Effective 26 November 2026

Privacy Policy

This Privacy Policy explains how Nevika Innovations Private Limited ("Nevika", "we", "us") collects, uses, discloses and safeguards information when you use Nevika AI. We comply with the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the EU GDPR.

1. Data we collect

• Account data: name, email, phone, profile photo (via Google or WhatsApp OTP).
• Health data: chat transcripts with the AI Doctor, uploaded lab reports and medical documents, family member profiles, symptoms, medications, allergies.
• Usage data: pages viewed, features used, device/browser type, anonymised IP, crash reports.
• Payment data: processed by Cashfree Payments; we store only invoice metadata (order id, amount, status), never card details.

2. Purpose of processing (DPDPA §6)

• To deliver AI-assisted health information you specifically request.
• To secure your account (fraud prevention, session management).
• To comply with legal, tax and audit obligations under Indian law.
• To improve model safety with de-identified, aggregated signals — only if you consent under Settings → Consent.

3. Legal basis

We process personal data based on your explicit consent recorded in the Consent Panel. You may withdraw consent at any time; withdrawal does not affect processing that already happened lawfully.

4. Sharing

We do not sell your data. We share strictly with processors bound by DPAs:

• Supabase (Lovable Cloud) — encrypted database and storage.
• OpenRouter / Sarvam AI — model inference for chat, OCR, TTS/STT.
• Cashfree Payments — payment processing.
• Resend — transactional email.
• MSG91 — WhatsApp OTP.
• Sentry — error monitoring (no PII in payloads).

5. International transfers

Some processors operate outside India (US, EU). We use contractual safeguards and, where required, standard contractual clauses.

6. Your rights

• Right to access, correct and erase your data (Account → Privacy).
• Right to export a full copy of your data in machine-readable JSON.
• Right to nominate a person to exercise your rights in case of death or incapacity.
• Right to grievance redressal — see contact below.

7. Retention

See our Data Retention Policy. Chat and documents are deleted 90 days after account closure unless legally required.

8. Security

TLS 1.3 in transit, AES-256 at rest, row-level security on every table, strict origin isolation, CSP headers, private storage, rate-limited APIs, and continuous vulnerability scanning.

9. Children

Nevika AI is intended for users aged 18 and above. We do not knowingly process data of minors. Parents managing minor family profiles bear responsibility for that data.

10. Grievance Officer

As required under DPDPA §8(9) and the IT Rules 2011:
Name: Grievance Officer, Nevika Innovations Private Limited
Email: info@nevika.co
Address: 1st Floor, Mapkhan Nagar, Opp. Municipal School, Marol, Marol Naka, Andheri (East), Mumbai – 400059, Maharashtra, India
We acknowledge grievances within 24 hours and resolve within 15 days.

11. Changes

We will notify material changes at least 14 days before they take effect via email and in-app banner.