Privacy Policy

This Privacy Policy (the "Policy") describes how Zyvenxa Technologies Private Limited ("Anvikare", "we", "us", or "our") collects, uses, discloses, stores, and protects information when you use the Anvikare mobile application (the "App"), our website at https://anvikare.com (the "Site"), and any related services we offer (collectively, the "Services").

By downloading, accessing, or using the Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

• Legal entity: Zyvenxa Technologies Private Limited
• Registered address: Anakkallil, Puthencruz P.O., India, 682308
• Country of incorporation: India
• Contact email (all enquiries, including privacy and grievances): support@zyvenxa.in

2. About the App and the Nature of the Data

Anvikare is a personal tracker designed to help parents, guardians, and caregivers record and monitor information related to a baby's and a mother's wellbeing — including sleep, feeding, diapers, growth measurements, vaccinations, moods, medicines, journal notes, and similar caregiving information.

Important nature-of-data notice. Some information you enter (for example, weight, growth measurements, feeding patterns, vaccinations, moods, medicines, or maternal information) may constitute "health-related", "sensitive", or "special category" personal data under laws such as the EU/UK GDPR (Art. 9), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), Brazil's LGPD, India's Digital Personal Data Protection Act 2023, and similar laws. You provide such data voluntarily, and where required by law we rely on your explicit consent (see Section 7).

Anvikare is not a medical device. The App does not provide medical advice, diagnosis, or treatment, is not intended to replace consultation with qualified healthcare professionals, and is not regulated as a medical device. Always consult a qualified healthcare provider for medical decisions.

3. Who May Use the App

The App is intended for use by adults aged 18 years or older who are parents, legal guardians, or authorised caregivers recording information about themselves and/or a child in their care.

Children do not use the App directly. The App is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly allow children to create accounts or use the App on their own behalf. Information about a child is entered, controlled, and managed solely by the parent or legal guardian. If you are a parent or guardian and believe a child has provided personal information to us directly, please contact us at support@zyvenxa.in and we will take appropriate steps to delete it.

4. Information We Collect

4.1 Information you provide directly

• Caregiver / mother profile: name, date of birth, weight, optional email address, and similar profile details.
• Baby/child profile: name (or nickname), date of birth, sex (if provided), profile photo or colour tag, and similar identifiers you choose to enter.
• Caregiving and health-related entries: sleep logs, feeding logs, diaper logs, growth measurements (height/weight/head circumference), vaccination records, mood entries, medicine logs, journal entries, notes, photos (if any), and any other data you choose to record.
• Support communications: when you contact us (e.g., via the in-app support form or email), we receive your email address, the contents of your message, and any attachments. Support tickets are processed through Zoho Desk.
• Purchase information: subscription tier, transaction identifiers, purchase/restore history, and entitlement status. Payment is handled by Apple (and, where applicable, Google); we do not receive or store your full payment card details.

4.2 Information collected automatically

• Device and technical data: device model, operating system and version, language, region, time zone, app version, build, crash logs, diagnostic logs, error stack traces, and performance metrics.
• Usage data: features used, screens viewed, taps, navigation paths, session duration, in-app events, and similar interaction data (see Microsoft Clarity in Section 6).
• Identifiers: a randomly-generated installation identifier, RevenueCat anonymous user ID, Firebase installation ID, and, only with your express ATT consent, the Apple Identifier for Advertisers (IDFA).
• Approximate location: derived from your IP address and device locale (we do not collect precise GPS location).
• Advertising attribution: Apple SKAdNetwork / AdAttributionKit signals used to measure ad performance in a privacy-preserving way.

4.3 Information from third parties

• Apple / Google: subscription receipts, renewal events, and refund notifications relayed to us through RevenueCat.
• Apple iCloud / CloudKit: when you enable iCloud sync or co-parent sharing, your data is synchronised through your Apple ID via Apple's CloudKit service.

4.4 What we do not collect

• We do not integrate with Apple HealthKit; we do not read from or write to your Health app.
• We do not collect precise GPS location, contacts, calendars, photos library, microphone audio, or camera content (unless you actively attach an image you choose).
• We do not sell your personal information for money (see Section 11 for the CCPA-defined meaning of "sell" / "share").

5. How We Use Your Information (Purposes & Legal Bases)

We use personal data for the following purposes. Where the GDPR/UK GDPR applies, the corresponding legal bases are indicated.

