FamFit Privacy Policy

This policy is in English; a Hindi translation will follow. If the two differ, the English version prevails.

1. Who we are

FamFit is a diet planner, health log and family "Care Circle" app for Android and iPhone. This policy explains how we handle your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules, and the Information Technology Act, 2000 and its rules.

• Data Fiduciary: AITOXR IT SERVICES Pvt. Ltd., a company registered under the Companies Act, 2013, with its registered office at 13B Shopping Complex, BARC Staff Colony, Boisar, Distt. Palghar, Maharashtra, India ("AITOXR", "we", "us").
• Privacy questions and support: projects@aitoxr.com, or +91 86000 02990 (Monday to Saturday, 9:00 AM to 9:00 PM IST; on Sundays, email only). This is our contact for questions about how we process your personal data.
• Grievance Officer:
  • Name: Arun
  • Designation: CEO & CTO, AITOXR IT SERVICES Pvt. Ltd.
  • Email: projects@aitoxr.com
  • Post: Grievance Officer, AITOXR IT SERVICES Pvt. Ltd., 13B Shopping Complex, BARC Staff Colony, Boisar, Distt. Palghar, Maharashtra, India
  • Phone: +91 86000 02990 (Monday to Saturday, 9:00 AM to 9:00 PM IST; on Sundays, email only)
  • We acknowledge a grievance within 48 hours and resolve it within 30 days, and never later than the period the DPDP Rules allow.

2. The short version

• FamFit is for adults (18+) only.
• FamFit is a wellness app, not a medical device. It does not diagnose, treat or prevent any disease and is not an emergency service (call 112).
• We collect what you log or connect so the app can work for you. Sensitive features (FamFit AI, periods and pregnancy, Care Circle sharing, sharing with a FamFit nutritionist, meter photos, health records, phone step counting, tummy / skin / eye check-ins) each ask for their own consent, and you can withdraw each one separately.
• Logging is free. AI features, the nutritionist call and the weekly report come with FamFit Plus, a paid subscription sold through the App Store and Google Play. We never see your card, UPI or bank details.
• No ads. No sale of data. No tracking. The app contains no advertising, analytics or crash-reporting software.
• Your account data is stored on our servers in Mumbai, India. FamFit Plus AI features send specific data to Google Gemini, which may process it outside India. Subscription status is handled by RevenueCat in the USA.
• You can export your data or delete your account from inside the app at any time, or ask us to delete it.

3. Who can use FamFit

FamFit is only for people aged 18 or over. During onboarding you enter your date of birth; the app does not accept a date of birth under 18. A profile that is under 18 can only see an adults-only page and sign out, and no AI feature works for it. We do not knowingly process the personal data of children. If we learn that we hold a child's data, we delete it. Do not add a child's data to your account or to a Care Circle.

4. What we collect, by feature

You decide which features to use. If you never open a feature, we collect nothing for it. "Stored" means stored on our servers in your account; anything not stored stays on your phone (see §5).

4.1 Account and sign-in (needed to use the app)

You can sign in with your email address and a one-time code, with Sign in with Apple (iPhone) or with Sign in with Google. If the email address is the same, these all open the same FamFit account.

• Your email address, used to send you a one-time 6-digit sign-in code and to identify your account.
• If you use Sign in with Apple: an Apple account identifier and your email address, which may be a private relay address that Apple forwards to you; and your name, if you choose to share it (Apple shares it only the first time you sign in).
• If you use Sign in with Google: a Google account identifier, your email address, and the name and profile-picture link on your Google account, which Google includes with every sign-in.
• We never receive your Apple or Google password.
• A random account ID that links your records.
• Technical data our servers record for security and to run the service: IP address, device and operating-system type, app version, request times. Kept for up to 30 days.
• Your sign-in session is kept on your phone. Android device backup and device-to-device transfer of FamFit's local data are switched off.

