Privacy Policy
Your data. Your rights. Our responsibility.

Aavie is a product of AAVIE Life Sciences Private Limited, a company incorporated under the Companies Act, 2013, with its registered office in India. We operate the Aavie mobile application (available on Google Play and Apple App Store) and the website aavie.life.

Aavie is an Ayurvedic women's wellness platform offering matched herb supplements based on Prakriti & Vikriti, cycle tracking, and Vaidya-reviewed supplement dispatch to support hormonal balance and cycle wellness.

For the purposes of applicable data protection laws, AAVIE Life Sciences Private Limited is the Data Fiduciary (under India's DPDP Act, 2023) and Data Controller (under GDPR for EU/UK users).

We collect only what is necessary to deliver a personalised, safe Ayurvedic wellness experience. Below is a full account of every category of data we may collect.

• Matched Herb Supplement Composition based on Prakriti & Vikriti — Your Prakriti, Vikriti, hormonal pattern, and cycle data are used to generate a personalised Ayurvedic herb supplement via our assessment engine.
• Vaidya Review Before Dispatch — Your supplement and wellness summary are shared with our qualified Vaidya (Ayurvedic practitioner) for review before any supplement is dispatched to you.
• Cycle & Symptom Tracking — To track your menstrual cycle, flag irregularities, and offer phase-specific guidance on food, lifestyle, and herbs.
• Food Engine Recommendations — To provide matched dietary guidance based on Prakriti & Vikriti, Viruddha Ahara (incompatible food) detection, and meal timing advice based on your constitution and current phase.
• Supplement Dispatch & Order Management — To process, pack, and deliver your personalised supplement pouches.
• Service Communications — Order confirmations, dispatch notifications, supplement updates, check-in reminders (you may opt out of non-essential communications).
• App Improvement & Safety — Aggregated, anonymised usage data to improve assessment logic, food database accuracy, and app performance. No individual health data is used for this purpose.
• Customer Support — To respond to your queries, complaints, and support requests.
• Legal & Regulatory Compliance — To meet obligations under the DPDP Act, GDPR, FSSAI, and other applicable regulations.

Menstrual data, hormonal wellness information, Ayurvedic constitution data, dietary patterns, and self-reported signals are classified as sensitive personal data under India's DPDP Act, 2023 and as special category data under GDPR.

We process this data exclusively on the basis of your explicit, informed consent, obtained at onboarding via a dedicated consent screen. You may withdraw this consent at any time — see Section 9 (Your Rights).

Access to your sensitive health data is restricted to:

• The Aavie Assessment Engine — automated supplement composition system, operating under safety rules set by our Vaidya team
• Qualified Vaidya (Practitioner) — for supplement review prior to dispatch
• Authorised Engineering Staff — under strict access controls, only for debugging and safety audits, never for commercial use

Your health data is never sold, licensed, or shared with advertising networks, data brokers, or any third party for commercial purposes.

Aavie operates a Practitioner Review Layer — a governance model in which every generated herb supplement is reviewed by a qualified Vaidya before your supplements are dispatched.

When you complete your assessment and a supplement is generated, the following data is made available to the reviewing Vaidya within the Aavie Practitioner Portal:

• Your anonymised wellness profile (Prakriti, Vikriti, hormonal pattern, signal severity score)
• The generated herb supplement for review
• Any contraindication flags or safety alerts raised by the assessment engine
• Your age and relevant cycle history (not your name or contact details, unless you initiate a Priority Review)

Practitioner access is role-restricted, logged, and subject to confidentiality obligations equivalent to standard professional ethics requirements under Indian law.

We share your data only in the following limited, necessary circumstances:

All third-party processors are bound by data processing agreements requiring them to process your data only as instructed by Aavie and to implement appropriate security measures.

We do not sell your data. We do not share your health data with insurers, employers, pharmaceutical companies, or advertising platforms.

