HINDVED EDUCATION AND LABS LLP
Integrated Preventive Wellness & Digital Health Ecosystem

1. Introduction

Hindved is building an integrated preventive wellness and digital-health ecosystem across education, technology, professional development, corporate wellness, and community healthcare. Delivering these Services — enrollment, payment, program access, certification, and ongoing support — requires us to collect certain information about you. This Policy sets out what we collect, why, and what choices you have.

This Policy applies to all users of Hindved Services, including individual learners, corporate/institutional participants, website visitors, mobile app users, and practitioners in our expert network.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, Hindved acts as the Data Fiduciary in respect of the personal data you provide to us. This Policy is also intended to serve as our privacy policy under Section 43A of the Information Technology Act, 2000 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and should be read in line with the Information Technology Act, 2000 and the Indian Contract Act, 1872.

2. Information We Collect

Information you provide directly

• Contact details — name, email address, phone/WhatsApp number, postal address;
• Enrollment and account information — program selections, registration details, login credentials;
• Payment-related details submitted at checkout (see Section 5 below on how payment data specifically is handled);
• Health, lifestyle and wellness information you voluntarily share as part of a program — for example, laboratory reports, health assessments, fitness goals, or lifestyle questionnaires;
• Communications with us — support requests, feedback, testimonials, and correspondence;
• Corporate/institutional details, where you enroll on behalf of an organization — company name, designation, and relevant business contact information.

Information collected automatically

• Technical data — IP address, browser type, device information (such as device model, operating system, unique device or advertising identifiers, and push-notification tokens), and crash/diagnostic logs;
• Usage data — pages or screens visited, features used, time spent, referring website, general interaction with our website and digital platforms;
• Cookies and similar tracking technologies (see Section 8).

Information you choose to give through device permissions

Our mobile apps may request access to certain device features (for example camera, photo gallery, microphone, notifications, or approximate location) only where needed for a feature you choose to use. You can grant or withdraw these permissions at any time in your device settings; the core Services will continue to function wherever the feature is not essential.

3. Consent, Legal Basis & Purpose

We process your personal data only on the basis of (a) your free, specific, informed, unconditional and unambiguous consent, given by a clear affirmative action; or (b) a "legitimate use" recognised by the DPDP Act — for example, to perform a service you have requested, to comply with law or a court order, or to respond to a medical emergency or threat to life.

We collect only the personal data that is necessary for the purposes stated in this Policy and do not use it for an incompatible purpose without fresh consent. You may withdraw consent at any time by writing to us (see Section 21); withdrawal will not affect the lawfulness of processing done before withdrawal, but we may be unable to continue providing the Services that depend on that data. Information shared with us by someone on your behalf (for example, an employer or institution) is processed on the basis of the consent or authority they have confirmed to us.

4. How We Use Your Information

We use collected information to:

• Process enrollment, registration, and payment;
• Deliver programs, classes, certifications, and related services;
• Provide customer support and respond to enquiries;
• Send transactional communications — payment confirmations, schedules, program updates, certificates;
• Improve our programs, website, mobile apps, and digital platforms;
• Conduct health-risk assessments and wellness tracking as part of an enrolled program;
• Prevent fraud, abuse, and security incidents, and enforce our Terms;
• Meet legal, regulatory, tax, and compliance obligations; and
• With your consent, send promotional communications about programs and offers, which you may opt out of at any time.

5. Payment Information

Payments for Hindved programs are processed through Razorpay or other authorized third-party payment gateways. Hindved does not store your full card number, CVV, UPI PIN, or net-banking credentials on its own servers — these are handled directly by our payment gateway partner(s) in accordance with applicable payment-security standards (such as PCI-DSS) and Reserve Bank of India guidelines.

Where you purchase through the Apple App Store or Google Play Store, the transaction is processed by Apple or Google under their own terms and privacy policies, and we receive only limited confirmation details (such as purchase status and product).

We retain transaction records (amount, date, program purchased, payment status) as required for accounting, invoicing, refund processing, and legal compliance.

