Privacy

Privacy Policy

Last updated: October 9, 2026

NYUS Inc. ("NYUS", "we", "our", "us") operates the NYUS mobile application and related services (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.

1. Information We Collect

1.1 Information you provide directly

• Account data: email address, name and profile photo. Member accounts have no password: you sign in with a one-time code we email you (we store only a hash of it) or with Google Sign-In.
• Body stats and health profile: age, sex, height, weight, activity level, goals, dietary preferences, allergies, training history.
• Logged data: meals, workouts, weights, measurements, sleep, mood, ratings, and progress photos you choose to upload.
• Chat content: messages exchanged with the in-app AI coach and other users.
• Payment data: payments are processed by Razorpay. We receive the plan, amount, date and Razorpay order and payment IDs. Your card, UPI or bank details go to Razorpay only; we never see or store them.

1.2 Information from Health Connect (with your permission)

If you grant permission, NYUS reads the following from Android Health Connect:

• Steps (READ_STEPS) — daily step counts for activity tracking.
• Total calories burned (READ_TOTAL_CALORIES_BURNED) — daily energy expenditure.
• Weight (READ_WEIGHT, WRITE_WEIGHT) — body weight history; we may write logged weight back to Health Connect.
• Heart rate (READ_HEART_RATE) — workout intensity tracking, and the high-heart-rate alert if you turn it on.
• Exercise (READ_EXERCISE, WRITE_EXERCISE) — completed sessions; we may write logged workouts back.
• Sleep (READ_SLEEP) — sleep duration and stages, for recovery insights and the sleep alerts you turn on.
• Resting heart rate (READ_RESTING_HEART_RATE), heart rate variability (READ_HEART_RATE_VARIABILITY), blood oxygen (READ_OXYGEN_SATURATION) and breathing rate (READ_RESPIRATORY_RATE) — shown on your Health alerts screen and used only for the alerts you choose to turn on.

Data read from Health Connect is copied to our servers so it appears in your history and can power the alerts you set. It is never used for advertising, never sold, and is deleted with your account (Section 7). NYUS's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

You can revoke Health Connect access at any time from Health Connect settings on your device. Revoking permission stops further reads; data already imported into NYUS is governed by Section 7 (retention and deletion).

1.3 Information collected automatically

• Device and usage data: device model, OS version, app version, IP address, crash reports (sent to our own servers), performance metrics, feature interactions.
• Identifiers: a NYUS user ID, a device push token (for notifications), and a Firebase Analytics app-instance ID linked to your NYUS user ID.
• Cookies and local storage: used to maintain your session and remember preferences.

2. How We Use Your Data

• Provide, maintain, and improve the Service.
• Personalize your training plan, diet plan, and AI coaching responses.
• Compute progress charts, streaks, weekly insights, and notifications.
• Process subscriptions and prevent fraud.
• Send transactional and (with consent) marketing communications.
• Detect, investigate, and prevent security incidents and abuse.
• Comply with legal obligations.

3. Legal Bases (EEA / UK users)

• Contract: to deliver the Service you signed up for.
• Consent: for Health Connect data, marketing emails, push notifications.
• Legitimate interests: security, fraud prevention, product analytics.
• Legal obligation: tax, accounting, lawful requests.

4. Sharing and Disclosure

We share data only with the following categories of recipients:

• Oracle Cloud Infrastructure (Hyderabad, India): hosting and the database.
• OpenAI: writes the AI coach's replies and builds AI plans. It receives your messages and the profile and log details a reply needs, under OpenAI's API data terms.
• Razorpay: processes payments.
• Resend: sends our emails (sign-in codes, account and deletion notices).
• Google: Firebase Cloud Messaging (push notifications), Firebase Analytics (app usage analytics), and Google Sign-In if you choose it.
• Discord: internal operational alerts for our team. These carry event types, user IDs and counts only, never message text, health values or email addresses.
• Food and exercise lookups: USDA FoodData Central (nutrition data) and Pollinations (food and exercise illustrations) receive only the food or exercise name, never anything about you.
• Legal: when required by law, court order, or to protect rights, safety, and property.
• Business transfers: in the event of a merger, acquisition, or asset sale, with notice to you.

We do not sell personal data and we do not use Health Connect data for advertising.

5. International Transfers

Our servers are in India (Oracle Cloud, Hyderabad region). Some processors above operate outside India: OpenAI and Google process data in the United States, and Resend and Discord also run outside India. We rely on their contractual safeguards for these transfers.

6. Security

Data travels over TLS. Our database storage is encrypted at rest by our cloud provider, and nightly database backups are encrypted (OpenPGP) before they leave our servers. Sign-in codes are stored only as hashes; sessions use signed tokens that expire, and each refresh token works only once. We also apply rate limiting and server-side input sanitization. No system is perfectly secure; please report anything suspicious to support@nyus.in.

7. Data Retention and Deletion

We keep your data while your account is active. You can delete your account at any time:

• From within the app: Profile → Settings → Delete Account.
• From the web: nyus.in/account-deletion.
• By email: support@nyus.in.

How deletion works. A request made in the app while you are signed in is scheduled at once: your account is permanently deleted 7 days later, and we email you a link to cancel until then. A request from the web or by email must first be confirmed from a link we send to the account's email address; nothing is deleted until you confirm, and the same 7 days then apply.

What is deleted. Your profile, body stats, plans, logs, progress photos, messages, AI coach history and data imported from Health Connect. Shared groups or challenges you created pass to another member, or are deleted if no one else is in them.

What we keep. Payment records (plan, amount, date and Razorpay IDs) for as long as Indian tax law requires; a record that the deletion happened, with your email address removed; and our internal audit log of staff actions. Encrypted database backups are kept for up to 90 days, so your data leaves the backups within 90 days of deletion. Usage analytics held by Google are deleted under Google Analytics' retention settings.

8. Your Rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, DPDP Act 2023, etc.), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent (e.g., revoke Health Connect at any time).
• Lodge a complaint with your data protection authority.

To exercise any right, email support@nyus.in. We respond within 30 days.

9. Children

NYUS is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Third-Party Links

Our Service may link to third-party sites (e.g., Google Play, social platforms). Their privacy practices are governed by their own policies.

11. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes via the app or email. The "Last updated" date at the top reflects the latest revision.

12. Contact

NYUS Inc.
Email: support@nyus.in
Available Monday – Friday, 9:00 a.m. – 9:00 p.m. IST