4.2 Profile (needed for the calorie and meal maths)

Name, gender, date of birth, height, weight, activity level, diet preference (veg, egg, non-veg, Jain or vegan), cuisine region, health conditions you choose to add (a lab result never adds one), goals and focus areas, calorie and nutrient targets (including weekly adjustments), step and water goals, language, units and reminder preferences. Your diet choice and fasting modes (for example Navratri, Ekadashi or Ramzan) may indicate your religious practice; we use them only to plan and filter food.

4.3 Food, meals and fasting

Meals and their items, the way you logged them (photo, voice, text, search, barcode), meal photos you take, typed or spoken meal text (as text: audio is never uploaded), your own foods and recipes, meal plans, grocery lists, fasts and vrat days, and water logs. Meal plans are made by fixed rules from our food database, without AI. A barcode number is looked up directly from your phone on Open Food Facts (§8.3); the product you add is saved as your food.

4.4 FamFit Plus subscription

• Your plan: whether you have FamFit Plus, monthly or yearly, whether you are in the free trial, the product, and the date it renews or ends. If we give you FamFit Plus ourselves (for example as a tester), we record that and its end date.
• From the App Store or Google Play, through RevenueCat: subscription events, such as a purchase, renewal, cancellation, billing problem or expiry, with the product, dates, store, price and currency, country and the store's transaction numbers.
• We never receive your card, UPI or bank details. Apple or Google handles the payment.
• Your diet plan: the plan for each week, whether the app or a FamFit nutritionist set it, the nutritionist's calorie target and note for you, and the meals you mark "Ate as planned".
• FamFit AI questions: a daily count, to apply the limit of 5 questions a day.

4.5 Nutritionist calls (FamFit Plus)

• Your call request: the preferred day, the time slot (morning, afternoon or evening), the language (English or Hindi), an optional note of up to 500 characters, and a phone number for the call. We use this number only to call you about your request.
• About each call: its status (requested, scheduled, done, missed or cancelled), the scheduled time, which nutritionist handled it, and the nutritionist's notes from the call.
• Before your first request, the app asks for a separate consent that lets FamFit nutritionists see your profile, food logs, weight and diet plan. §8.2 explains exactly what they see.

4.6 Activity, body and connected health apps

• From Apple Health (iPhone) or Health Connect (Android), only after you connect and choose the data types: steps, workouts, distance, active and total calories burned, heart rate, resting heart rate, heart rate variability, blood oxygen, breathing rate, skin / wrist temperature, sleep (with stages when available), weight, body fat, lean mass, body water, BMI, blood glucose, blood pressure and water. On iPhone also the high, low and irregular heart-rate notifications your watch records. We store daily values and the source (for example your watch) and compute a daily readiness estimate.
• Saved back to Apple Health / Health Connect, only if you turn on each switch: water, meals (nutrition), weigh-ins, body fat (Android) and mindful minutes (iPhone).
• Entered or scanned by you: manual activities, body measurements (waist and others), smart-scale screenshots, body-composition goals and private progress photos (never shared, never sent to AI).

4.7 Phone step counting (optional, separate consent)

If you have no watch, your phone can count steps. The raw sensor data stays on your phone. We store only daily totals (steps, distance, floors on iPhone, active / brisk / still minutes), a status row for each phone (platform, permission state, last sync) and, if you turn it on, a weekly routine band made of statistical scores (no raw values, no mood). Only with a separate "share presence" consent do your Care Circle members see the hour of your last movement outside 22:00–06:00. Turning a signal off erases its data.

4.8 Sleep and screen time (optional)

• Sleep: nights from your watch or ring, from manual logs, or (Android, optional) estimated from when your phone was not in use; sleep notes and settings.
• Sleep screenshots from a watch app (FamFit Plus): read by Google Gemini and then deleted; only the numbers you save are kept.
• Screen time stays on your phone. On Android (after you grant "Usage access") and on iPhone (numbers you type in), screen time is kept only on your phone. It is never sent to our servers, to AI or to your Care Circle, so a new phone starts fresh.

