Skip to main content

Fiddlefitt Life | Personalized Diet, Fitness & Sleep Therapy Programs

Privacy Policy

FIDDLEFITT LIFE PRIVATE LIMITED

(carrying on business as “FiddleFitt Life”)

  1. INTRODUCTION AND APPLICATION

    1. This Privacy Policy sets out how Fiddlefitt Life Private Limited, a company incorporated under the Companies Act, 2013 and having its registered office at G-04, Ground Floor, Plot No. 41, Block B, Sector 63, Noida, Gautam Buddha Nagar, Uttar Pradesh, India (the “Company”, “we”, “us” or “our”), which carries on business under the name “FiddleFitt Life”, collects, uses, shares, retains and protects personal data in the course of offering and delivering its nutrition, lifestyle and wellness programmes.

    2. Scope: This Privacy Policy applies to personal data collected through the website at fiddlefittlife.com (the “Website”), inquiry forms, telephone and WhatsApp communications, assessment calls, live sessions conducted by video conference, email, and every other channel through which the Company deals with prospective and existing clients, parents and guardians of minor clients, and employees of corporate clients who participate in a programme. It does not apply to the websites, applications or services of third parties, including those reached through links on the Website, which are governed by their own terms.

    3. Legal Framework: This Privacy Policy is published in compliance with Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and is framed to meet the requirements of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”) as the respective provisions come into force. For the purposes of the DPDP Law, the Company is the Data Fiduciary in respect of the personal data described in this Privacy Policy.

    4. This Privacy Policy forms part of, and is to be read with, the Company’s Terms of Use. Capitalised terms used but not defined in this Privacy Policy carry the meaning given to them in the Terms of Use.

  2. INTERPRETATION

    1. In this Privacy Policy, “personal data” means any data about an individual who is identifiable by or in relation to such data; “Health Information” means information relating to an individual’s physical, physiological or mental health condition, medical history, medication, menstrual, hormonal, reproductive and fertility health, body measurements, and any medical or laboratory report shared with the Company, all of which the Company treats as sensitive personal data or information within the meaning of Rule 3 of the SPDI Rules; and “you” refers to the individual whose personal data is processed and, where that individual is below eighteen years of age, includes the Parent acting on the individual’s behalf.

  3. PERSONAL DATA COLLECTED

    1. Identity and Contact Data: The Company collects name, age, date of birth, gender, telephone and WhatsApp number, email address and city of residence and, for invoicing, billing address and GSTIN where applicable. Where the Client is a minor, the Company also collects the identity and contact details of the Parent and the Parent’s relationship with the Client. For participants in a corporate programme, the Company may receive name, contact details and employee identifier from the Corporate Client.

    2. Health Information: Before recommending any Programme, the Company conducts a detailed assessment in which the Client, or in the case of a minor the Parent together with the Client, reports current health status, existing conditions and medication, dietary habits, preferences and restrictions, physical activity, sleep and stress patterns, menstrual, hormonal and fertility history, and body measurements, and may share medical or laboratory reports. Information of the same nature is collected during the Programme through progress updates and follow-ups. The Company collects only such Health Information as is necessary to assess suitability for, design and deliver a Programme, and processes it only on the consent described in Section 4.2.

    3. Programme and Communication Data: The Company maintains records of assessment calls, plans issued, progress logs and follow-up notes, messages exchanged over WhatsApp, email and telephone, attendance at live sessions, and feedback received. Live sessions are not recorded unless every participant has consented in advance.

    4. Transaction Data: The Company records the amount, date and mode of payment, the UPI or bank transaction reference, the name of the remitting account holder, and the invoices issued. The Company does not collect or store UPI PINs, card numbers, card verification values, net banking credentials or other payment authentication data. Where a payment is made through a payment gateway, such data is collected and processed by the gateway operator under its own terms and the regulatory framework of the Reserve Bank of India.

    5. Technical and Usage Data: When you visit the Website, the Company collects your IP address, device and browser type, pages visited, referring source and interactions with the Website through the technologies described in Section 10.

    6. Data Received from Others: Where you are referred by an existing client or a Corporate Client, or respond to an advertisement on a social media platform, the Company may receive your name and contact details from that source, together with the referral or campaign through which the inquiry arose.