Automated decision-making (GDPR Art. 22). We do not carry out solely automated decision-making — including profiling — that produces legal effects concerning you or similarly significantly affects you. Any AI-generated insights, charts, percentiles, or summaries within the App are informational only and are not used to make any decision about you or your child.

6. Third-Party Services and Processors

To deliver the Services, we share limited personal data with carefully selected third-party providers acting as our processors or as independent controllers. We require each provider to maintain appropriate security and confidentiality measures.

We do not authorise these providers to use your personal data for their own independent marketing purposes.

7. Consent, Apple App Tracking Transparency & Advertising

7.1 App Tracking Transparency (ATT)

On iOS we use Apple's App Tracking Transparency framework. We will only use your IDFA, or otherwise "track" you across apps and websites owned by other companies (as Apple defines that term), if you grant permission through the ATT system prompt. You may change your choice at any time in Settings → Privacy & Security → Tracking. If you decline, you will still see ads, but they will not be personalised based on cross-app tracking.

7.2 EEA / UK / Swiss users — Google UMP consent

If you are located in the EEA, the United Kingdom, or Switzerland, we present a Google-certified consent management prompt (UMP) on first launch to obtain your consent (or signal your objection) for advertising and analytics cookies and identifiers, consistent with the EU ePrivacy Directive, GDPR, and the IAB Transparency & Consent Framework. You may withdraw or change your choices at any time from the App's Settings → Privacy screen.

7.3 Advertising

The App may display advertisements served by Google AdMob. Depending on your consent and ATT choices, ads may be personalised (based on profiles and identifiers) or non-personalised (contextual only). Google may use cookies, device identifiers, and similar technologies to serve and measure ads. For more information about Google's advertising practices, please see policies.google.com/technologies/ads.

8. How We Store and Secure Your Data

8.1 Storage locations

• On your device: the majority of your personal and caregiving data is stored locally on your device in an encrypted Core Data database, protected by iOS file protection.
• Your iCloud account: if iCloud sync or co-parent sharing is enabled, your data is replicated through Apple's CloudKit infrastructure under your Apple ID. We do not have administrative access to your iCloud container contents; access is governed by Apple.
• Our processors: limited operational data (crash logs, subscription metadata, support tickets, analytics events) is stored on infrastructure operated by the providers listed in Section 6, which may be located in the United States, the European Union, India, or other jurisdictions.
• Website hosting: the Site at anvikare.com is hosted as static content on Amazon S3 (Amazon Web Services) in the Mumbai region (ap-south-1), India. The domain is registered through GoDaddy, but GoDaddy does not host the Site content.

8.2 International data transfers

Where personal data is transferred outside your country of residence — including to the United States (Apple, Google, Microsoft, RevenueCat), India (Zyvenxa; Zoho Desk on the zoho.in data centre; Amazon Web Services in the Mumbai ap-south-1 region for website hosting), or other jurisdictions — we rely on appropriate safeguards such as:

• the European Commission's Standard Contractual Clauses (SCCs) together with the UK International Data Transfer Addendum for transfers from the EEA/UK to the United States and to India;
• the EU–U.S. Data Privacy Framework (and the UK and Swiss extensions) for transfers to U.S.-based providers that are certified under the framework;
• adequacy decisions of the European Commission or the UK Government where applicable;
• your explicit consent, where consent is the lawful basis we rely on.

You may request a copy of the relevant safeguards (including the SCCs we have entered into with our processors) by contacting us at support@zyvenxa.in.

8.3 Security measures

We implement administrative, technical, and physical safeguards designed to protect your information, including: encryption in transit (TLS), encryption at rest on device, file-protection classes on sensitive caches, principle-of-least-privilege access for staff, secure software development practices, dependency monitoring, and incident response procedures. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8.4 Data breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (including, where applicable, the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India) and affected users without undue delay and, where feasible, within 72 hours, as required by applicable law.

8.5 Where your caregiving data actually lives

Zyvenxa does not hold a server-side copy of your caregiving data. All data you enter into the App — including baby and mother profiles, feeds, sleep logs, diapers, growth measurements, vaccinations, medicines, moods, journal entries, and photos — is stored exclusively on your device and, if you have iCloud sync enabled, in your personal Apple iCloud account under your Apple ID. Only you have access to your iCloud container; Zyvenxa has no administrative access to it.