6. Health & Wellness Information

Certain Hindved programs involve you voluntarily sharing health-related information — such as lab reports, existing conditions, fitness levels, or lifestyle habits — so that a program can be tailored appropriately. This is treated as "sensitive personal data or information" under the SPDI Rules, and we collect it only after obtaining your express consent, in writing or through electronic means, for the stated purpose.

We treat this information with additional care:

• It is collected only where relevant to the specific program you've enrolled in;
• It is used solely for program delivery, coaching guidance, and wellness tracking — not sold, rented, or used for unrelated purposes or targeted advertising;
• It is not a substitute for medical records, and sharing it with Hindved does not create a doctor-patient relationship unless the specific service is expressly delivered by a licensed healthcare professional within their authorized scope;
• Access to this information within Hindved is limited to personnel and practitioners directly involved in delivering your program and bound by confidentiality;
• You may decline to provide this information, or withdraw your consent and request its deletion, at any time; we may then be unable to tailor or continue the relevant program.

Please do not share health information about another person unless you are authorised to do so (for example, as a parent or lawful guardian).

7. Sharing of Information

We do not sell your personal information. We may share information with:

• Service providers (Data Processors) who help us operate — payment gateways (e.g. Razorpay), cloud hosting, learning-management and platform providers, communication tools (email, WhatsApp, video-conferencing), and analytics providers — bound by written contracts imposing confidentiality, security, and purpose-limitation obligations;
• Trainers and practitioners directly delivering the program you've enrolled in, to the extent necessary for that delivery;
• Corporate or institutional partners, where you have enrolled through a corporate, school, or CSR program, limited to information relevant to that engagement;
• Legal and regulatory authorities, where required by applicable law, court order, or lawful government request, or to protect the rights, property, or safety of Hindved, our users, or the public; and
• Successors, in the event of a merger, acquisition, or business restructuring, subject to this Policy continuing to apply to your information.

Where Hindved is responsible for a Data Processor's handling of your data, we remain accountable for it under the DPDP Act.

8. Cookies & Tracking Technologies

Our website and digital platforms may use cookies and similar technologies to remember your preferences, understand how our Services are used, and improve functionality. Non-essential cookies (such as analytics and marketing cookies) are used only with your consent where required. You can control cookies through your browser settings or any cookie banner we present; disabling certain cookies may affect the functionality of our website or platform.

9. Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction, consistent with applicable Indian law, including reasonable security practices under the Information Technology Act, 2000 and rules made thereunder. These include access controls, encryption in transit, and confidentiality obligations on personnel and vendors.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for activity under your account.

10. Personal Data Breach

If a personal data breach occurs that affects your information, we will, as required by applicable law, notify the Data Protection Board of India and the affected users, describing the nature of the breach, its likely consequences, and the steps taken to mitigate it and what you can do to protect yourself. We will also report cyber-security incidents to CERT-In within the timelines prescribed under the Information Technology Act, 2000 and directions issued under it.

11. Data Retention

We retain personal information for as long as necessary to deliver the Services, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. Once the purpose is no longer served and retention is not required by law, we erase the data or anonymize it. Health-related information voluntarily shared as part of a program is retained only as long as relevant to that program and applicable record-keeping requirements, after which it may be securely deleted or anonymized.

Transaction and tax records are retained for the period required under applicable Indian tax and company/LLP laws. Certain logs may be retained for at least one year as required by law.

12. Children's Information

Most Hindved Services are intended for adults aged 18 and above, and we do not knowingly collect personal data from a child (a person under 18 years of age) without verifiable consent of the parent or lawful guardian.

Where a Hindved program is specifically designed for schools, colleges, or younger participants (for example, institutional health programs), participation and any related data collection will be conducted only with verifiable parental/guardian consent (or that of the institution acting with such authority), in line with the DPDP Act. We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, and we do not process children's data in any manner likely to cause detrimental effect on their well-being. If you believe a child has provided us data without proper consent, please contact us (Section 21) and we will delete it promptly.

