Privacy Policy

Last updated: 19 October 2026

TIVA Innovations LLP ("TIVA Wellness", "we", "us", or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

This Policy applies to our website, our patient/staff portal, and the TIVA Wellness mobile app for Android and iOS (together, the "Services"). The mobile app is a wrapper around the same portal, so the information it handles is the same as the portal's, with the additions described under "Mobile App and Push Notifications" below.

Information We Collect

We may collect the following types of information:

• Contact details you provide, such as your name, phone number, email address, and postal address.
• Appointment and health-related information you share with us in connection with the services we provide.
• Billing and payment information related to services rendered.
• Online orders you place, including the items ordered, any note you add, and the order's pickup and payment history.
• Technical information such as your IP address, browser type, and cookies collected when you visit our website or portal.
• If you use the mobile app and allow notifications: a push notification token, together with the device platform (Android or iOS) and app version, so we can deliver notifications to your device.

Mobile App and Push Notifications

The TIVA Wellness app requests only the permissions it needs: internet access, and permission to show notifications. It does not access your location, contacts, camera, microphone, photos, or files.

If you allow notifications, the app registers a push token with Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS) and stores that token against your portal account so we can send you appointment reminders, invoice notices, and other updates about your care. The token identifies your device only; it does not contain personal or health information. Notification content is limited to what is needed to inform you and does not include detailed clinical notes.

You can turn notifications off at any time in your device settings or in your portal notification preferences. When you sign out, uninstall the app, or turn off notifications, the token is deactivated and is no longer used.

Fingerprint sign-in (optional). If you turn on fingerprint sign-in, the check is done entirely by your phone's own fingerprint or Face ID feature — we never receive, see, or store your fingerprint or face data. The app keeps a random sign-in key in your phone's secure storage, released only after a successful check; we store only a scrambled (hashed) copy of that key against your account, with the date it was last used. You can turn it off at any time on your phone; it is switched off automatically on every phone when your password changes.

The app does not use cookies of its own, but the portal pages shown inside it use the same cookies as the website (see "Cookies" below). We do not use third-party advertising or tracking SDKs in the app.

How We Use Your Information

We use the information we collect to:

• Provide, schedule, and manage the clinical and wellness services you request.
• Communicate with you about appointments, invoices, and your care.
• Process your online orders and tell you, by email and WhatsApp, when an order is received, ready for pickup, or cancelled.
• Maintain accurate records as required by applicable law and professional standards.
• Improve our website, portal, and services.
• Comply with legal and regulatory obligations.
• Send you health tips and offers by email or WhatsApp — only if you have ticked the box agreeing to this. Marketing is always optional and never a condition of receiving care.

Your Consent

We process your personal data on the basis of the consent you give us (for example, by ticking the box on our sign-up or Contact Us form), or where the law otherwise allows it — such as to provide care you have asked for, to keep records the law requires, or in a medical emergency. This is in line with India's Digital Personal Data Protection Act, 2023.

You can withdraw your consent at any time, and withdrawing is as easy as giving it: use the unsubscribe link in any marketing message, change your notification preferences in the portal, use “Cookie Settings” in our website footer, or write to our Grievance Officer (below). Withdrawing consent does not affect anything we did before you withdrew it, and we may still keep records the law requires us to keep.

How We Protect Your Information

We take reasonable administrative, technical, and physical safeguards to protect your personal and health information from unauthorized access, use, or disclosure. Access to patient records within our portal is restricted to authorized staff on a need-to-know basis.

Sharing of Information

We do not sell your personal information. We share it only with service providers who process it on our behalf, or when required by law, regulation, or legal process. Our service providers are:

• GoDaddy — web hosting for our website and portal.
• Google — email delivery, encrypted backups (Google Drive), the anti-spam check on our forms (reCAPTCHA), Firebase Cloud Messaging for Android notifications, and Google Analytics (only if you accept analytics cookies).
• Meta (WhatsApp Business) — appointment, invoice and order messages, and marketing messages if you have agreed to them.
• Apple — Apple Push Notification service for iOS notifications.
• OpenAI — advertising measurement on our website (only if you accept advertising cookies).

Some of these providers may store data outside India. They process it only on our instructions and under their own privacy terms.

Data Retention

We keep personal data only for as long as the purpose needs it, or as long as the law requires:

• Clinical and treatment records: at least 3 years after your last visit, or longer where the law or professional standards require.
• Billing and payment records: 8 years, as required by Indian tax law.
• Enquiries from the Contact Us form that do not lead to treatment: up to 2 years after our last contact.
• Push notification tokens: only while active; removed when they become invalid, or when you disable notifications or delete your account.

When a retention period ends, we delete the data or make it anonymous.

Cookies

Essential cookies keep you signed in, keep your shopping cart and protect our forms. The site cannot work without them, so they are always on.

Analytics and advertising cookies (Google Analytics and OpenAI Ads) help us understand how the site is used and measure our adverts. They are off unless you press Accept on the cookie banner. You can change your choice at any time using “Cookie Settings” in the website footer; if you withdraw, we stop loading them and remove their cookies. You can also block cookies in your browser settings, though this may affect some site functionality.

Your Rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• get a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• have inaccurate or incomplete data corrected, and out-of-date data updated;
• have your data deleted when it is no longer needed, subject to records the law requires us to keep;
• withdraw your consent at any time (see “Your Consent” above);
• nominate another person to exercise these rights for you if you die or become unable to do so;
• have your complaints handled by our Grievance Officer, and, if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, write to our Grievance Officer (below). We will confirm your identity first.

Account and Data Deletion

You can ask us to delete your portal / mobile app account and the personal data associated with it by emailing info@tiva-wellness.com from the email address on your account, or by asking at the clinic. We will confirm your identity, then remove your login, contact details, and push notification tokens within 30 days. Clinical, billing, and appointment records may be retained for the period required by applicable law and professional standards, and are kept only for that purpose.

Children

Online sign-up is for adults aged 18 and over. Anyone under 18 is registered at the clinic, with the consent of a parent or legal guardian, and their records are managed through that parent or guardian. We do not track children's behaviour or send them targeted advertising.

Data Breaches

If a security incident affects your personal data, we will tell you and the Data Protection Board of India without delay, as the law requires, along with what happened, what it may mean for you, and what we are doing about it.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

Grievance Officer and Contact

For any question, request or complaint about your personal data, contact:
Grievance Officer, TIVA Innovations LLP
Email: info@tiva-wellness.com
Phone: +91 87002 34540
C-3266, Ground Floor, Greenfield Colony, Faridabad, Haryana

We will acknowledge your request within 7 days and resolve it within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.