The data Zyvenxa and its processors hold is limited to what is described in Sections 4.2 and 4.3 (device and technical data, support communications, subscription metadata, and analytics events). Your caregiving and health-related entries are not among them.

9. How Long We Keep Your Data (Retention)

• Caregiving and health-related data (sleep, feeding, diapers, growth, vaccinations, medicines, moods, notes, photos): retained for as long as you keep the data in the App. You can delete individual entries, an entire baby record, or all of your data at any time from Settings → Profile (or the equivalent in-app control). Health-related data is retained for the same duration as other caregiving entries; it is not retained longer.
• App data on your device: retained on the device until you delete it inside the App or uninstall the App. Note that uninstalling the App removes the local copy from that device only.
• iCloud-synced data: if iCloud sync is enabled, your data is stored in your personal iCloud account under your Apple ID. Uninstalling the App does not delete the iCloud copy — that copy remains in your iCloud until (a) you delete it from inside the App on any signed-in device, (b) you remove the Anvikare iCloud data from iOS Settings → Apple ID → iCloud → Manage Account Storage → Anvikare, or (c) you delete your Apple ID. Zyvenxa does not have administrative access to your iCloud container and cannot delete iCloud-stored content on your behalf.
• Subscription / billing records: retained for the period required by tax, accounting, and consumer-protection laws (typically up to 7–10 years).
• Support tickets: retained for up to 24 months after resolution.
• Crash logs and diagnostic data: retained for up to 90 days, then aggregated or deleted.
• Analytics (Microsoft Clarity): retained per Microsoft's retention schedule (currently up to 12 months).
• Advertising identifiers: retained per Google's retention schedule.

When retention periods expire, we delete or anonymise the data so that it can no longer be associated with you.

10. Your Rights (Global)

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Lodge a complaint with a supervisory authority (e.g., your national data-protection regulator, the UK ICO, the Data Protection Board of India, or your EU member-state authority).
• Not be subject to a decision based solely on automated processing producing legal effects.

To exercise these rights, email support@zyvenxa.in from the address associated with your account, or use the in-app Settings → Data & Privacy → Delete My Data control. We will respond within the period required by applicable law (typically 30 days under GDPR; 45 days under CCPA, extendable once).

11. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with the rights summarised below.

11.1 Categories of personal information collected (last 12 months)

• Identifiers — name, email, device identifiers, IP-derived region.
• Customer records — caregiver and child profile fields.
• Commercial information — subscription transactions.
• Internet/network activity — app usage, interaction events, crash logs.
• Inferences — limited inferences drawn for ad personalisation (only with consent/ATT).
• Sensitive personal information — health-related entries you choose to record; we use this only to provide the Service you requested and do not use or disclose it for purposes that would trigger the "right to limit" under CPRA.

11.2 "Sale" and "Sharing"

We do not "sell" your personal information for money. However, the use of advertising identifiers with Google AdMob for personalised ads may be considered "sharing" for cross-context behavioural advertising under the CPRA. You can opt out at any time by:

• declining ATT (iOS) or revoking it in iOS Settings;
• using the "Do Not Sell or Share My Personal Information" link in the App's Settings → Privacy; or
• enabling a Global Privacy Control (GPC) signal in your browser when visiting our Site — we honour GPC signals.

11.3 Your CCPA/CPRA rights

• Right to know / access;
• Right to delete;
• Right to correct;
• Right to opt out of sale/sharing and targeted advertising;
• Right to limit use of sensitive personal information;
• Right to non-discrimination for exercising your rights.

Authorised agents may submit requests on your behalf with proof of authorisation. We verify requests using your account email and, where appropriate, additional information to confirm identity.

12. European Economic Area, United Kingdom & Switzerland (GDPR / UK GDPR / FADP)

If you are located in the EEA, UK, or Switzerland, the legal bases for processing are listed in Section 5. You have all the rights listed in Section 10. For all data-protection enquiries and requests, please contact us at support@zyvenxa.in. You may also lodge a complaint with your local supervisory authority, including:

• UK: Information Commissioner's Office — ico.org.uk
• Ireland: Data Protection Commission — dataprotection.ie
• Other EU member states: edpb.europa.eu

13. India — Digital Personal Data Protection Act 2023

As we are incorporated in India, our processing of personal data is also governed by the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Under the DPDP Act, you (the "Data Principal") have the right to:

• obtain a summary of the personal data being processed and the processing activities;
• request correction, completion, updating, and erasure of your personal data;
• nominate another individual to exercise your rights in the event of your death or incapacity;
• readily-available grievance redressal.

