Generate progress reports, streaks, adherence scores and shareable summaries you choose to create.
• Send transactional and programme notifications (push, email, SMS/WhatsApp) — reminders, coach messages, renewal and payment alerts. You can turn off push notifications in app or OS settings and unsubscribe from marketing email at any time.
• Process payments, subscriptions, upgrades, downgrades and refunds.
• Keep the service secure, detect fraud and abuse, and comply with legal obligations.

Health Connect / Apple Health data is used solely to display and track your activity inside the app and to compute your progress. It is never used for advertising, never sold, and never shared with third parties for their own purposes. We do not transfer Health Connect data to any third party other than our own hosting/database provider acting on our instructions.

We do not use your personal or health data for advertising or ad targeting, and we do not sell or rent it to anyone.

3. Legal basis and consent

We process your data on the basis of your consent (given at sign-up and at each OS permission prompt), performance of our contract with you, and our legal obligations under Indian law, including the Digital Personal Data Protection Act, 2023 and the IT (SPDI) Rules, 2011. You may withdraw consent at any time by revoking permissions or deleting your account.

4. Sharing and disclosure

We do not sell your data. We share only what is necessary, with:

• Supabase (AWS, Mumbai region, India) — database, authentication, file storage and serverless functions.
• Razorpay — payment processing.
• MSG91 — OTP and transactional SMS/WhatsApp.
• Google Firebase Cloud Messaging / Apple Push Notification service — push delivery.
• Thyrocare Technologies — only when you book a diagnostic test; we share the name, age, gender, phone and address required to fulfil the booking, and receive your results back.
• AI processing (Google Gemini via a secure gateway) — lab-report and food-photo interpretation. Content is sent for processing only, is not used to train third-party models, and is not retained by the provider beyond the request.
• Your assigned BBDO coach and our clinical/support staff, under confidentiality obligations and role-based access controls.
• Legal authorities, where required by law or valid court order.

All processors operate under data-processing agreements limiting them to our instructions.

5. Data storage, location and security

• Your data is stored on infrastructure located in India (AWS Mumbai).
• Encrypted in transit with TLS and at rest.
• Access is role-based, least-privilege and audited; database row-level security restricts each user to their own records, with coaches limited to their assigned clients.
• Health Connect / Apple Health data is stored under the same protections and is never written to third-party analytics.

6. Data retention

We keep your data only as long as needed for the purposes above:

Backups are rotated on a maximum 90-day cycle, so deleted data disappears from backups within 90 days.

7. Your rights and choices

• Access / portability — export all your data as JSON from Profile → Privacy & Security → Export All My Data, or email us.
• Correction — edit your profile and logs in the app, or email us.
• Deletion — delete your account and all associated data in-app from Profile → Privacy & Security → Delete My Account & All Data, or email support@byebyediabetesandobesity.com with the subject "Account Deletion Request" from your registered address. We confirm and complete deletion within 7 business days (backups purged within 90 days). Full details: Delete my account.
• Partial deletion — request removal of specific data (e.g. community posts, photos, fitness history) without closing your account.
• Withdraw permissions — revoke camera, notification, Health Connect or Apple Health access at any time in your device settings; the app continues to work with reduced functionality.
• Grievance Officer — write to support@byebyediabetesandobesity.com, subject "Grievance"; we respond within 30 days.

8. Children

BBDO is not intended for anyone under 18. We do not knowingly collect data from children. If we learn we have, we delete it promptly.

9. Medical disclaimer

BBDO provides wellness coaching and educational information. It is not a substitute for professional medical advice, diagnosis or treatment. Always consult your physician before changing medication.

10. Changes to this policy

We post updates on this page and email registered members at least 14 days before material changes take effect.