Privacy Policy

Last updated: July 2026

This Privacy Policy explains how Vytal ("Vytal", "we", "us") collects, uses, shares and protects your personal data when you use our Service. We aim to handle your data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using the Service you consent to the practices described here.

1. Data we collect

• Account data: name, email address, password (stored securely, in hashed form by our authentication provider).
• Health & fitness data: body-composition (BCA) metrics such as weight, body-fat %, muscle mass, BMI and BMR; age, gender, goals, training experience and activity.
• Sensitive inputs: allergies, dietary preferences and any self-reported medical considerations or injuries you choose to provide.
• Payment data: handled directly by our payment processor, Razorpay. We do not store your full card or bank details.
• Usage data: basic technical and interaction data needed to operate, secure and improve the Service.

2. How we use your data

• To generate your personalised plans, assessments and AI coaching.
• To create and manage your account, subscription and billing.
• To operate, secure, maintain and improve the Service.
• To communicate with you about your account, updates and support.
• To comply with legal obligations and enforce our Terms.

3. Legal basis and consent

We process your personal data on the basis of the consent you give when you sign up and provide information, and where processing is necessary to provide the Service you have requested or to meet a legal obligation. Because health and dietary information can be sensitive, you provide it voluntarily and consent to its use for generating your plans. You can withdraw consent at any time (see Your rights), though this may mean we can no longer provide parts of the Service.

4. How we share data

We do not sell your personal data. We share it only with trusted service providers that help us run the Service, and only as needed:

• Google — to generate AI plans and assessments from the data you provide.
• Supabase — database and authentication.
• Vercel — application hosting.
• Razorpay — payment processing.
• Resend — sending account, plan-ready and support-related emails on our behalf.
• Your organisation — if you are added by a gym, academy or trainer, that organisation and its staff can access the plans and data associated with your account with them.

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer.

5. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes and enforce our agreements. When no longer required, we will delete or anonymise it.

6. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Subject to applicable law, you may request to access, correct or update your data, request deletion of your data, or withdraw your consent. You may also nominate another person to exercise your rights in the event of death or incapacity, and you may raise a grievance. To exercise any of these, contact us using the details below.

8. Children

The Service is intended solely for adults aged 18 and over. It is not directed to anyone under 18, and people under 18 are not permitted to create an account or use the Service. We do not knowingly collect or process the personal data of anyone under 18. If we become aware that we have collected such data, we will delete it and close the account. If you believe a person under 18 has provided us data, please contact us and we will take appropriate steps.

9. Cookies

We use only essential cookies and similar technologies needed to keep you signed in and to operate the Service securely.

10. International processing

Your data may be processed on the infrastructure of our service providers, which may be located outside India. Where this occurs, we take steps intended to ensure your data remains protected in line with applicable law.

11. Grievance / contact

For any questions, requests or complaints about your data or this policy, contact our grievance contact at cpt.aryanbhargav@gmail.com. We will respond within the timelines required by applicable law.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.