4.9 Mind (optional)

Mood and stress check-ins with optional tags and a note, your journal, PHQ-9 and GAD-7 screener answers and scores, and breathing sessions. Mind data is private by default. Only if you switch on "share with coach" does FamFit AI receive averages (never notes, answers or results).

4.10 Readings, lab reports and health records (optional)

Blood pressure, blood sugar and other readings (typed or synced); lab reports (photo or PDF) and the values read from them; recheck reminders; and records you import (PDF, photos, FHIR files exported from other apps). For imported records, the original file is kept only with the separate "keep originals" consent, and AI reading needs FamFit Plus and the "AI read" consent; FHIR files are read on your phone. Before a report photo is uploaded, location and camera details are removed. Tests that are often private (HIV, pregnancy, hepatitis B) are left unticked during import. FamFit is not connected to India's ABDM.

4.11 Medicines and appointments (optional)

Medicine names (from our catalogue or as you typed them), dose times, taken / skipped events, stock, reminders and appointments. FamFit gives no dosage advice and does no interaction checking.

4.12 Emergency medical ID and SOS (optional)

Blood group, allergies, conditions, notes, doctor's name and phone, hospital, insurance note, and up to 5 emergency contacts (name, relation, phone number). Only add people who agree to be your emergency contacts. SOS events (time and delivery status) are stored so your family can be told. When you choose to text your contacts, the message is composed in your phone's own SMS app. This version does not collect your location.

4.13 Life stage: periods, pregnancy, menopause, check-ups, quit tracker (optional, 18+, separate consent)

Cycle days (flow, pain, symptoms, moods, discharge, ovulation and pregnancy test results, short notes), cycle predictions, pregnancy details (due date, last period date, number of babies, pre-pregnancy weight, height, gestational diabetes noted by you, and the outcome if a pregnancy ends, which you may decline to give), kick counts, check-up reminders, EPDS / IPSS / MRS screener results, and quit trackers for smoking, smokeless tobacco or alcohol (quit date, how much per day, cost per unit, daily logs). These screens sit behind an app lock. FamFit AI and Care Circle get nothing from here unless you switch on sharing after seeing exactly what is shared (Care Circle: only the pregnancy week and the next visit window). Withdrawing this consent erases all of this data.

4.14 Tummy, skin and eyes (optional, 18+, separate consent)

Gut, skin and eye check-ins with red-flag checklists and notes, your skin routine, and eye-rest reminder settings. On Android the optional screen-use mode checks on your phone whether the screen is on; that check stays on the phone.

4.15 Care Circle and Parent mode (optional)

• Who is in your circle, the relation and names you give each other, each person's role, and exactly the categories each person agreed to share (for example readings, check-ins, medicines, sleep, meals, labs, mood, appointments, emergency ID, pregnancy summary, presence). The person whose data is shared gives that consent on their own phone.
• A consent log (what was agreed, the exact text shown, language, time) and an access log (which caregiver viewed which category, and when). You can see your access log.
• "I'm OK" check-ins, "last active in the app" time (rounded to 5 minutes, only if you share presence; it comes from opening the app or logging, never from phone unlocks), reminders a caregiver sets with your permission, updates (for example "a reading outside the range you set"), nudges (preset messages or a short custom message of up to 140 characters), the inbox and delivery records.
• Push and email updates never contain a reading or a condition name, only a line like "needs a look".
• Parent mode's family PIN is stored only on the phone that uses Parent mode, in a scrambled (hashed) form. We never receive it.

4.16 Walk groups and Wrapped (optional)

Walk-group membership and per-group consent, walk sessions, daily walk effort and stickers ("cheers") sent between members. Weekly "Wrapped" recaps are calculated when you open them and are not stored; a share picture is made on your phone and leaves it only if you share it yourself. Mind, sleep, medicines and body data can never be drawn on it.

