1. Who Is Responsible for Your Information
Ace Innovations is the data fiduciary (or “data controller”) for personal information processed through the Service. Ace Innovations is a sole proprietorship based in India, and its proprietor is Sachin Raman. You can reach us at support@livfitai.com. Our Grievance Officer is named in Section 12.
2. Information We Collect
Information you give us
- Account and sign-in information. Your name and, depending on how you sign in, your email address or phone number. If you sign in with Google or Apple, we receive your name, your email address (or an Apple private-relay address), and an account identifier from that provider. We do not receive your Google or Apple password. If you use the app as a guest, we create an account linked to a secret key stored on your device, and we do not collect an email or phone number.
- Profile information. Your age, gender, height, weight, dietary preference, activity level, typical sleep, and the health goals you describe.
- Health and wellness information. Information you log or share in the app, including meals, meal descriptions and food photos; lab reports (as PDFs or photos) and the biomarker values in them; sleep, activity, and other wellness metrics you enter; body measurements; and the messages, photos, and files you send to the AI companion. Some of this, such as lab reports and information about medical conditions, is sensitive personal information under Indian law.
- Information the Service derives from what you share. To make the AI companion useful over time, the Service creates information from your content. This includes nutrition estimates for meals, values and summaries extracted from lab reports, diet plans, insights and trends, and short “memory” notes about you (for example, a stated food preference or goal) taken from your conversations. We store these notes together with numerical representations of them (called “embeddings”) so the AI companion can recall relevant context later.
- Feedback. Reviews, ratings, and comments you submit in the app.
- Early-access (waitlist) information. If you join our early-access list on the website, we collect your first and last name, age, email address and, if you choose to give it, your primary health goal.
- Communications. The content of emails and other messages you send us.
Information collected automatically
- Device and diagnostic information. Device model, operating system and version, app version, language and time-zone settings, crash reports, and app performance data (such as screen load and network request times). This is collected through Google Firebase Crashlytics and Firebase Performance Monitoring, which also use an app-installation identifier and your IP address. Google uses the IP address to estimate your country, and does not use it to locate you precisely.
- Session and security information. Information that keeps your account signed in and secure, such as the type of device a session was created on and when it was last used, plus server logs of requests made to our systems (which include IP addresses).
- Website information. When you submit the early-access form, we record your browser’s user-agent string and the page that referred you. Our website does not use cookies, analytics tools, or advertising trackers.
Information we do not collect
We do not collect your precise location, your contacts, or your advertising identifier. We do not use third-party advertising or cross-app tracking tools. We do not currently connect to wearables or health platforms (such as Apple Health, Health Connect, or Google Fit). If we add these integrations, we will update this policy and ask for your permission in the app first.
3. How We Use Your Information
We use personal information to:
- Provide the Service, including creating and securing your account, storing your logs and reports, and showing your history, trends, and dashboards.
- Generate AI responses and insights. This includes answering your messages, estimating nutrition from meal photos and descriptions, extracting values from lab reports and explaining them, building diet plans, and personalising guidance using your profile, history, and memory notes.
- Maintain, secure, and improve the Service, including diagnosing crashes and errors, measuring performance, preventing abuse and fraud, and developing new features. We use aggregated or de-identified information where we can.
- Communicate with you about your account, early access, changes to the Service or to our legal documents, and your support requests.
- Meet legal obligations, respond to lawful requests, and enforce our Terms of Service.
We do not sell your personal information. We do not use your health information for advertising, and we do not share it with advertisers or data brokers. We do not use your content to train our own or third-party AI models.
Our legal basis
Under India’s Digital Personal Data Protection Act, 2023, we process your personal information on the basis of your consent. We also process it for the “legitimate uses” the Act allows, such as meeting legal obligations and responding to medical emergencies. If laws such as the EU or UK General Data Protection Regulation apply to you, we rely on: your explicit consent, for health information; performance of our contract with you, to provide the Service; our legitimate interests, to keep the Service secure and reliable and to improve it; and compliance with legal obligations.
Your consent to processing of health information
When you create an account and accept this Privacy Policy, you explicitly consent to us collecting and processing your health and other sensitive personal information as described in this policy. That includes sharing it with the AI and infrastructure providers listed in Section 4 so that they can process it on our behalf. This processing is essential to how the Service works. You can withdraw your consent at any time as described in Section 9.
4. Third-Party AI Processing
LivFit AI does not run its own AI models. When you use AI features, the content needed for the request is sent to the third-party AI providers below. They process it on our behalf and send the result back. Depending on the feature, that content can include your message, a meal photo or description, a lab report, relevant parts of your profile and history, and relevant memory notes.
- Microsoft Azure AI (Azure OpenAI Service), operated by Microsoft Corporation. Microsoft generates AI chat responses, insights, and diet plans, analyses meal photos and lab reports, and extracts information from documents.
- Google Gemini API, operated by Google LLC. Google creates the embeddings described in Section 2 that let the AI companion recall relevant context. Your memory notes and conversation text are sent to Google for this.