  4. PURPOSES AND BASIS OF PROCESSING

    1. Purposes: The Company processes personal data to (a) respond to inquiries and schedule assessment calls; (b) assess your health and lifestyle and recommend a suitable Programme; (c) design, deliver, monitor and modify your Programme, including through follow-ups and live sessions; (d) confirm enrolment, collect Fees, issue invoices and maintain accounts; (e) communicate with you regarding your Programme, including schedules, pauses and progress reviews; (f) improve its Programmes and train its practitioners, using de-identified data wherever the purpose permits; (g) inform you of its own Programmes and offers; (h) comply with applicable law, including tax and accounting obligations, and respond to lawful requests of public authorities; and (i) establish, exercise or defend legal claims.

    2. Consent for Health Information: Health Information is collected and processed only after you have given free, specific, informed and unambiguous consent, which the Company obtains in writing or by electronic means, including by a recorded affirmation over WhatsApp or email, before the assessment is conducted. Separate consent is obtained for any use of Health Information beyond the purposes in clauses (b), (c) and (f) of Section 4.1, including the publication of testimonials, photographs or progress outcomes, which are otherwise used only in a form that does not identify you.

    3. Other Personal Data: Identity, contact, transaction and communication data are processed on the basis of your consent, the specified purpose for which you have voluntarily provided them, and the Company’s obligations under law, as permitted by Section 7 of the Digital Personal Data Protection Act, 2023.

    4. Restrictions: The Company does not sell or rent personal data, does not use Health Information for advertising or for building advertising audiences, and does not take decisions concerning you solely by automated means.

    5. Promotional Communications: Information about the Company’s Programmes and offers is sent by its personnel over WhatsApp, telephone or email and not through automated bulk messaging. You may opt out at any time by replying to such a message or writing to the Grievance Officer, and opting out does not affect communications required to administer an ongoing Programme.

  5. PERSONAL DATA OF CHILDREN

    1. The Company offers Programmes to persons below eighteen years of age only through a Parent, who holds the account, is the Company’s point of contact, and participates in the assessment call together with the Client. Before collecting any personal data of the minor beyond what is needed to schedule the assessment, the Company obtains the verifiable consent of the Parent in the manner prescribed under the DPDP Law, which includes confirming the identity and adulthood of the Parent by reference to reliable identity details and recording the Parent’s consent in writing or by electronic means.

    2. The personal data of a minor, including Health Information, is used solely to deliver the minor’s Programme through the Company’s paediatric nutrition specialists. The Company does not undertake tracking or behavioural monitoring of minors or advertising directed at them, and does not use a minor’s personal data for promotional communications, testimonials or analytics except in aggregated form from which the minor cannot be identified. The rights described in Section 9 in respect of a minor’s personal data are exercisable by the Parent.

  6. DISCLOSURE OF PERSONAL DATA

    1. Practitioners: Personal data is accessible to the dietitians, paediatric nutrition specialists, yoga and exercise instructors and support personnel assigned to your Programme, whether employed by the Company or engaged as independent contractors. Each of them is bound by written confidentiality obligations and may access only such personal data as your Programme requires.

    2. Service Providers: The Company engages third-party service providers, acting on its instructions, for document storage, spreadsheet management and video conferencing (Google), website hosting (Hostinger), website analytics and advertising measurement (Google Analytics and Meta), and payment processing (banks, UPI service providers and, upon integration, a payment gateway). These providers process personal data only for the purpose of providing their services to the Company.

    3. Corporate Clients: Where you participate in a Programme through your employer or another Corporate Client, the Company shares with that Corporate Client only your enrolment and participation status and aggregated, de-identified outcomes. Your Health Information is not disclosed to the Corporate Client without your express consent.

    4. Disclosure Required by Law: The Company may disclose personal data to government agencies, courts, tribunals and regulators where required by law or lawful order, including for verification of identity or the prevention, detection or investigation of offences, as contemplated by Rule 6 of the SPDI Rules.

    5. Business Transfers: In the event of a merger, amalgamation, acquisition or transfer of the whole or part of the Company’s business, personal data may be transferred to the successor entity, which shall be bound to process it in a manner consistent with this Privacy Policy.

  7. TRANSFER OF PERSONAL DATA OUTSIDE INDIA

    1. The Company’s Website is hosted in India. Certain of the service providers referred to in Section 6.2, including Google and Meta, may store or process personal data on servers located outside India. Such transfers are made only to the extent necessary for the purposes in Section 4.1, to providers that maintain a level of data protection not lower than that required under the SPDI Rules, and not to any country or territory notified as restricted by the Central Government under Section 16 of the Digital Personal Data Protection Act, 2023.