4.17 FamFit AI and other AI features (FamFit Plus)

AI features are part of FamFit Plus, including its free trial. Free accounts get no AI features and send nothing to AI. The AI features use Google Gemini (§8.1); Appendix A lists, feature by feature, exactly what is sent and when.

• FamFit AI (the assistant) needs its own consent, answers up to 5 questions a day, and never receives your name, date of birth (only an age band), email, phone number, location or journal text.
• We store your AI chats, memories (which you can see and delete), suggested actions and AI reports for the periods in §10. Every AI answer is labelled as AI and can be reported from the app.
• The morning "Today for you" card is made on your phone by fixed rules, without AI. We store the card's rule codes and numbers.
• We keep an AI usage ledger for each account: which function ran, which model, token counts and estimated cost. It never contains what you wrote or any health content. It is used to apply daily and monthly AI limits.

4.18 Weekly report (FamFit Plus)

Each Monday, FamFit makes a weekly report for FamFit Plus members who logged meals in the past week: your numbers for the week (food, steps, water, fasts, weight, and readings and sleep if you share them) and a short summary with 3 things to try. The summary is written by Google Gemini only if you also gave FamFit AI consent; otherwise it is made by fixed rules, without AI. A profile under 18 never gets one. Reports are stored in your account.

4.19 Features that are switched off in this version

• Meter photos ("Snap the meter"): you can see its settings and give consent, but reading is switched off on our servers, so no meter photo is sent or kept. When it is switched on, a photo of your BP or sugar meter's screen will be sent to Google Gemini to read the numbers (FamFit Plus), which you check before saving. Unconfirmed readings are discarded after 24 hours; a photo is kept only if you choose, for at most 30 days. Withdrawing consent deletes kept photos.
• Partner links for lab tests and medicine refills: switched off. Nothing is collected or sent to any partner. Before any partner goes live we will update this policy, name the partner and say what it receives.

4.20 "Help improve recognition" (optional, off by default)

If you turn it on, photos of meals you confirm, the dish name and the phone's guess are stored to improve the on-device food model. Turning it off stops new uploads. Photos you already shared stay until you delete your account, or until you ask us to delete them.

4.21 Notifications and devices

A random install ID for each phone, and, only if you turn on push notifications, a push token, platform, app version, language and last-seen time. Reminders are scheduled on your phone.

4.22 When you contact us

Your messages, your email address or phone number, and anything you choose to send us.

5. What stays on your phone

• Raw step-sensor data and all screen-time data.
• Meal photos the on-device model recognises confidently (they are saved with the meal only if you save it).
• Speech-to-text: your phone's speech service (Apple's on iPhone, Google's on Android) turns speech into text; FamFit never uploads audio. That service may itself send audio to Apple or Google under their terms.
• Fingerprint and face data for the app lock: handled by your phone; we never receive them.
• Parent mode's family PIN.
• Your answer to the one-time Google Gemini notice (§7).
• FHIR health-record files, which are parsed on the phone.
• Wrapped pictures until you share them, and grocery lists you share through your phone's share sheet.

6. Why we use your data

We do not use your data for advertising, for selling, for building profiles for others, for decisions about credit, insurance or employment, or to train Google's AI models.

7. Consent and how to withdraw it

Each consent below is separate. Saying no to one does not stop you using the rest of the app. Withdrawing is as easy as giving consent; it stops further processing and, where noted, erases the data. It does not undo processing that happened before. Most settings are under Me; features are listed under Me > All trackers.

For most consents we keep a record of each consent event (what you agreed to, the version and exact text shown, the language and the time) as proof of consent, as the DPDP Act requires. For sharing with FamFit nutritionists we keep the time you agreed. Your answer to the Google Gemini notice is kept on your phone. Consent records contain no health data and are deleted with your account.

When registered Consent Managers start operating under the DPDP Rules, we will update this policy to explain how you can use one with FamFit.