We use these providers’ paid business API services. Under their terms, they process our requests to provide the service to us and may not use your content to train their AI models. They may keep requests for a limited period solely to detect abuse and meet legal requirements.
We may change or add AI providers as the Service develops. If we do, we will update this section before the new provider receives your information. If the change is material, we will also notify you as described in Section 11.
5. How We Share Information
We share personal information only as follows:
- AI providers, as described in Section 4.
- Infrastructure and service providers. These providers act only on our instructions and only to run the Service:
- Neon (managed PostgreSQL database) stores your account, profile, health logs, conversations, and memory notes. Hosted on Amazon Web Services in Singapore.
- Oracle Cloud Infrastructure stores files you upload, such as lab reports and photos. Hosted in Mumbai, India.
- Google Cloud and Amazon Web Services run our application servers.
- Google Firebase provides crash reporting and performance monitoring.
- Google and Apple provide sign-in, if you choose to sign in with them.
- Apple App Store and Google Play distribute the app. They receive information under their own privacy policies when you download it.
- Legal reasons. We share information when we reasonably believe it is required by law, regulation, court order, or a lawful request from a government authority. We also share it when necessary to protect the rights, safety, or property of our users, the public, or Ace Innovations, including in a medical emergency.
- Business transfers. We may share information if Ace Innovations or the LivFit AI product is involved in a reorganisation, merger, acquisition, or sale of assets. If that happens, we will notify you before your information becomes subject to a different privacy policy.
- With your direction. We share information when you ask us to.
6. Where Your Information Is Stored
Your information is stored and processed mainly in Singapore and India. Some providers, such as Google Firebase and our AI providers, may also process it in other countries, including the United States. When we transfer personal information across borders, we use providers that are bound by contractual data-protection commitments. We also follow any restrictions on cross-border transfer that the Government of India sets under applicable law.
7. How Long We Keep Information
- Account, profile, health information, conversations, uploaded files, and memory notes are kept while your account is active. When you delete your account, we delete them from our live systems right away. Remaining copies in database backups are overwritten within 30 days.
- Revoked or expired sign-in sessions are deleted 30 days after they end.
- Crash and performance data in Firebase is kept for up to 90 days.
- Server and security logs, which may include IP addresses and account identifiers, are kept for up to one year, or longer if the law requires.
- Early-access (waitlist) information is kept until you ask us to remove it, and no longer than 24 months after your last interaction with us.
- Emails and support requests are kept for as long as needed to handle them, and for up to 24 months afterwards.
We may keep information longer if the law requires it, or to establish, exercise, or defend legal claims. We may keep information that has been aggregated or de-identified so that it no longer identifies you.
8. Security
We protect your information with technical and organisational measures. These include encryption in transit (HTTPS/TLS), encryption at rest provided by our storage providers, sign-in tokens stored in your device’s secure storage, revocable sessions, and limits on who can access production systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities, including the Data Protection Board of India, as required by law.
9. Your Rights and Choices
Depending on where you live, and subject to applicable law, you have the right to:
- Access a summary of the personal information we hold about you and how we process it, and the identities of those we have shared it with;
- Correct, complete, or update inaccurate or incomplete information. You can also edit most profile details directly in the app;
- Erase your personal information;
- Receive a copy of your information in a portable format;
- Withdraw consent at any time. Withdrawing doesn’t affect processing that took place before. Because processing health information is essential to the Service, if you withdraw consent we will stop that processing and delete your account;
- Nominate another person to exercise your rights if you die or become incapable of doing so;
- Object to or restrict certain processing, where the law gives you this right; and
- Raise a grievance with us, and then complain to the Data Protection Board of India (or your local data-protection authority) if you are not satisfied with our response.
To exercise these rights, email support@livfitai.com from the address linked to your account, or include enough detail for us to verify that the account is yours. We will respond within the time limit set by applicable law, and in any case within 30 days.
Deleting your account
You can delete your account at any time in the app: open Profile → Delete Account and confirm. This permanently deletes your account and the information described in Section 7. It cannot be undone. If you can no longer get into the app, email support@livfitai.com from the email address on your account and ask us to delete it. Guest accounts are tied to the device they were created on. If you uninstall the app or lose the device, the account can no longer be accessed, but you can still ask us to delete its data.
10. Age Requirement
The Service is intended only for adults aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, please contact us at support@livfitai.com and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date shows when it was last changed, and earlier versions remain available on request. If we make a material change, such as using your information for a new purpose or adding a new kind of recipient, we will notify you in the app or by email before the change takes effect. Where the law requires it, we will ask for your consent again before continuing to process your information under the updated policy.
12. Grievance Officer and Contact
If you have a question, complaint, or concern about this policy or how we handle your information, please contact our Grievance Officer:
- Grievance Officer: Sachin Raman, Proprietor, Ace Innovations
- Email: support@livfitai.com
We will acknowledge your grievance within 7 days and aim to resolve it within 30 days. In every case we will resolve it within the time limit set by applicable law.