LYXAA

Privacy Policy

Effective date: September 13, 2026

This Privacy Policy explains how Lyxaa Biodynamics Private Limited ("LYXAA," "we," "us," or "our") collects, uses, stores, shares, and protects information when you use the LYXAA mobile application, website pages, and related services.

Scope and Controller Details

This policy applies to the LYXAA mobile app and related services, including app pages used for App Store submission. For privacy-law purposes, Lyxaa Biodynamics Private Limited is the business, controller, or data fiduciary responsible for deciding why and how your personal information is processed, unless another notice says otherwise for a specific clinic or partner service.

Information We Collect

Depending on how you use LYXAA, we may collect:

• Account information such as name, email address, phone number, sign-in identifiers, and authentication details.
• Profile and onboarding information such as age, gender, height, weight, waist measurements, health goals, questionnaire answers, habits, and lifestyle preferences.
• Health and wellness information you choose to provide, including lab reports, extracted biomarkers, glucose or CGM report details, meal logs, food photos, hydration, sleep, movement, heart-rate, calories, distance, routine completion, mood, and other metabolic health inputs.
• Files, images, audio, and messages you choose to submit for app features such as lab report analysis, meal photo analysis, AI chat, voice features, or optional image-based wellness review.
• Care-coordination information such as doctor or nutritionist booking requests, care messages, plan preferences, and related service history.
• Payment or subscription status where paid plans are offered through Apple, Google, or another payment provider. We do not receive your full card number from app-store payment processors.
• Technical information such as device type, operating system, app version, IP address, crash logs, diagnostics, security logs, notification tokens, and app usage events.

Consent and App Permissions

We ask for consent before collecting or using personal, usage, or sensitive health information where required. Some features also ask for device permissions, such as camera, photo library, microphone, notifications, Apple Health, or Health Connect. You can deny or later withdraw these permissions in your device settings, although the related feature may stop working.

Paid features are not conditioned on granting permissions that are not necessary for the paid feature itself. We aim to request only the data needed for the feature you choose to use.

Apple Health and Health Connect

If you choose to connect Apple Health or Health Connect, LYXAA may request permission to read selected categories such as steps, sleep, heart rate, calories, distance, and similar activity metrics. These permissions are optional and can be changed in your device settings.

LYXAA uses imported health data only to provide app features, personalization, metabolic insights, progress tracking, and wellness coaching. We do not sell health data and we do not use Apple Health or Health Connect data for advertising, marketing, or unrelated profiling.

LYXAA is read-only for Apple Health unless a future feature clearly asks for separate permission. We do not store Apple Health personal health information in iCloud through the LYXAA app.

Sensitive Health Information

Health, wellness, biometric-adjacent, lab, glucose, nutrition, and lifestyle information can be sensitive. We process this information only for the purposes described in this policy, such as providing dashboards, insights, AI-assisted educational explanations, care coordination, safety, support, and service improvement.

LYXAA does not use sensitive health information for third-party advertising or unrelated marketing. We do not conduct health research using your identifiable data unless we ask for separate, explicit consent and provide any additional information required by law.

How We Use Information

• To create and maintain your account.
• To provide dashboards, reminders, scores, trends, and reports.
• To analyze meals, lab reports, CGM reports, lifestyle inputs, and other content you voluntarily submit.
• To generate educational insights, AI responses, care summaries, and personalized wellness plans.
• To operate care-coordination features, clinic workflows, appointment requests, and support communications.
• To improve reliability, safety, security, user experience, and app performance.
• To comply with applicable laws, respond to lawful requests, enforce our terms, and prevent abuse or fraud.

Legal Bases for Processing

Where privacy laws require a legal basis, we process personal information based on one or more of the following: your consent, performance of our agreement with you, compliance with legal obligations, protection of rights and safety, and legitimate interests such as securing and improving the app. When consent is the basis for processing, you may withdraw it at any time through the app, device settings, or by contacting us.

AI Processing

LYXAA uses AI-assisted systems to support features such as wellness chat, voice interaction, meal photo analysis, lab report extraction, report summarization, and personalized educational guidance. Content submitted for these features may be processed by our cloud systems and AI service providers.

AI outputs may be incomplete or inaccurate and are provided for informational and educational use only. Do not use LYXAA for medical emergencies or as the sole basis for medical, diet, medication, or treatment decisions.