8. Who we share data with

8.1 Service providers that process data for us (Data Processors)

We use these providers only to run FamFit, under their contracts that limit their use of your data.

8.2 FamFit nutritionists (FamFit Plus, only with your consent)

FamFit nutritionists are our staff. They work through a staff dashboard that shows member data only through checked server functions.

• With your consent, and only while you have FamFit Plus, they see: your name, age, gender, height, goal, the health conditions you added, diet and cuisine preferences, activity level, calorie and protein targets, target weight and language; your recent weights; your food logs for the last 14 days (calories, protein and number of meals each day); your diet plan for the week; and your call requests.
• They can change your diet plan (dishes and the daily calorie target) and add a note for you, which you see in the app.
• For a call request they see your name, the phone number you gave, your preferred day, time and language, and your note. They call you on that number by phone or on WhatsApp. A WhatsApp call is handled by WhatsApp under its own terms.
• Every time a nutritionist opens or changes your data, we log it (who, what and when). You can ask us for this log.
• Nutritionists never see your mind, life-stage, readings, lab or Care Circle data, and they never see your payment details.

8.3 Apps and services you connect yourself

These are not our processors; their own terms and privacy policies apply.

• Apple Health and Health Connect send us data only for the types you allow.
• Sign in with Apple and Sign in with Google confirm who you are and send us the details in §4.1.
• The App Store and Google Play sell and bill FamFit Plus. They tell us (through RevenueCat) about your subscription, but never give us your payment details.
• Your phone's speech service (Apple or Google) converts speech to text.
• Open Food Facts receives only the barcode number you scan, directly from your phone. No account data is sent.

8.4 People you choose

• Care Circle members see only the categories you grant, and only while you share. You can see who viewed what.
• Walk-group members see your walk days, effort, stickers and the name you use in the group.
• Emergency contacts receive the SOS messages you send.
• Anyone you send a doctor PDF, a Wrapped picture or a grocery list to.

8.5 Partners (not active)

Lab and pharmacy partners receive nothing in this version. When this goes live, a partner will receive only what you confirm for a booking.

8.6 Legal and safety

We disclose data when the law requires it (for example a court order or a lawful request from a government agency), and only as much as is required. We check that each request is lawful.

8.7 Change of ownership

If AITOXR is merged or acquired, your data may move to the new owner under this policy. We will tell you before that happens and you can delete your account.

We never sell your data and never share it with advertisers, data brokers, insurers or employers.

9. Where your data is stored and transfers outside India

Your account data and files are stored in India, on our server in Mumbai rented from Hostinger. Backups are kept on the same server. Google Gemini (FamFit Plus AI features), RevenueCat (USA), the push services and our email provider may process the specific data listed in §8.1 outside India. The DPDP Act allows such transfers except to countries the Government of India restricts; we will stop any transfer to a restricted country.

10. How long we keep data

Unless the table says otherwise, we keep your records until you delete them or delete your account.

We may keep specific data longer only if the law requires it, and only for that purpose.

11. Your rights

Under the DPDP Act you can:

• Get a summary of your data and of who we shared it with: use Me > Privacy & account > Export my data (a JSON file of the records in your account and your AI usage ledger), or write to the Grievance Officer. If something you want is not in the file (for example your nutritionist call history or the log of staff access), write to us and we will send it.
• Correct, complete or update your data: edit it in the app, or write to us.
• Erase your data: delete single records in the app, withdraw a consent (§7), or delete your account (below).
• Nominate someone to exercise these rights if you die or become unable to: email the Grievance Officer with the nominee's name and contact details.
• Complain: first to our Grievance Officer (§1). If you are not satisfied, you can complain to the Data Protection Board of India.