13. Your Rights

Subject to applicable law (including the DPDP Act and the rules made under it, as and when their provisions come into force, and the SPDI Rules), you have the right to:

• Access a summary of the personal information we hold about you and the processing activities, and the identities of those with whom it has been shared;
• Request correction of inaccurate or misleading information, completion of incomplete information, and updating of information;
• Request erasure of your personal information, subject to our legal and record-keeping obligations;
• Withdraw consent for processing (such as promotional communications) at any time, with a process as easy as that of giving consent;
• Nominate another individual to exercise your rights in the event of your death or incapacity; and
• Access readily available grievance redressal and raise a grievance regarding how your information is handled (see Section 21). If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, after first exhausting our grievance process.

To exercise these rights, contact us using the details in Section 21. We may need to verify your identity before actioning certain requests, and may decline requests that are manifestly unfounded or that we are legally required or permitted to refuse. You agree to give us accurate and complete information, and to promptly update it.

14. Third-Party Links & Services

Our website and platforms may link to or integrate third-party services (payment gateways, social media, video platforms, communication tools, app stores). These third parties have their own privacy policies, and Hindved is not responsible for their independent data practices. We encourage you to read their policies before sharing information with them.

15. International Users & Cross-Border Transfer

Hindved is currently building and operating primarily in India, with our expert network and delivery expanding toward a global platform. Our servers or service providers may be located outside India. We transfer personal data outside India only to the extent permitted under the DPDP Act and any restrictions notified by the Central Government, and subject to appropriate contractual safeguards.

If you access our Services from outside India, your information may be processed in India, where data-protection standards may differ from those in your home jurisdiction. By using our Services, you consent to this processing. Users in jurisdictions with mandatory local data-protection laws are responsible for ensuring their use of the Services is lawful in their location.

16. Our Mobile Apps: The Twinkle Club & Supplement Mastery School

Hindved offers the mobile applications listed below (each an "App"). This Section applies specifically to your use of the Apps, in addition to the rest of this Policy. If there is a conflict between this Section and the rest of this Policy on a point concerning an App, this Section prevails for that App.

16.1 Who is responsible

Both Apps are owned, operated, and published by Hindved Education and Labs LLP, which is the Data Fiduciary for personal data collected through them. Apple Inc. and Google LLC are independent third parties that distribute the Apps; they are not responsible for the Apps or this Policy, and their own terms and privacy policies apply to your use of their stores and devices.

16.2 Data we collect through the Apps

• Account data — name, email address, phone number, and login credentials (stored in protected form);
• Profile and programme data — enrolment, progress, course/community activity, assessments, and any content you submit or upload (for example posts, comments, photos, or documents);
• Health or wellness inputs you voluntarily provide, which are handled as set out in Section 6;
• Device and usage data — device model, operating system version, app version, unique identifiers, push token, crash logs, and in-app activity; and
• Purchase confirmations from the app stores or our payment gateway, as described in Section 5.

We do not knowingly collect precise location, contacts, or SMS content through the Apps; if a future feature requires any of these, we will ask for your explicit permission at that time and update this Policy.

16.3 Permissions

The Apps ask for permissions (such as notifications, camera, photo library, or microphone) only when you use a feature that needs them. Denying a permission may limit that feature but will not affect unrelated parts of the App.

16.4 How App data is used

We use App data only to create and manage your account, deliver content and programmes, process purchases and memberships, send service and (with your consent) promotional notifications, provide support, secure the Apps, analyse and fix crashes and performance, and comply with law. We do not sell App data and do not use health or wellness data for advertising.

16.5 Sharing App data

App data is shared only as described in Section 7 — for example with hosting, analytics, communication, and payment providers acting on our instructions, with trainers or community moderators to the extent needed to run your programme, and with authorities where required by law. Content you post in community or social areas of an App may be visible to other users, so please do not post information you wish to keep private.

16.6 Account deletion and data removal

You may request deletion of your account and associated personal data at any time from within the App (where the option is provided) or by writing to our Grievance Officer at the email address in Section 21 from the email address or phone number registered to the account. We will action verified requests within a reasonable time, not exceeding 30 days, except for data we must keep under law (for example, transaction records), or that we need to resolve a dispute or enforce our terms. Deleting the App from your device does not by itself delete your account or data.

