Dietixa ("Dietixa", "we", "us" or "our") is a cloud-based practice management platform for dietitians, nutritionists, dentists and wellness clinics, developed and operated by Saral Amplisoft (Saral Computers Pvt. Ltd.). This Privacy Policy describes how we collect, use, disclose, store and protect information when you visit www.dietixa.com, sign up for a Dietixa account, or use the Dietixa application and related services (together, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Service.

This Policy applies to two categories of individuals whose data may be processed through the Service:

• Practice Owners and Users — dietitians, nutritionists, clinic staff and administrators who register for and operate a Dietixa account ("you", "Practice Owner").
• Patients / Clients — the individuals whose health, contact and appointment records a Practice Owner enters into Dietixa in the course of running their practice ("Patients").

• Personal Data — any data that identifies, or can be used to identify, an individual.
• Sensitive Personal Data — personal data revealing physical or mental health information, medical history, biometric information or financial information, as defined under applicable Indian data protection law.
• Data Fiduciary — the entity that determines the purpose and means of processing personal data (in most cases, this is the Practice Owner in respect of their Patients' data, and Dietixa in respect of Practice Owner account data).
• Data Processor — an entity that processes personal data on behalf of a Data Fiduciary and in accordance with its instructions.
• Applicable Law — the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), together with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules, as each comes into force and applies to our processing activities.

4.1 Information you provide when you register

• Name, email address, phone number and clinic/practice name
• Professional details (qualification, registration/license number, specialisation)
• Billing and subscription details (plan selected, GST details; card and payment processing itself is handled by our third-party payment gateway — see Section 8)
• Account credentials (password is stored in encrypted/hashed form)

4.2 Patient / client information entered by Practice Owners

As part of using the Service, Practice Owners may input the following about their Patients. This is Sensitive Personal Data and is treated with heightened security controls:

• Contact details (name, phone, email, address, date of birth, gender)
• Health and medical information — height, weight, BMI/BMR, body composition, lab reports, allergies, medical history, prescriptions and follow-up notes
• Diet plans, meal logs and progress/adherence data
• Appointment history and billing records related to the Patient

4.3 Information collected automatically

• Log data (IP address, browser type, device identifiers, pages viewed, time and date of visit)
• Usage data (features used, session duration, error/crash reports)
• Cookies and similar tracking technologies (see Section 10)

4.4 Information from third-party integrations

Where you choose to connect the Service to WhatsApp, email, SMS gateways or other third-party tools, we receive limited information necessary to deliver diet charts, invoices, reminders and reports through those channels (e.g., delivery status, message metadata).

We use the information described above to:

• Provide, operate, maintain and improve the Service (patient management, diet plan building, BMI/body-metric calculations, scheduling, billing and analytics)
• Create and manage Practice Owner accounts and authenticate logins
• Generate and share diet charts, invoices, reminders and progress reports via WhatsApp, email or SMS at the Practice Owner's direction
• Process payments and manage subscriptions
• Provide customer support, onboarding and training
• Send service-related communications (updates, security alerts, billing notices)
• Send optional marketing communications, where you have consented, and which you may opt out of at any time
• Monitor, detect and prevent fraud, abuse, security incidents and technical issues
• Comply with legal obligations and enforce our Terms of Service

We do not sell Patient health data or Practice Owner personal data to third parties, and we do not use Patient health data for advertising purposes.

We process personal data on one or more of the following bases: (a) your consent; (b) performance of the contract between you and Dietixa (our Terms of Service); (c) our legitimate interests in operating, securing and improving the Service; and (d) compliance with our legal obligations under Indian law. Where Sensitive Personal Data is processed, we rely on consent collected by the Practice Owner (from their Patients) and/or by us (from Practice Owners), as applicable.

In relation to Practice Owner account data (Section 4.1), Dietixa acts as the Data Fiduciary and determines how that data is used, subject to this Policy.

In relation to Patient data that a Practice Owner enters into the Service (Section 4.2), Dietixa acts as a Data Processor, processing that data only on the instructions of, and on behalf of, the Practice Owner, who remains the Data Fiduciary responsible for their Patients' data and for obtaining any consents required to share it with us. Practice Owners should have their own patient-facing privacy notice covering their use of Dietixa.

We share information only in the following circumstances:

• Service providers — cloud hosting and storage providers, payment gateways, SMS/WhatsApp Business API providers, and analytics providers (e.g., Google Analytics), each bound by confidentiality and data-processing obligations
• At your direction — when a Practice Owner shares a diet chart, invoice or report with a Patient via WhatsApp or email
• Legal and safety reasons — where required to comply with applicable law, regulation, legal process or a governmental request, or to protect the rights, property or safety of Dietixa, our users or the public
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy continuing to apply to the transferred data

We do not sell personal data or Patient health data to third parties.

The Service allows Practice Owners to share diet charts, invoices and progress reports with Patients over WhatsApp or email. When this feature is used, the shared content and the Patient's contact details are transmitted to the relevant messaging provider solely to deliver that message. Practice Owners are responsible for obtaining their Patients' consent to be contacted through these channels.

We use cookies and similar technologies (including Google Analytics, via Google's gtag.js) to keep you signed in, remember preferences, understand how the Service and website are used, and improve performance. You can control or disable cookies through your browser settings; disabling certain cookies may affect the functionality of the Service.

Personal data, including Patient health data, is stored on cloud infrastructure located in data centres with industry-standard physical and technical safeguards. We apply reasonable security practices and procedures, including:

• Encryption of data in transit and at rest
• Role-based access controls limiting who can view Patient records
• Regular automated backups
• Access logging and monitoring for suspicious activity

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We retain personal data for as long as an account remains active and thereafter for as long as necessary to comply with legal, accounting or regulatory requirements, resolve disputes and enforce our agreements, after which it is securely deleted or anonymised. Practice Owners may request deletion of their account and associated Patient data, subject to any statutory retention requirements applicable to medical/health records.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request erasure of your personal data, subject to legal retention requirements
• Withdraw consent for optional processing (e.g., marketing communications) at any time
• Obtain a copy of your data in a portable format, where technically feasible
• Lodge a grievance regarding our handling of your personal data (see Section 13)

Patients wishing to exercise these rights over their health records should contact their Practice Owner (dietitian/nutritionist/clinic) directly, as they are the Data Fiduciary for that information; we will support Practice Owners in fulfilling such requests.

In accordance with the Information Technology Act, 2000, the SPDI Rules, 2011, and the DPDP Act, 2023, we have designated a Grievance Officer to address any concerns or complaints regarding this Policy or our handling of personal data.

The Service is intended for use by practising professionals and their adult account holders. Where a Practice Owner records a minor Patient's information (e.g., a paediatric nutrition case), that data is processed solely at the Practice Owner's direction and on the basis of consent obtained by the Practice Owner from the minor's parent or legal guardian, as required by law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. We will post the revised Policy on this page with an updated "Last updated" date, and where changes are material, we will provide additional notice (e.g., by email or an in-app notice).

If you have questions about this Privacy Policy or how we handle your data, please reach out to us:

• Email: info@dietixa.com
• Phone: +91 9810364941
• Address: Saral Amplisoft (Saral Computers Pvt. Ltd.), India
• Support hours: Monday–Saturday, 10:00 AM – 6:00 PM IST