We do not intentionally submit your data to AI providers for third-party advertising. Where available, we use provider settings, contracts, or product terms intended to limit service-provider use of submitted content to providing and securing the requested services.

How We Share Information

We do not sell your personal information. We may share information:

• With service providers that help us run the app, including cloud hosting, database, authentication, file storage, AI processing, analytics, crash reporting, notifications, customer support, and payment processing.
• With doctors, nutritionists, clinic staff, or care-team members where you request or use care-coordination services.
• With app-store or payment providers where needed to manage subscriptions, purchases, refunds, or fraud prevention.
• With legal, regulatory, or safety authorities if required by law or necessary to protect rights, safety, and security.
• In connection with a merger, acquisition, financing, or business transfer, subject to appropriate protections.

We require service providers and processors that handle personal information for us to protect it using safeguards consistent with this policy and applicable law. They may use the information only for the services they provide to LYXAA, unless you authorize another use or the law permits it.

Third-Party Services

LYXAA may use third-party services such as Supabase for authentication, database, storage, and backend functions; OpenAI or similar AI providers for AI-assisted features; Expo or device platform services for app infrastructure and notifications; Apple, Google, or payment providers for app distribution and subscriptions; and analytics or diagnostics tools to understand app performance and reliability.

No Sale of Data and No Targeted Ads from Health Data

We do not sell personal information. We do not use or share health, fitness, lab, CGM, Apple Health, Health Connect, face-scan, or medical-context data for third-party advertising, targeted advertising, or unrelated data mining.

De-Identified and Aggregated Information

We may use de-identified, anonymized, or aggregated information to understand app performance, improve features, develop wellness insights, and report high-level trends. We do not attempt to re-identify de-identified information except where necessary to test or improve our safeguards or where permitted by law.

Data Storage, Security, and Retention

We use reasonable technical and organizational safeguards designed to protect your information, including authentication, access controls, encrypted transport, and cloud security controls. No digital service can guarantee absolute security.

We retain personal information for as long as needed to provide the service, maintain your account, comply with legal obligations, resolve disputes, prevent abuse, and enforce agreements. Health and wellness data is generally retained while your account remains active unless you request deletion, subject to legal or operational retention needs.

If we become aware of a personal data breach that requires notice under applicable law, we will take steps to investigate, mitigate, and notify affected users and/or regulators as required.

Your Choices and Rights

• You can choose not to provide optional data, although some features may not work without it.
• You can manage camera, photo library, microphone, notification, Apple Health, and Health Connect permissions in your device settings.
• You may request access, correction, export, restriction, objection, or deletion of your personal information where applicable law gives you those rights.
• You may request account deletion by contacting us at the email addresses below or by using any account-deletion feature available in the app.

Account Deletion and Consent Withdrawal

You may request deletion of your account and associated personal information by contacting us at the email addresses below or using any account-deletion option available in the app. We may ask for information needed to verify your identity and locate your account.

We aim to complete deletion requests within a reasonable period, generally within 30 days where practical, unless we need to retain limited information for legal, security, fraud-prevention, dispute, tax, accounting, or regulatory reasons. Withdrawing consent does not affect processing that occurred before withdrawal.

Regional Privacy Rights

Depending on where you live, you may have additional rights under laws such as India's Digital Personal Data Protection Act, the GDPR, UK GDPR, or applicable US state privacy laws. These rights may include access, correction, deletion, portability, withdrawal of consent, objection, restriction, appeal, grievance redressal, or the ability to nominate another person where applicable.

To exercise these rights, contact us using the details below. We will respond within the timeframe required by applicable law.

Medical, HIPAA, and Clinical Services

LYXAA is primarily a wellness education and metabolic-health technology service. The app is not intended to create a doctor-patient relationship by itself. If you separately receive services from a doctor, clinic, laboratory, or other healthcare provider, that provider may give you additional privacy notices and may be subject to separate healthcare privacy laws or professional obligations.

Children's Privacy

LYXAA is intended for users who are at least 18 years old. We do not knowingly collect personal information from children.

International Transfers

Your information may be processed and stored in countries other than where you live. Those countries may have data protection laws that differ from your jurisdiction. Where required, we use appropriate safeguards for international transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we may notify you through the app, email, or another reasonable method. The effective date above shows when this version took effect.

Contact and Grievance Redressal