Privacy Policy

Activénse Holistic Solutions Pvt Ltd ("Activénse", "we", "us") operates Glycosutra™, an adaptive agentic AI platform for pre-diabetes reversal. This policy explains what personal and health data we collect, why, how we protect it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who we are

Activénse Holistic Solutions Pvt Ltd, a DIPP-recognised startup based in Pune, India. Glycosutra is our patent-pending (Indian Patent Application No. 202621040877) adaptive agentic AI platform, built on the Adaptive Agentic Framework shared across the Activénse product portfolio.

2. What we collect

Depending on how you use Glycosutra, we may collect:

• Account and contact details — name, phone number, email address.
• Clinical and health data — meal logs and photos, weight, fasting/post-meal blood-sugar readings, HbA1c, dietary preferences, fasting-day patterns, and clinical history you or your dietitian enter.
• Programme activity — diet-plan adherence, swap requests, in-app messages with your dietitian, notifications.
• Technical data — device type, app version, and basic usage logs needed to keep the service running and secure.

We do not collect or store medication dosages, insulin units, or any instruction we could construe as a dosing recommendation — this is a structural rule in how Glycosutra is built, not a policy choice we could quietly change (see Clause 5).

3. Why we collect it

• To generate and adapt your personalised, Indian-food-specific diet plan.
• To let your dietitian review your progress and approve any change to your plan.
• To maintain the audit trail required for clinical accountability (Clause 6).
• To operate, secure, and improve the service, including fixing defects.
• To send you programme-related notifications (meal reminders, dietitian messages, swap approvals) via the app, email, or WhatsApp, where you have opted in.

We do not sell your personal or health data. We do not use it to train third-party advertising systems.

4. Where your data lives

Glycosutra's production systems and database are hosted on cloud infrastructure located in India, in line with the DPDP Act's residency expectations for a health-adjacent Indian product. Where we use a large-language-model provider to help draft plan language or summarise a report, we route that call through a provider-neutral layer and prefer providers offering an India or Asia-Pacific processing region; the underlying data sent to any such provider is minimised and never includes information we could use to directly identify you without your account.

5. The one thing Glycosutra will never do

Glycosutra's architecture structurally prohibits any agent, prompt, or output from computing or implying a medication or insulin dose. This is enforced at the code and policy level, not left to an AI model's judgement. Every AI-generated output carries a confidence score and a provenance record, and every decision that changes your plan is logged in an append-only, hash-linked audit chain that cannot be silently edited — including by us.

6. Human review, always

Glycosutra's AI components are advisory only. A named dietitian is the sole approval authority for any change that reaches you, and a clinician reviews escalations. No fully automated decision about your health plan is made without a documented, reviewable, human-governed step.

7. Who else sees your data

We share data only with:

• The dietitian and, where relevant, clinician assigned to your programme.
• Infrastructure and processing vendors acting strictly as our data processors (e.g. cloud hosting, transcription, messaging delivery), bound by contract to use your data only to provide that service to us.
• Authorities, where required by Indian law.

If you arrive at Glycosutra through a paid advertisement, the advertising platform (for example Meta or Google) may set its own cookie on that landing page to measure ad performance. That is governed by the advertising platform's own privacy policy, not ours.

8. How long we keep it

We retain your data for as long as your account is active and for a reasonable period afterward to meet our clinical audit-trail and legal obligations. You can ask us to delete your account data at any time (Clause 9); we will do so except where a record must be retained by law or to preserve the integrity of the shared audit chain, in which case we will tell you what is retained and why.

9. Your rights under the DPDP Act

• Access — ask what personal data we hold about you.
• Correction — ask us to correct inaccurate or out-of-date data.
• Erasure — ask us to delete your data, subject to Clause 8.
• Withdraw consent — at any time, for any processing based on consent, without affecting past processing.
• Grievance redress — raise a complaint with our Data Protection Officer below; if unresolved, you may approach the Data Protection Board of India.

10. Security

We use role-based access control, encryption of health data at rest, and PII redaction at system boundaries so that raw identifiers are not passed further than necessary. Every material action on your record is logged in the append-only audit chain described in Clause 5, which lets us detect — not just prevent — any anomaly.

11. Changes to this policy

If we materially change how we handle your data, we will update this page and, where the change is significant, notify you directly.