Deleting your account

• In the app: Me > Privacy & account > Delete my account, then type DELETE to confirm. We remove your files and then your account and every record linked to it, straight away. The only exceptions are the FamFit Plus store purchase records and the log of staff access, which we keep without any link to you (§10). Backups expire within 14 days.
• Without the app: request deletion at famfit.co.in/delete-account, or email projects@aitoxr.com from the email address on your account. We confirm that the request comes from the account owner, then complete it within 30 days.
• Deleting your account does not cancel FamFit Plus. Cancel your subscription in the App Store or Google Play subscription settings first, or the store will keep charging you.
• Apple and Google keep their own purchase records under their own policies. RevenueCat keeps a record of your purchases as our service provider; ask us and we will have it deleted.

We may ask you to confirm a request from the email address on your account. We answer requests within 30 days and within any shorter period the law sets. As the DPDP Act asks, please give accurate information and do not file false or frivolous complaints.

12. Sensitive health data: extra protections

Health, reproductive, sexual-health and mental-health data get extra care:

• Separate consent for life-stage data, mind data sharing, AI sharing, Care Circle sharing, records and sharing with FamFit nutritionists.
• Off by default for AI and Care Circle; you switch on each item after seeing what is shared.
• FamFit nutritionists see your data only with your separate consent and only while you have FamFit Plus, and every view is logged.
• An app lock (Face ID, fingerprint or phone passcode) for the cycle and pregnancy screens, screenshots blocked on those screens on Android, and a privacy cover in the iPhone app switcher. Reminders are worded discreetly.
• Push notifications and emails never carry readings, symptoms or condition names.
• Our server logs carry no health values.
• Screen time stays on your phone; it never reaches our servers, FamFit AI or Care Circle.

Health Connect. FamFit's use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. We use Health Connect data only to show you your own health and fitness information and the features described in §4.6, for the AI features you switch on, for the Care Circle categories you grant and, with your consent, for your FamFit nutritionist. We never use it for advertising, never sell it, and never use it for credit, insurance or employment decisions. People at AITOXR read it only with your permission, for security, or when the law requires.

Apple Health. Data from Apple Health is never used for advertising, marketing or data mining, never sold, and never stored in iCloud by FamFit. It is shared only with the processors in §8.1 for the features you turn on, with the Care Circle members you choose and, with your consent, with your FamFit nutritionist.

13. Security

• All traffic between the app and our servers is encrypted (TLS). The database is not reachable from the internet; only the app's API and the staff dashboard's sign-in page are.
• Row-level security on every table, so an account can read only its own rows; caregivers read only through checked, logged functions and only the categories granted. Sensitive columns (such as push tokens) are not readable directly.
• Private storage buckets; server functions verify who is calling before they act.
• Only the nutritionists and admins on our staff list can use the staff dashboard. They see member data only through checked functions, only for FamFit Plus members who agreed, and every view and change is logged. Admins can also look up an account by email, only to give it FamFit Plus. Access to the servers themselves is limited to the AITOXR engineers who run FamFit.
• If a personal data breach happens, we will tell affected users and the Data Protection Board as the DPDP Rules require (without delay, with a detailed report to the Board within 72 hours).

No system is perfectly secure, but we work to protect your data and fix problems quickly.

14. Cookies and tracking

The app uses no cookies, no advertising ID and no cross-app tracking. The website that shows this policy, famfit.co.in, uses no advertising or analytics cookies.

15. Changes to this policy

This is the first published version. We will post any change here with a new version number and date. For material changes we will tell you in the app or by email before they take effect, and ask for fresh consent where the law requires it. Earlier versions will be available on request.

16. Contact

• Privacy questions and support: projects@aitoxr.com, or +91 86000 02990 (Monday to Saturday, 9:00 AM to 9:00 PM IST; on Sundays, email only).
• Grievance Officer: Arun, CEO & CTO, projects@aitoxr.com (see §1).
• Post: AITOXR IT SERVICES Pvt. Ltd., 13B Shopping Complex, BARC Staff Colony, Boisar, Distt. Palghar, Maharashtra, India.

Appendix A: what reaches Google Gemini, feature by feature

Only for FamFit Plus members, including the free trial. Free accounts send nothing to Google Gemini.