Privacy Policy.

1. About this policy

This Privacy Policy explains how LYVA Health Pvt Ltd. (“LYVA”, “we”, “us”, or “our”), based in Mumbai, Maharashtra, handles personal information in connection with this website, enquiries, and the care or partnership arrangements you discuss with us.

We respect your privacy and aim to collect only information needed for a clear, lawful purpose. This policy is a notice about our practices; visiting the website does not by itself give consent to unrelated processing or promotional messages.

Our approach is subject to applicable Indian law, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable, and the Digital Personal Data Protection Act, 2023 and its rules as the relevant provisions come into force.

2. Information you may provide

The information involved depends on how you choose to interact with us:

• Care enquiries and booking requests: contact details, relationship to the person needing care, address and home details, the recipient’s name, age, gender, mobility, memory, health situations, allergies and preferences, care service, requested dates and schedule, tasks and frequencies, caregiver preferences, optional doctor and medical instructions, budget, notes, and your consent confirmations. You may also choose to upload one prescription or discharge summary (JPG, PNG, or PDF, up to 5 MB) after separate consent. LYVA then receives its filename and contents, even if you do not subsequently send the WhatsApp message.
• Care arrangements: when needed and separately requested, relevant information about the person receiving care, their preferences, daily routine, care requirements, authorised contacts, and the agreed engagement. Health information should be shared only through a channel agreed with our team and with the appropriate consent or other lawful authority.
• Partner applications: the form allows you to submit contact and agency details, age and gender where supplied, address/locality, languages, qualifications, professional registration, experience, references, availability, expected payout, typed confirmation, and date. Aadhaar is optional at this stage. Supporting documents such as a CV, qualifications, or professional registration are optional and upload on submission.
• Communications and transactions: information you choose to send by WhatsApp, email, or phone, and records needed for a confirmed service, payment, refund, or complaint. This website does not have an online payment checkout or request card credentials.

Please provide accurate, relevant information. Do not include identity document numbers, payment credentials, or detailed medical records in a general enquiry. Only share information about another person if you have their consent or other lawful authority. Obtain a reference’s permission before providing their personal contact details.

3. How the website forms work

Partner applications and selected files

Your entries and selected files stay in the page until you choose “Submit application” after reviewing and confirming accuracy, authority, storage, and contact. Submission sends the complete application and selected documents to LYVA’s private hosting. A reference confirms that the application was saved; it does not confirm a partnership or employment.

Application details and document links are emailed to partner@lyva.health. Document links require authorised administrator sign-in to the private dashboard. Documents are not publicly listed or available to someone who merely receives a forwarded link. An optional Aadhaar number is stored encrypted and masked to its last four digits in the review, email, dashboard, and downloadable summary. Identity documents are optional; provide only relevant documents you are authorised to share.

The application is saved before email delivery is attempted. An email failure does not delete it; failed notifications are queued for retry. “Download a copy” saves a text summary on your device, including document names rather than file contents. It does not itself submit an application.

Customer booking requests, contact enquiries, and WhatsApp

The booking form validates entries locally and lets you review a complete request before agreeing to share it. Optional health details should be limited to what is relevant and what you have consent or other lawful authority to share. The website does not save booking text drafts or create a server-side record of your complete booking form. If you select a medical document, a separate confirmation explains that choosing “Upload document” sends the file to LYVA’s hosting storage before you send your WhatsApp message. Merely selecting a file does not upload it. The upload records the file, filename, upload/expiry times, and consent version for this purpose; it does not upload the other form answers.

Uploaded customer documents are encrypted in storage outside the public website folder. A random download link is included in your booking message. It does not require a login: anyone with the complete link can download the file until it expires seven days after upload or you delete it. Share the link only with appropriate people. The document is provided as a download link, not automatically attached in WhatsApp.

While this booking page remains open, “Delete uploaded document” lets you revoke an uploaded file and its link. Clearing an already uploaded selection also requests deletion. If you replace a document, earlier uploads remain listed on the Review step so you can delete them. Closing the page can lose these local deletion controls; contact care@lyva.health with the document link if you need help. Deleting the hosted copy cannot remove a copy another person has already downloaded.

The booking and contact forms prepare WhatsApp messages. When you continue with a prefilled link, the details in that message are passed to WhatsApp and may be handled by that platform before you press Send. You can review the message there. For a long booking request, the page offers to copy the complete text to your device’s clipboard before opening the chat; paste it yourself, or copy it manually if clipboard access is unavailable. Clipboard contents may be available to your device or other apps under their own settings. LYVA receives the message only if you send it. Opening a link does not confirm a booking.

WhatsApp, your email provider, and your device handle information under their own terms and privacy practices. You may instead contact us directly by phone or email. Partner applications use the separate submission process above rather than WhatsApp.

4. Why LYVA uses information it receives

When you actually provide information to LYVA, we use it as relevant to:

• Respond to your enquiry and check service or professional availability in your locality.
• Understand care needs, arrange an assessment, match an appropriate professional, coordinate the agreed care, and communicate with authorised family contacts.
• Review a partnership enquiry, arrange verification with appropriate permission, or discuss a separate partner agreement.
• Manage agreed fees, payments, expenses, refunds, feedback, and complaints.
• Protect people and information, prevent misuse or fraud, and meet applicable legal or professional requirements.

We rely on your consent where it is required and on other grounds permitted by applicable law where appropriate. Where consent is needed for sensitive information, we will seek it for the stated purpose. We do not treat a care enquiry as permission for unrelated advertising. Promotional communications require a separate lawful basis, and you may ask us to stop them.

