Privacy Policy

The short version

• Vivrox is a fitness app for adults (18+). We collect what you give us (your profile, workouts, yoga, food, habits, weight) and what the app needs to work (account, device and usage data).
• We use your data to run Vivrox for you: your plans, targets, streaks, reminders, friends and challenges. We never sell your data and we never use it for ads. Vivrox has no advertising.
• Health and fitness data needs your explicit consent, which you give at sign-up. Our separate Consumer Health Data Privacy Policy explains it in full, including Health Connect.
• Our servers are in the United States. A few service providers, listed below, help us run the app under contracts that limit what they can do with your data.
• You can export your data (Settings > Your data > Export my data) and delete your account (Settings > Delete account) at any time, or email support@vivrox.com.
• The app sends basic usage events (never health data) to help us improve it. Read App analytics.

1. Who we are #

Vivrox is provided by Vivek Yadav, an individual developer based in Lucknow, Uttar Pradesh, India ("Vivrox", "we", "us"). We are the controller (in India, the "data fiduciary") of the personal data described in this policy.

• Privacy questions and requests: support@vivrox.com
• India Grievance Officer: see section 13

Where Vivrox is available. The Vivrox app is not currently offered in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the United Kingdom or Switzerland. When it is, we will name our EU and UK representatives here.

This policy covers the Vivrox app (Android today; an iPhone app is planned), the website vivrox.com, and emails and support. It does not cover other companies' apps or sites that you connect to or that link to us, such as Google Play or Health Connect, which have their own policies.

2. What we collect #

Information you give us #

Information from your phone and connected services #

Information collected automatically #

• App usage events (screens opened, features used, linked to a random user ID), through our app analytics provider (EU). See section 4.
• Crash and error reports through our crash reporting provider (EU): what went wrong, app and device details, and the screen involved. IP addresses are not stored and request bodies are scrubbed.
• Server logs: requests to our servers, with your user ID (not your email). Health data fields, passwords, codes and tokens are removed from logs.
• Feed activity: which posts were on your screen (the first time only) and when you add a habit, recipe, meal or plan from someone's post. We use it to order the Global feed ("For you") and to avoid showing you the same posts again. It is never shown to anyone, including the person who posted.
• Security log: sign-ins and important account changes, with the IP address and device, to protect your account and investigate misuse.
• Website: if you accept analytics cookies, Google Analytics measures visits. See our Cookie Policy.

Information from others #

• Friends may invite you, send you a friend request, or invite you to a challenge.
• Other people may report your posts.
• Google Play and our subscription management provider tell us about your subscription status.

We do not buy data about you from data brokers.

3. How we use your information #

We do not use your data for advertising, we do not sell it, and we do not build profiles to show you ads anywhere.

Automatic decisions. Vivrox calculates suggestions such as calorie targets and plans from your profile. You can change them at any time and they have no legal or similarly significant effect on you. The Global feed's "For you" order is worked out automatically from likes, saves, which posts you've seen, your goals, country and training level; tap the order chip to switch to Latest (newest first) at any time. Posts are checked automatically for a short list of banned content, and photos may be screened automatically before others see them. A person reviews reports and any removal you appeal.

AI. Vivrox does not offer AI features today and does not use your data to train AI models. If that changes, we will update this policy and ask for consent where the law requires.

4. App analytics #

To learn which features are used and where people get stuck, the app sends our app analytics provider (hosted in the EU) usage events, such as "workout saved", and the names of the screens you open.

• Events are linked only to a random user ID. We do not send your email, name or other contact details.
• Events never contain health data, health values or text you type.
• We do not record your screen.
• The analytics provider processes this data only for us, under a data processing agreement. It is never used for ads.

5. Who we share it with #

We never sell your personal data and we never share it with advertisers or data brokers.

Other Vivrox users #

• Your public profile: your name, @username, photo, bio, avatar frame, and founding member number if you choose to show the Founder frame. People can find you by @username unless you turn that off in Edit profile.
• Posts go only to the audience you pick for each one: Friends or Everyone. Nothing is posted automatically.
• Challenges: people in a challenge you join see your progress and result in that challenge. They never see the rest of your activity.
• Invite links you share show your name and photo to the person who opens them.

Your workouts, meals, weight, habits and Health Connect data are never visible to other users unless you post them yourself.

Service providers (processors) #

These companies process data only on our instructions, under contracts that require them to protect it.

Email support@vivrox.com if you would like the names of our current providers.

Open Food Facts. When you scan a barcode, the barcode number is sent from your phone to Open Food Facts, a free public food database, to look up the product. It receives the barcode and your phone's IP address like any website would, but no account or health data.

Other cases #

• Health Connect and Apple Health receive the data you choose to write to them, on your phone.
• Law and safety: we disclose data when the law requires it, to answer a valid legal request, or to protect someone's safety. We report child sexual abuse material to the authorities as the law requires.
• Business changes: if Vivrox is merged, acquired or sells its assets, your data may move to the new owner under this policy, and we will tell you first.
• With your direction: for example, when you share a workout card to another app.

6. International transfers #

Our main servers are in the United States, and some providers are in the European Union. If you live elsewhere, your data is transferred to these countries, whose laws may differ from yours.

For data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum), or on the EU-US Data Privacy Framework and its UK Extension where the provider is certified. Email us for a copy of the safeguards.

7. How long we keep it #

8. Your choices and rights #

Everyone can do these in the app:

You can also email support@vivrox.com from the email address on your account. To protect you, we verify requests, usually by sending a code to that address. You can ask someone to act for you (an authorized agent); we will ask for proof of their authority and may ask you to confirm. We will not treat you differently for using your rights.