Our designated grievance officer under the DPDP Act and the Information Technology Act, 2000 (and rules thereunder) is:

• Grievance Officer: The Designated Officer, Zyvenxa Technologies Private Limited
• Email: support@zyvenxa.in
• Address: Zyvenxa Technologies Private Limited, Anakkallil, Puthencruz P.O., India, 682308

We will acknowledge grievances within 48 hours and resolve them within 30 days of receipt. Unresolved complaints may be escalated to the Data Protection Board of India.

13.1 Data Protection Officer (DPO)

We have assessed the criteria for the mandatory appointment of a Data Protection Officer under Article 37 of the GDPR / UK GDPR and under the Indian DPDP Act, and have determined that the appointment of a formal DPO is not currently mandatory for our processing activities, given the scale of our operations and the fact that our core activity is not large-scale systematic monitoring of data subjects or large-scale processing of special-category data on behalf of third parties. All privacy enquiries, complaints, and data-subject-rights requests should be directed to support@zyvenxa.in, which is monitored by the team responsible for privacy compliance. We will re-assess this position if the scale or nature of our processing changes.

13.2 EU / UK Representative (GDPR Art. 27)

Because we are established outside the EEA and the UK but offer the Services to users in those regions, the requirement under Article 27 GDPR (and the corresponding UK GDPR provision) to designate a representative in the Union and the UK may apply to us. We are in the process of formalising such a designation. In the meantime, EEA, UK, and Swiss data subjects may exercise all of their rights — and lodge any complaint, query, or data-subject-rights request — directly with us at support@zyvenxa.in, and we will respond within the periods required by applicable law.

14. Other Jurisdictions

• Brazil (LGPD): you have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. ANPD complaints: gov.br/anpd.
• Canada (PIPEDA / Quebec Law 25): you may access and correct your data; complaints to the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act 1988): you have rights under the Australian Privacy Principles; complaints to the OAIC.
• South Korea (PIPA), Japan (APPI), Singapore (PDPA), South Africa (POPIA), UAE, Saudi Arabia (PDPL), Turkey (KVKK), and others: you have rights substantially similar to those described above, and you may contact your national data-protection authority.
• U.S. state laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Tennessee, Indiana, New Jersey, etc.): you have rights of access, correction, deletion, portability, and opt-out of targeted advertising and sale, exercisable as described in Section 11.

15. Children's Privacy

The App is intended for adults caring for children.

• We do not knowingly collect personal information directly from a child. Only an adult (aged 18 or over) may install the App, create the parent/caregiver profile, and add information about a child.
• Information about an identifiable minor (your child) that you enter into the App is treated as sensitive personal data under the GDPR/UK GDPR, the DPDP Act, and analogous laws, even though it is provided by you rather than by the child.
• We do not use any data about your child for advertising, profiling, marketing, or analytics targeting. Child data is used solely to provide the tracking, syncing, sharing, and AI-insight features you request.
• When you delete your baby record (or your entire account) from the App, the associated child data is removed from the local device immediately. Any iCloud-synced copies are removed in line with the retention rules in Section 9 (subject to the iCloud-deletion caveat there).
• Under the U.S. Children's Online Privacy Protection Act (COPPA), the App is not directed to children, and data about a child entered by their parent/guardian is held under that parent's/guardian's account.
• Under the DPDP Act, processing of a child's personal data requires verifiable consent of the parent or lawful guardian; we obtain this by requiring that an adult creates and controls the account and by limiting child-related entries to the account-holder's input.

If you believe a child has used the App without parental consent, please contact support@zyvenxa.in and we will investigate and delete the data as appropriate.

15.1 Advertising and minors

Advertisements in the App are served by Google AdMob and are intended for the parent/caregiver — i.e. an adult user — not for the child. We do not share any data about your child with AdMob, Google, or any other ad provider. AdMob is configured in our App so that ad requests are not treated as directed to children, but are also not personalised on the basis of any child data; ad personalisation, where it occurs, is based only on the adult parent/caregiver's own ATT/UMP consent choices, as described in Section 7.