16.7 App-store disclosures

The privacy "nutrition label" / Data Safety information we provide to Apple and Google is intended to match this Policy. In case of any difference, please contact us and we will correct it promptly.

16.8 Rules for users of the Apps

• You must be at least 18 years of age (or use the Apps with verifiable parental/guardian consent and supervision) and legally capable of entering into a contract under the Indian Contract Act, 1872;
• You must provide accurate information and keep your login credentials confidential;
• You must not upload unlawful, defamatory, obscene, infringing, or harmful content, impersonate another person, attempt to hack, reverse-engineer, scrape, or disrupt the Apps, or share another person's personal data without authority;
• We may remove content or suspend or terminate accounts that violate this Policy, our Terms, or applicable law, and may report unlawful activity to the authorities as required.

16.9 Health, nutrition and supplement information

Content in the Apps — including anything relating to nutrition, dietary supplements, wellness, or lifestyle — is provided for general educational and informational purposes only. It is not medical advice, diagnosis, or treatment, and no statement has been evaluated as a claim to diagnose, cure, treat, or prevent any disease. Individual results vary. Consult a qualified, licensed healthcare professional before starting or changing any supplement, diet, or exercise programme, especially if you are pregnant, nursing, have a medical condition, or take medication. Never disregard professional medical advice or delay seeking it because of something you read in an App. Products referred to in any App are subject to applicable Indian law, including the Food Safety and Standards Act, 2006 and rules made under it.

16.10 Updates to the Apps

We may update the Apps from time to time. Updates may change what data is collected; where a change is material, we will notify you in the App or by other reasonable means and obtain fresh consent where required.

17. Communications & Marketing

We send transactional messages (such as payment confirmations, schedule changes, and security alerts) as part of the Services. We send promotional messages by email, SMS, WhatsApp, or push notification only where you have consented or where permitted by law, and in compliance with the Telecom Commercial Communications Customer Preference Regulations (TRAI), including any Do Not Disturb preferences. You may opt out at any time using the unsubscribe link, replying "STOP", changing device notification settings, or writing to us. Opting out of marketing will not stop essential service messages.

18. Disclaimers & Limitation of Liability

The Services are provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, Hindved will not be liable for any indirect, incidental, special, or consequential loss arising from your use of the Services, or from unauthorised access to your information that occurs despite our reasonable security practices or due to your own failure to safeguard your credentials or devices. Nothing in this Policy excludes or limits any liability that cannot be excluded or limited under applicable Indian law, including your statutory rights under the Consumer Protection Act, 2019 and the DPDP Act.

Educational, wellness, and supplement-related content in our Services is informational and does not replace professional medical, legal, or financial advice.

19. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our Services, technology, or legal requirements. The updated version will be published on our website and, for the Apps, within the App, with a revised "Last Updated" date. Where a change is material, we will give you reasonable notice and, where the law requires, seek your fresh consent. Continued use of our Services after an update constitutes acceptance of the revised Policy.

20. Governing Law & Jurisdiction

This Policy and any dispute arising from it are governed by the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the Indian Contract Act, 1872. Subject to your statutory rights, including the right to approach consumer forums or the Data Protection Board of India where available, and subject to any mandatory legal provisions, the courts at [City, State], India shall have exclusive jurisdiction. We encourage you to first contact our Grievance Officer so that we can try to resolve the matter amicably.

21. Grievance Officer & Contact

For questions, requests, or grievances regarding this Privacy Policy or how your information is handled, you may contact our Grievance Officer. We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days of receipt, or such shorter period as the law requires:

HINDVED EDUCATION AND LABS LLP

Website: [Official Hindved Website]
Support Email: [Official Email Address]
Contact Number: [Official Contact Number]
Registered Office: [Registered Office Address]

Grievance Officer: [Name]
Grievance Email: [Email Address]

© HINDVED EDUCATION AND LABS LLP — Integrated Preventive Wellness & Digital Health Ecosystem