  8. RETENTION

    1. Personal data, including Health Information, is retained for three years from the date of its collection and is thereafter erased or irreversibly de-identified, unless you have obtained its earlier erasure under Section 9 or its retention for a longer period is required by law or for the defence of a pending or reasonably anticipated claim.

    2. Notwithstanding Section 8.1, invoices and transaction records are retained for the periods prescribed under the Companies Act, 2013, the Central Goods and Services Tax Act, 2017 and the income-tax law, and logs of processing are retained for the minimum period prescribed under the DPDP Law.

  9. YOUR RIGHTS

    1. Subject to applicable law, you may (a) obtain a summary of the personal data held by the Company about you, the processing undertaken and the identities of those with whom it has been shared; (b) require correction, completion or updating of inaccurate or incomplete personal data; (c) require erasure of personal data that is no longer necessary for the purpose for which it was collected, save where its retention is required by law; (d) withdraw any consent previously given; (e) have your grievances redressed under Section 12; and (f) nominate another individual to exercise these rights in the event of your death or incapacity.

    2. Withdrawal of Consent: Consent may be withdrawn at any time by writing to the Grievance Officer, with the same ease with which it was given, and its withdrawal does not affect the lawfulness of processing carried out before it. As a Programme cannot be designed or delivered without Health Information, withdrawal of consent to its processing requires the Company to discontinue the Programme, and the consequences as to Fees are governed by the cancellation provisions of the Terms of Use.

    3. Exercise of Rights: Requests are to be addressed to the Grievance Officer from the email address or telephone number registered with the Company. The Company may verify your identity before acting on a request, and will respond within the period stated in Section 12.2.

  10. COOKIES AND ANALYTICS

    1. The Website uses cookies and similar technologies necessary for its operation, and analytics and advertising technologies, namely Google Analytics 4 and the Meta Pixel, which record how visitors reach and use the Website and measure the effectiveness of the Company’s advertisements on Meta platforms. These technologies collect Technical and Usage Data and do not receive Health Information. Where required by law, the Company seeks your consent before placing non-essential cookies.

    2. You may block or delete cookies through your browser settings, opt out of Google Analytics through the opt-out mechanism made available by Google, and manage advertising preferences in your Meta account settings. Disabling non-essential cookies does not affect your access to the Website.

  11. SECURITY OF PERSONAL DATA

    1. The Company maintains reasonable security practices and procedures proportionate to the nature of the personal data it holds, including restriction of access to Health Information to the practitioners assigned to a Programme, authentication and access controls on accounts and files holding client records, confidentiality undertakings from personnel and contractors, and periodic review of access permissions.

    2. In the event of a personal data breach, the Company will take steps to contain it and will intimate the affected individuals, the Data Protection Board of India and, where applicable, the Indian Computer Emergency Response Team, in the manner and within the time prescribed by law.

    3. You are responsible for the security of your own devices and accounts, and should share Health Information and make payments only through the channels and accounts designated by the Company in writing.

  12. GRIEVANCE OFFICER

    1. In accordance with the SPDI Rules, the DPDP Law and the Consumer Protection (E-Commerce) Rules, 2020, the Company has designated Ms. Akansha Tiwary, as its Grievance Officer, who is also the point of contact for every request under Section 9. She may be contacted at contact@fiddlefittlife.com or on +91 81302 34098, or by post at the registered office of the Company.

    2. The Grievance Officer will acknowledge every grievance or request within forty-eight hours of its receipt and will resolve it within one month of receipt. If you are not satisfied with the resolution, you may, having exhausted this mechanism, approach the Data Protection Board of India in accordance with the DPDP Law.

  13. AMENDMENTS

    1. The Company may amend this Privacy Policy to reflect changes in its practices, service providers or applicable law. The amended Privacy Policy will be published on the Website with a revised “Last Updated” date, and material changes will be communicated directly to Clients whose Programmes are ongoing. Where an amendment requires fresh consent under law, the Company will obtain it before giving effect to the amendment.

  14. GOVERNING LAW

    1. This Privacy Policy is governed by the laws of India, and disputes arising under it are subject to Section 17 of the Terms of Use.