Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to all visitors, users, and subscribers of DietXP, including those who
access our educational content, use our health and nutrition calculators, submit forms, or engage
with dietitian services via our website, email, or WhatsApp Business.

2. Information We Collect

2.1 Personal Information You Provide

• Name and contact details (email address, phone number)
• Health and lifestyle information voluntarily submitted during consultations, intake forms, or calculator use
• Messages, inquiries, and feedback submitted through contact forms, email, or WhatsApp

2.2 Information Collected Automatically

• IP address and device information
• Browser type, pages viewed, and time spent on the website
• Referral sources and general usage patterns

We use cookies and website analytics tools — including Google Analytics and
standard WordPress analytics — to improve website performance, security, and user experience.
These tools may collect anonymised usage data. You can disable cookies through your browser
settings, though some features may be limited. Our calculators process all health data
locally in your browser and do not transmit health inputs to our servers.

4. How We Use Your Information

• Provide access to calculators, educational resources, and professional nutrition services
• Respond to user inquiries, consultation requests, and support communications
• Improve website functionality, content quality, and platform performance
• Send newsletters or service updates — only with your explicit prior consent
• Maintain platform security and prevent fraudulent use
• Comply with applicable legal and regulatory obligations

5. Legal Basis for Processing

This Privacy Policy is prepared in accordance with:

• Digital Personal Data Protection Act, 2023 (DPDP Act) — India’s primary
  data protection legislation governing collection, processing, storage, and rights related
  to personal data of Indian residents
• Information Technology Act, 2000 and IT (Reasonable Security Practices
  and SPDI) Rules 2011 — governing sensitive personal data including health information
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
  — governing grievance redressal and platform obligations

Under the DPDP Act 2023, the primary lawful basis for processing your data is
your informed and freely given consent, obtained before or at the time of
data collection for each stated purpose.

6. Data Sharing & Third Parties

DietXP does not sell, rent, or trade personal information to third parties.

Limited data may be shared with trusted service providers operating under confidentiality
obligations, including:

• Web hosting provider — for website operation and storage
• Google Analytics — for anonymised website usage statistics
• Email platforms — for appointment confirmations and newsletters (consent-based only)
• WhatsApp Business — for client communication, subject to Meta’s Privacy Policy

Information may be disclosed if required by law, regulation, court order, or legal process.

7. Data Storage & Security

We implement reasonable technical and organisational safeguards to protect personal data
from unauthorised access, misuse, or disclosure, including SSL encryption, access controls,
and secure communication channels.

8. Data Retention

Under the DPDP Act 2023, personal data must not be retained beyond the period necessary
for the purpose for which it was collected.

• Consultation and health records: Retained for the duration of the active client relationship and up to 3 years thereafter, unless a longer period is required by law
• Contact form submissions: Retained for up to 12 months from last interaction
• Newsletter subscribers: Retained until you unsubscribe or withdraw consent
• Analytics data: Retained in anonymised/aggregated form as configured in Google Analytics settings
• Calculator inputs: Processed entirely in your browser; not stored on our servers

You may request deletion of your personal data at any time as described in Section 10.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights
or interests, DietXP will:

• Notify affected data principals as soon as reasonably practicable
• Report the breach to the applicable authority as required under the DPDP Act 2023
• Take immediate corrective action to contain and mitigate the breach

To report a suspected breach or security concern, contact us at
support@dietxp.com.

11. Children’s Privacy

Under the Digital Personal Data Protection Act, 2023, any individual
under 18 years of age is classified as a child. DietXP does not
knowingly collect or process personal data of children under 18 without obtaining
verifiable consent from a parent or lawful guardian.

The Act expressly prohibits tracking, monitoring, profiling, and targeted advertising
directed at children. If we identify that data has been collected from a child without
verifiable parental consent, it will be deleted promptly.

12. External Links

Our website may contain links to third-party websites including official government
publications, research databases, and clinical resources. DietXP is not responsible
for the privacy practices, content, or data handling of these external sites.
We encourage you to review the privacy policies of any external sites you visit.

13. Changes to This Privacy Policy

We may update this policy to reflect changes in legal requirements, technology, or our
services. Updates will be posted on this page with a revised effective date. Continued
use of the platform after changes constitutes acceptance of the updated policy.
For material changes affecting your rights, we will notify active users by email
where possible.

14. Grievance Officer & Contact Details

In accordance with the Information Technology (Intermediary Guidelines and
Digital Media Ethics Code) Rules, 2021, DietXP has designated a
Grievance Officer to receive and resolve complaints related to
data processing, privacy, and this policy.

The Grievance Officer will acknowledge complaints within 3 working days
and aim to resolve them within 15 days of receipt.

For unresolved complaints, you may also contact the
Data Protection Board of India (to be established under the DPDP Act 2023)
once it becomes operational.