Your data is stored on secure servers hosted in India. We implement the following security measures:

• Encryption in Transit — All data between your device and our servers is encrypted via TLS 1.2 or higher
• Encryption at Rest — Health and personal data is encrypted in our database
• Access Controls — Role-based access; only authorised personnel can access identifiable health data
• Audit Logs — All access to health records by staff or practitioners is logged and auditable
• Authentication — Secure login with OTP / email verification; practitioner portal requires additional authentication
• Regular Security Reviews — Periodic internal audits of data access and security posture

No system is 100% secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities within the timeframes required by applicable law (72 hours under GDPR; as required under DPDP Act).

When retention periods expire, data is securely deleted or irreversibly anonymised. You may request early deletion — see Section 9.

Regardless of your country, you have the following rights over your personal data:

To exercise any right, email us at privacy@aavie.life with subject line "Data Rights Request". We will respond within 30 days (or sooner as required by law). Identity verification will be required for sensitive requests.

This section applies to users in India and supplements our general policy in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act).

• Lawful Basis — We process your personal data on the basis of free, informed, specific, and unambiguous consent obtained at onboarding. For sensitive health data, explicit consent is collected separately.
• Consent Records — A timestamp and record of your consent is stored securely for audit purposes.
• Right to Nominate — You may nominate another individual to exercise your DPDP rights in the event of your death or incapacity. Contact privacy@aavie.life to register a nominee.
• Grievance Officer — A named Grievance Officer is designated for Indian users (see Section 15). Complaints must be acknowledged within 72 hours and resolved within 30 days.
• No Children's Data — We do not knowingly collect data from persons under 18 years. Aavie is not intended for minors.
• Data Localisation — Your personal data is stored on servers located within India.

If you are unsatisfied with our response to a complaint, you may escalate to the Data Protection Board of India once constituted under the DPDP Act.

This section applies to users in the European Economic Area (EEA) and the United Kingdom, and supplements our general policy in compliance with the General Data Protection Regulation (GDPR) and UK GDPR.

• Legal Basis for Processing — We rely on explicit consent (Article 9(2)(a) GDPR) for processing special category health data, and contractual necessity (Article 6(1)(b)) for account and order management.
• Data Controller — AAVIE Life Sciences Private Limited, India. Contact: privacy@aavie.life
• International Data Transfers — Your data is stored in India. Transfers from EEA/UK to India are made on the basis of Standard Contractual Clauses (SCCs) or equivalent safeguards until an adequacy decision is in place.
• Right to Object — You may object to processing at any time where we rely on legitimate interests as a legal basis.
• Right to Restrict — You may request we restrict processing while a complaint is being investigated.
• Supervisory Authority — EU users may lodge a complaint with their local Data Protection Authority (DPA). UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk.
• Breach Notification — In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay where required.

The Aavie mobile app does not use browser cookies. The aavie.life website uses the following:

• Essential Cookies — Required for the website to function (session management, security). Cannot be disabled.
• Analytics — Anonymised usage data to understand site traffic and improve the user experience. No personally identifiable or health data is included.
• No Advertising Cookies — We do not use advertising tracking cookies or third-party retargeting on aavie.life.

You may manage cookie preferences via your browser settings. For EU/UK users, a cookie consent banner is displayed on first visit to aavie.life in compliance with GDPR ePrivacy requirements.

Aavie is intended exclusively for users aged 18 years and above. We do not knowingly collect, process, or store personal or health data from minors.

If we become aware that data has been collected from a user under 18 without appropriate consent, we will delete it immediately. If you believe a minor's data has been submitted, contact us at privacy@aavie.life.

We may update this Privacy Policy from time to time to reflect changes in our services, data practices, or applicable law.

• Material changes will be notified to you via in-app notification and/or email at least 14 days before the change takes effect
• Non-material clarifications may be updated without advance notice
• Continued use of the Aavie app after the effective date constitutes acceptance of the updated policy
• If you do not accept material changes, you may delete your account before the effective date

The date of the most recent update is always displayed at the top of this page.

For any questions, rights requests, or complaints regarding your personal data, contact us through the following channels: