Legal
Privacy Policy
Overview - Which Part Applies to You
Zen Vitals ("we", "us", "our") operates two distinct services. Because the data involved is very different, this policy is organised into two tracks plus a set of shared provisions. Read the track that matches how you use Zen Vitals.
This policy is governed by Indian law, principally the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules. By using either service you consent to the practices described in the relevant track. If you do not agree, please discontinue use of that service.
Part 1 — Zen Vitals Kart zenvitals.com
Part 2 — Zen Vitals LifeOS zenvitals.com
- Overview — which part applies to you
- Scope
- Information we collect
- How we use your information
- Legal basis for processing
- Advertising & marketing
- Data sharing & disclosure
- Data retention
- Kart data protection contact
- At a glance
- Who we are & scope
- Data we collect
- How we use your data
- AI processing — VIVA, Wellness Index, report analysis
- Your care team
- Data sharing & third parties
- Storage, security & retention
- Apple HealthKit — required disclosures
- LifeOS data protection contact
- Your rights under the DPDP Act
- Children's privacy
- Security
- Breach notification
- International transfers
Part 1 — Zen Vitals Kart zenvitals.com
Applies to shopping, orders, the zenvitals.com website, and our email / WhatsApp communications. This part does not cover health data in the LifeOS app — see Part 2.
- 01
1.1 Scope
This part applies when you visit zenvitals.com, make a purchase, engage with our WhatsApp communications, or participate in our community programmes — including Zen Vitals Women, Zen Vitals Founders Circle, and Zen Vitals Influence.
- 02
1.7.1 Third-party service providers
We share data with trusted third parties only as necessary to deliver our services:
- 03
1.7.2 We do not sell your data
Zen Vitals does not sell, rent, or trade your personal information to any third party for their independent marketing purposes.
- 04
1.7.3 Legal disclosures
We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of Zen Vitals, our customers, or others.
Part 2 — Zen Vitals LifeOS zenvitals.com
Applies to the Zen Vitals LifeOS mobile application (iOS), its backend services, and zenvitals.com. Zen Vitals LifeOS is currently invite-only, available exclusively to registered Zen Vitals clients.
This part applies to: all users of the Zen Vitals LifeOS iOS app; visitors to zenvitals.com and its subdomains; individuals whose data is shared with Zen Vitals by a registered client (e.g., an emergency contact); and healthcare professionals and care-team members operating within Zen Vitals.
It does not govern: third-party services reached through links inside the app (external pharmacies, labs — they have their own policies); data processed by Apple itself when you use HealthKit or iOS; or content you share publicly in the Zen Vitals Community, which other users in your group may see (§2.3.8).
Apple HealthKit data is used solely to compute your Wellness Index, populate your daily metrics, and provide personalised insights inside the app. We do not use it for advertising, share it with data brokers, sell it, or use it for any purpose conflicting with Apple's HealthKit & Health Records API Guidelines. You may revoke access any time via iPhone Settings → Privacy & Security → Health → Zen Vitals or Zen Vitals Settings → Privacy & Consents; revocation is immediate. See §2.8 for the full required disclosures.
- 01
2.0 At a Glance
This summary is for orientation. The detailed sections below govern in case of any difference in interpretation.
- 02
2.1 Who We Are & Scope
Zen Vitals Ltd operates the Zen Vitals LifeOS platform, which combines AI-assisted analysis of health records, integration with wearables and Apple Health, supplement and protocol tracking, goal management, and a managed care-team workflow into a single mobile application (the "Services").
- 03
2.2 Data We Collect
We collect only the data necessary to deliver the Services. Each category explains what we collect, why, and the legal basis under the DPDP Act.
- 04
2.2.1 Account & profile data
You may leave height, weight, address, and other optional fields blank — the app still functions with reduced personalisation.
- 05
2.2.2 Health records you upload
When you upload a blood test report, diagnostic scan, or prescription, we collect: the document file itself (PDF or image); biomarkers and values automatically extracted from it; and metadata (upload date, source, document type, your annotations). These records are treated as sensitive personal data under the DPDP Act and receive the highest level of protection we offer.
- 06
2.2.3 Apple HealthKit data
When you connect Apple Health, we read only the categories you authorise in the iOS permission dialog, which may include: step count and daily activity; active and resting calories; sleep duration and stages; heart rate (resting, walking, workout); heart rate variability (HRV); blood oxygen (SpO₂); body weight and BMI where present; and other categories you explicitly authorise.
- 07
2.2.4 VIVA conversations
VIVA is Zen Vitals' named AI wellness assistant. VIVA accepts text input only — voice input is not a feature of Zen Vitals. We collect your questions and conversation history, the context VIVA used to answer (which reports, metrics, or goals were referenced), and feedback you give on responses. VIVA conversations are private to you and visible only to you and — where you choose — your assigned care team; they are not shared with other users. Responses are powered by third-party large language models with strict de-identification before any content leaves Zen Vitals (see §2.5). You may delete individual conversations or your entire history any time via VIVA → Menu → Conversation History; deletion is irreversible.
- 08
2.2.5 Protocols & adherence data
From My Protocols: medications, supplements, or interventions on your protocol; scheduled doses and dosage details; your adherence record (Took / Skipped / Missed and when); and aggregated adherence over time. Adherence is sensitive personal data and is visible to your assigned care team as part of clinical follow-up (see §2.6).