5. When information may be shared

We do not sell or rent your personal information. Information received by LYVA may be shared only as needed and lawfully, including:

• With authorised LYVA personnel and Care Managers who need it to respond or coordinate your engagement.
• With a matched care professional, an authorised family contact, or a relevant professional involved in the agreed care, limited to the information needed for that purpose.
• With communication, hosting, verification, accounting, or other service providers where used for an explained purpose and subject to appropriate safeguards.
• Where disclosure is required by a valid legal process or law, or is otherwise lawfully necessary to protect a person’s safety or address fraud or misuse.

We seek permission where required and do not authorise recipients to use information for unrelated purposes. Partner details or documents are not made public merely because a person applies to work with LYVA.

6. Cookies, technical logs, and external links

The current website does not set advertising or analytics cookies, run tracking pixels, or load third-party analytics. The upload and application services use short-lived server-side abuse-prevention counters with a keyed hash of the connection IP address, rather than storing the raw IP in those counters. These counters expire within 24 hours and are cleared during subsequent service requests. The private partner dashboard uses an essential session cookie for sign-in; it is HttpOnly, Secure, and SameSite protected. Sign-in codes expire after 10 minutes, dashboard sessions expire after inactivity or a maximum of eight hours, and security events are recorded without application contents. Fonts and site images are served as local website assets.

Infrastructure used to deliver and protect a website may process technical information such as an IP address, browser/device information, requested page, date/time, referrer, or security logs. This is separate from submitting form contents. If optional tracking or additional collection is introduced, we will explain it and seek consent where required before it operates.

External platforms you choose to open may use their own cookies, logs, and storage. Their privacy practices apply to their services. A link to another service is not a promise about that service’s data handling.

7. How long information is kept

For information actually received by LYVA, retention depends on its purpose, the engagement, and applicable legal or professional record-keeping requirements. We retain it only for as long as needed to deal with the enquiry or service, meet those requirements, or reasonably resolve a complaint or legal claim. We delete or anonymise information when it is no longer needed, subject to lawful retention requirements.

Customer document links stop working seven days after upload. Expired encrypted files are deleted during the next document-service request; deletion controls can remove them earlier. Hosting backups, if retained by the hosting provider, may follow a separate lifecycle. Copies a recipient downloads or LYVA separately retains for an agreed care arrangement are subject to the relevant purpose and retention requirements above.

Partner applications and uploaded documents are stored long term with no automatic expiry to support application review, verification, ongoing partnership administration, and related queries. This differs from customer documents’ seven-day links. We review retention when information is no longer needed, consent is withdrawn, or a correction or deletion request is received, subject to lawful retention requirements. Long-term storage depends on maintaining the hosting account and its private records and backups; it is not a guarantee against loss. Authorised LYVA administrators can permanently delete a partner application with its uploaded files and copies in website-managed local database snapshots. Its hosted document links then stop working. Notification emails already sent, downloaded documents or backups, and the hosting provider’s independent backups need separate handling. Copies you download remain under your control. Information held by WhatsApp, email services, or other independent platforms is subject to their retention practices.

8. Keeping information secure

LYVA is committed to reasonable technical and organisational safeguards appropriate to the information it handles, including limiting access to authorised people and using information only for the relevant purpose. No internet transmission, device, or storage system can be guaranteed completely secure.

Partner records and documents are encrypted at rest outside the public website folder. Authorised dashboard access requires a one-time code sent to LYVA’s partner mailbox; hosting account administrators can also manage the private storage. Application emails are additionally stored in that mailbox and are protected by its access controls. Please do not send passwords, OTPs, card security codes, or unnecessary identity documents in an application. If documents are needed for onboarding or care, ask the team to confirm the appropriate channel first. Suspected misuse or a privacy incident can be reported using the contact details below. Any notification required by applicable law will be handled within the applicable requirements.

9. Your choices and requests

You may contact us to ask about information LYVA holds about you, request access or correction, withdraw consent, stop optional communications, or request deletion where applicable. We may ask for proportionate information to verify your identity or authority before acting.

You can choose not to provide optional information. Withdrawing consent does not affect processing already lawfully carried out, but it may limit a service that needs that information; we will explain the impact. Some records may need to be retained under law. We will explain any lawful reason why a request cannot be fully met.

Additional statutory rights will be respected as the relevant legal provisions become applicable. Nothing in this policy limits rights or remedies available to you under law.

10. Children and people represented by others

Website enquiries and partner applications are intended to be made by adults aged 18 or over. An adult arranging care for a child or another dependent must have the appropriate consent or legal authority. Please do not enter a child’s sensitive information in a general enquiry.

We do not knowingly seek personal information directly from a child without the authorisation required by law. If you believe a child has provided information inappropriately, contact us so we can review and take appropriate action.

11. Processing outside India

Communication platforms and service providers may process information in India or other countries. Where LYVA transfers information outside India, it will do so only as permitted by applicable law, with required safeguards and consent where applicable. Choosing an external platform also brings its own processing and transfer practices into play.

12. Changes to this policy

We may update this policy when the website, services, providers, or legal requirements change. The latest version will display its update date. Where a change requires additional notice or consent, we will provide or obtain it as required before the relevant processing. An update does not remove rights that already apply to you.

13. Privacy questions and complaints

For a privacy request, correction, withdrawal, or complaint, contact LYVA’s general contact below and use the subject “Privacy request” or “Privacy complaint”. Please include enough information to explain your request without sending unnecessary sensitive documents.

We aim to acknowledge complaints within 48 hours and address them within one month, subject to any shorter applicable legal requirement. If further steps are needed, we will keep you informed. You retain the right to use the competent statutory authority or forum available under applicable law.