16. Health & Medical Disclaimer

The information in the App, including any AI-generated insights, summaries, charts, or growth-percentile indications, is provided for general informational and tracking purposes only. It is not medical advice and is not a substitute for consultation with a qualified healthcare professional. Never disregard professional medical advice or delay seeking it because of something in the App. If you believe your child or you may have a medical emergency, contact your local emergency services immediately.

17. AI Features Disclaimer

Certain features generate text, summaries, or insights using Apple Intelligence on-device Foundation Models. AI output may be inaccurate, incomplete, or misleading. You should not rely on AI output for medical, safety-critical, financial, or legal decisions. You can disable AI features at any time from Settings → AI Insights. We do not send your data to OpenAI, Anthropic, Google Gemini, or any other external AI provider; Apple Intelligence processes data on-device or in Apple's Private Cloud Compute environment, governed by Apple's privacy practices.

18. Push Notifications & Communications

With your permission, we send push notifications (for example, feeding/sleep reminders or service updates) via Apple Push Notification Service and Firebase Cloud Messaging. You can disable notifications at any time in iOS Settings or in the App. We do not currently send marketing emails; if this changes, you will receive a clear opt-in and an unsubscribe mechanism.

19. Co-Parent Sharing

If you choose to share your child's record with a co-parent or caregiver, we use Apple's CloudKit Sharing to create a share link. Anyone you grant access to will see the data you have shared and may add, edit, or delete entries depending on the permissions you grant. You are responsible for whom you invite. You may revoke access at any time from the App.

20. Subscriptions, Free Trials & Billing

The App offers auto-renewable subscriptions (monthly, quarterly, and yearly tiers) managed through your Apple ID via Apple's App Store (and, in future, Google Play). Payment is charged to your store account on confirmation of purchase. Subscriptions automatically renew unless cancelled at least 24 hours before the end of the current period. You can manage and cancel subscriptions in your store account settings. We use RevenueCat to verify entitlements; RevenueCat receives a pseudonymous user identifier and your transaction metadata.

21. Cookies and Similar Technologies (Site)

Our Site at anvikare.com uses only strictly necessary cookies and, where permitted, limited analytics cookies. The App itself does not use browser cookies but uses functionally equivalent local-storage identifiers as described above. EEA/UK visitors are presented with a cookie banner before any non-essential cookies are placed.

22. "Do Not Track" Signals

Some browsers transmit "Do Not Track" (DNT) signals. Because there is no industry consensus on how to respond to DNT signals, we currently do not respond to them, but we do honour the Global Privacy Control (GPC) signal as described in Section 11.2.

22A. Acknowledgements & Data Sources

Growth percentile curves and reference data displayed within the App are reproduced from the World Health Organization (WHO) Child Growth Standards, published by WHO, Geneva. The World Health Organization does not endorse this product, is not affiliated with Anvikare or Zyvenxa Technologies Private Limited, and is not responsible for the interpretation, presentation, or use of WHO data within the App. The views and content of Anvikare do not necessarily reflect the views of WHO. A full list of third-party libraries and data sources is available in the App under Profile → Legal → Acknowledgements.

23. Third-Party Links

The App and Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties; please review their privacy policies before providing them with information.

24. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the App, by email, or by prominent notice on our Site before the changes take effect, and we will update the "Last updated" date above. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

25. How to Contact Us

For any questions, complaints, privacy requests, data-subject-rights requests, or grievances relating to this Policy or our handling of your personal data, please contact us using the details below. We answer all enquiries from a single mailbox to ensure timely response:

• Email (all enquiries): support@zyvenxa.in
• Postal address: Zyvenxa Technologies Private Limited, Anakkallil, Puthencruz P.O., India, 682308

26. Governing Law & Jurisdiction

This Policy is governed by the laws of India, without regard to its conflict-of-laws principles, and subject to the exclusive jurisdiction of the competent courts at Ernakulam, Kerala, India, except where mandatory local consumer-protection or data-protection law in your country of residence grants you additional rights or a different forum.

27. App Store & Play Store Privacy Labels

For convenience, the data categories shown in our Apple App Privacy labels and Google Play Data Safety section reflect the practices described in this Policy. In the event of any conflict between the labels and this Policy, this Policy controls.