Depending on where you live, you may also have the rights described in the regional sections below. If we refuse a request, we will say why and how to appeal.

9. Security #

• Data travels over encrypted connections (HTTPS) and is encrypted at rest by our hosting provider.
• The offline copy on your phone is encrypted, and its key is kept in the phone's secure storage. It is erased when you log out or delete your account.
• Only our servers can reach the database, with the least access they need. Every request is checked so that nobody can read another person's data.
• Photos are re-encoded when uploaded, which removes hidden data such as GPS location.
• Our staff use two-step sign-in. They do not see your health data by default; any access to private data needs a reason and is recorded.
• If a breach puts your data at risk, we will tell you and the authorities as the law requires.

No system is perfectly secure, so please use a strong password and keep your email account safe.

10. Children #

Vivrox is only for people 18 and over. The app checks your date of birth and does not let anyone younger create a profile. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email support@vivrox.com and we will delete it.

11. European Economic Area, United Kingdom and Switzerland #

The Vivrox app is not currently offered in these countries (see section 1). This section applies to anyone there who uses our website or contacts us, and will apply in full when the app launches there. The controller is Vivek Yadav; contact details are in section 1. The legal bases are in section 3. Health data is processed on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time without affecting earlier processing.

You have the right to:

• access your data and get a copy (Art. 15)
• correct it (Art. 16)
• delete it (Art. 17)
• restrict how we use it (Art. 18)
• receive it in a portable format (Art. 20)
• object to processing based on legitimate interests, including analytics (Art. 21)
• withdraw consent at any time (Art. 7(3))
• not be subject to decisions based solely on automated processing that significantly affect you (Art. 22)

We answer within one month (extendable by two months for complex requests, and we will tell you). You can complain to us first at support@vivrox.com, and you have the right to complain to your local data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

Giving us your profile and health data is needed to use Vivrox (it is a contractual requirement): without it we can't build your plans or targets.

12. United States #

Notice at collection #

At or before collection, this is what we collect and why:

Sources: you, your phone and Health Connect, Google Play and our subscription management provider, other users (invitations, reports).

Sale and sharing: we do not sell personal information and we do not "share" it for cross-context behavioral advertising, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing data of anyone under 16. In the last 12 months we disclosed the categories above for business purposes only to the service providers in section 5.

Sensitive personal information is used only for purposes the California rules allow without a right to limit: providing the service you asked for, security and integrity, and similar permitted purposes. So we do not offer a "Limit the use of my sensitive personal information" link.

Your rights #

Depending on your state (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you may have the right to:

• know what we collect, use and disclose, and access a copy
• correct inaccurate data
• delete your data
• get your data in a portable format
• opt out of sale, targeted advertising and profiling with significant effects (we do none of these)
• give or withdraw consent before we process sensitive data
• not be discriminated against for using these rights

How to ask: use the in-app tools in section 8 or email support@vivrox.com. We verify your identity by a code sent to your account email, respond within 45 days (extendable once by 45 days, with notice), and accept requests from authorized agents with written permission.

Appeals: if we decline your request, reply to our answer with the subject "Appeal". We will respond within the time your state's law sets (45 or 60 days). If we deny the appeal, you can contact your state Attorney General.

Global Privacy Control: our website treats a GPC signal as an opt-out of sale and sharing and of analytics cookies. We do not sell or share data in any case.

Consumer health data: Washington, Nevada and Connecticut residents, and anyone else, see our Consumer Health Data Privacy Policy.

Nevada: we do not sell covered information as defined by Nevada law.

13. India #

This section is our notice under the Digital Personal Data Protection Act, 2023 and its Rules.

• What we process and why: the itemised list of personal data is in section 2, and the purpose of each is in section 3. We process your data to provide the Vivrox app and the services described there.
• Consent: you give consent at sign-up, including a separate consent for health data. You can withdraw it as easily: Settings > Your data > Health data. Because Vivrox can't work without this data, withdrawing deletes your account.
• Your rights: access a summary of your data and who received it, correct, complete or update it, erase it, nominate someone to exercise your rights if you die or become unable to, and have your grievances addressed.
• Grievance Officer: Vivek Yadav, Lucknow, Uttar Pradesh, India, email support@vivrox.com. We acknowledge complaints within 24 hours and resolve them within 15 days, and never later than 90 days for data protection grievances.
• Data Protection Board: if you are not satisfied with our answer, you can complain to the Data Protection Board of India.
• Breaches: if a breach affects you, we will tell you what happened, the likely impact, what we are doing and what you can do, and inform the Board as the Rules require.

Your data is stored outside India (see section 6).

14. Other regions #

• Canada: our privacy contact is support@vivrox.com. Your data is stored in the United States and the EU and may be accessible to authorities there. You can complain to the Office of the Privacy Commissioner of Canada. In Quebec, the person in charge of personal information protection is Vivek Yadav, founder.
• Australia: we handle your data in line with the Australian Privacy Principles. Your data is held in the United States and the EU. Complain to us first; if unresolved, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
• Everywhere else: you can use every in-app tool and email request described in this policy, wherever you live.

15. Changes to this policy #

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect, and ask for your consent again when the law requires (for example, if we collect new health data or use a new kind of recipient).

16. Contact #

Vivek Yadav Lucknow, Uttar Pradesh, India Email: support@vivrox.com

Related: Consumer Health Data Privacy Policy · Cookie Policy · Terms of Service · Delete your account · Community Guidelines