Privacy Policy
NAVA AI Wellness Companion — Vital Links Pvt. Ltd.
Version 2.0 | Effective: 13 October 2026
1. Who We Are
Vital Links Pvt. Ltd. is the Data Fiduciary under the Digital Personal Data Protection Act, 2023.
| Detail | Information |
|---|---|
| Company | Vital Links Pvt. Ltd. |
| CIN | U62099DL2025PTC454795 |
| Data Protection Officer | Mahima Sharma |
| DPO Email | dpo@vitallinks.co.in |
| Registered Office | New Delhi, India |
2. What We Collect and Why
Account & Identity
Phone number, name, age, gender and email (optional), used to create your account and personalise NAVA. Not shared with anyone.
Health Vitals
Heart rate, heart rate variability, breathing rate, blood pressure estimates and stress, used to show your wellness signals. These are estimates, not clinical measurements. Never sold.
Family Health
Family members’ names, relationships and the check-ins they choose to share, used to let you look after your family’s wellness. Shared only with the family members you choose, and only with their consent.
Nutrition
Meal photos, food preferences and allergies, used to estimate nutrition and suggest affordable, local improvements. Photos are analysed by Google Gemini (see section 3) and deleted after analysis. Never sold.
Lifestyle
Wake and sleep times, work type, meal times and movement habits, used to fit suggestions around your day.
Community Health Worker Programme
If you are a health worker approved for the Community programme, the app records the people you serve: name, age, sex, height, weight, village, district and state, their wellness scan results, and any referral you raise. This data is about them, not you. You record it on their behalf, with their consent, which is taken before each scan and can be withdrawn at any time.
Community mode is restricted to phone numbers that a programme administrator has approved in advance. No one else can enter it, and no programme data can be reached without that approval. Workers see only the people in their own cluster, and supervisors see only their own workers.
If a health worker scanned you and you want your data accessed, corrected or deleted, contact the DPO below or ask any worker in your programme. The rights in section 4 apply to you whether or not you use the app yourself.
3. AI and Third-Party Processing
NAVA asks your permission in the app before any of your data is sent to the providers below. The permission screen names each provider and says what it receives. If you do not agree, nothing is sent, and scans, reports and photo analysis are unavailable. You can withdraw at any time in Settings > Privacy & data.
- CarePlix (India) measures your wellness signals from the face scan. It receives the scan signal from your camera (not a video), your date of birth, sex, height and weight.
- Google Gemini (Google LLC, USA) writes your report, diet and grocery plan and coach script. It also analyses the meal, skin and prescription photos you choose. It receives your scan results, the profile details you provide (age, sex, height, weight, food preferences, health goals and conditions, daily routine) and those photos. It never receives your name or phone number.
- ElevenLabs (USA) produces your coach’s voice. It receives your coach script, which includes your first name.
- HeyGen (USA) produces coach videos on the Premium and Family plans. It receives your coach script, which includes your first name.
Each provider processes this data only to produce your results for NAVA. We require them to protect it with safeguards at least equal to those described in this policy, and none of them may sell it or use it for advertising. Your phone number is never shared with any of them.
4. Your Rights (DPDP Act 2023)
- Access all your data
- Correct inaccurate data
- Export your data in a machine-readable format
- Delete your account and data, with a 30-day notice period
- Withdraw consent for any purpose at any time
- Nominate someone to exercise your rights if you die or are unable to
- Complain to the Data Protection Board of India
You can export or delete everything in the app: Settings > Privacy & data.
5. Data Residency and Security
All your data is stored in India (Mumbai, Maharashtra) on Supabase servers. With your permission, the data described in section 3 is processed to produce your results: by CarePlix in India, and by Google Gemini, ElevenLabs and HeyGen in the United States.
Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Row Level Security protects every database table, and access is audit-logged. If there is a breach, we notify the Data Protection Board and affected users within 72 hours.
6. Third Parties
| Service | Purpose | Data received | Location |
|---|---|---|---|
| Supabase | Database and storage | All data (encrypted) | India |
| CarePlix | Face-scan wellness signals | Face-scan signal (not video), date of birth, sex, height, weight | India |
| Google Gemini (Google LLC) | Reports, plans, coach scripts, photo analysis | Scan results, profile details you provide, photos you choose to analyse; never name or phone | US |
| ElevenLabs | Coach voice | Coach script, including your first name | US |
| HeyGen | Coach video (Premium, Family) | Coach script, including your first name | US |
| MSG91 | Login code by SMS | Phone number | India |
| Expo | Push notifications | Device push token only | US |
We never sell your data or use it for advertising.
7. Non-Diagnostic
NAVA is a wellness companion, not a medical device. All values are estimates. NAVA does not diagnose, treat, cure or prevent any disease. Always consult a healthcare professional for medical advice.
8. Children
Anyone under 18 needs verifiable parental consent (DPDP Act, Section 9). We do not target children with behavioural tracking or advertising.
9. Contact
DPO: Mahima Sharma — dpo@vitallinks.co.in
Grievances: acknowledged within 48 hours and resolved within 30 days.
Complaints: Data Protection Board of India
Vital Links Pvt. Ltd. · CIN: U62099DL2025PTC454795 · DPDP Act 2023 and Rules 2025