Privacy notice

Biolivon Care, at biolivon.com/care, is where you, your coach and your practitioner work from one care plan. It is for adults, and by invitation only: nobody signs up to it. An account is created when Biolivon or a practitioner invites someone into a care team, entering that person’s name and email address. Nothing else is collected until you sign in, and the app cannot be used until you have given the consents it asks for, one purpose at a time.

Your practitioner is a doctor registered in India. Biolivon checks their registration before they can join a care team, and the app shows you their name, qualification, and the body that registered them with their registration number. Your coach supports your plan with training, habits and nutrition, and does not advise on medicines.

Biolivon Care is not a medical device. It does not diagnose, treat, cure or prevent any medical condition. For medical advice, diagnosis or treatment, ask your practitioner or another healthcare professional.

It is not for emergencies. Messages are not monitored around the clock. If you feel very unwell, call 112 or see a doctor straight away.

To provide your care: so you, your coach and your practitioner work from the same plan; so your practitioner can see when something crosses a threshold (for example, weight falling faster than your plan allows, or a side effect at or above a set severity), which is plain arithmetic against the thresholds in your plan, or the app’s defaults where your practitioner set none, and not a diagnosis; so that messages about medicines, symptoms or an emergency reach your practitioner rather than your coach; to look into a concern that someone on your care team reports; and to sign you in securely and keep a record of who did what. Not for marketing or advertising, never sold, and never shared with anyone outside your care team except the service providers listed under Who receives it, and Biolivon’s Grievance Officer and administrators when someone reports a concern (see Reporting a concern).

Routing is automatic. As you send a message, plain written rules check it for words about medicines, doses and injections, symptoms and how you feel, and for emergency wording such as chest pain or thoughts of self-harm. A message the rules recognise goes to your practitioner as a clinical question. Your coach cannot see it or your practitioner’s answer to it, and you are told it has gone to your practitioner.

The rules catch what they recognise, not every possible wording. If a question is for your practitioner, say so in your message. If a message sounds like an emergency, the app also tells you straight away to call 112 or see a doctor.

Messages from your care team are checked too: a message from your coach that reads as advice about medicines is held back rather than sent. A held message is not stored. Only the fact that it was held, and which rule held it, goes into the audit trail.

Anyone on a care team, whether client, coach or practitioner, can report a concern in the app, under Messages → Report a concern. It can be about a message, about a person on the team, or about your care. You can also use it to ask for a different coach or doctor. It is not for emergencies: if you feel very unwell, call 112.

A report goes to the Grievance Officer, and to Biolivon’s administrators, who handle accounts. They see who made it, who it is about, what you wrote, and the one message you chose to share, if any. They see nothing else from the care record. The person you report is not shown your report, and it never appears to your care team in the app, not even in a care record’s activity log.

The Grievance Officer looks into it and can change your coach or doctor. You read the answer in the app, under Account → Your reports, even if your care team has changed since. We also email you that an answer is ready; the email never contains the answer or what you reported.

If someone on your care team reports a concern about you, the Grievance Officer and the administrators see what they write, and the one message of yours they chose to share, if any. That is why your consent to your care team seeing your record mentions it.

A report is part of your care team’s record, and is deleted with it (see How long it is kept). The reports you make, with their answers, are in your download and under Account → Your reports. For a coach or practitioner, a report on a care team they can no longer see stays with that client’s record: they see only its reference, reason and dates.

Hostinger, which hosts this website, also holds the app’s database on the same server and sends the app’s emails from the biolivon.com mailbox. Emails never contain health information. Each one carries a sign-in code, an invitation, the answer to a request about your data, a notice that a concern you reported has an answer, or, only if you turn it on, a notice that you have a new message. A notice never includes the message, the report or the answer. When a concern is reported, the Grievance Officer and the administrators get an email that says only that there is one.

Free text is encrypted in the database with AES-256-GCM: check-in notes, messages, plan priorities, medicines, programme content, coach notes, escalations and how they were resolved, reviews, what a report of a concern says and its answer, and notes on requests about your data. The key is kept in the server’s configuration, outside the database, so a copy of the database on its own cannot be read.

The rest is not encrypted this way, so that the app can draw trends and check thresholds. It is protected by the database’s own access controls only: your name and email address; check-in numbers (weight, waist, energy, appetite, sleep, training and protein); the side effects you choose and how severe they are; biomarker names, values and units; the plan’s markers to watch, thresholds, protein target and review date; programme titles; whether a message went to your practitioner, and which rules sent it; how urgent an escalation is; what kind of concern a report raises, who it is about and whether it has been answered; your consent decisions; staff registration details; dates; and the audit trail.

There are no passwords. You sign in with a code we email you; codes and session tokens are stored only as hashes. A code stops working after five wrong tries, and no more than eight codes are sent to an address in an hour. While you ask for or enter a code, your IP address is used to slow down repeated attempts, in the server’s working memory only. Every connection uses HTTPS, and every action on a record goes into the audit trail.

Pages showing your information always come fresh from the server: the app does not store them on your device, and if you are offline it shows a plain “you’re offline” page instead of anything from an earlier visit.

Biolivon Care sets only the cookies that signing in needs. All of them are limited to biolivon.com/care, and none is used for tracking or advertising:

Consent is asked for one purpose at a time, never as a single accept-all. The exact wording and the version of this notice are recorded with every decision. These are the purposes, in the words you are asked to agree to:

Biolivon Care is for adults only. Nobody can sign up to it: an account exists only when Biolivon or a practitioner invites someone into a care team, and we invite adults only. Before using the app, each client confirms that they are 18 or older, as the first part of their consent to keeping their care record. If we learn that an account belongs to someone under 18, we close it.

India’s Digital Personal Data Protection Act, 2023 gives you further rights once its main provisions take effect, currently expected in May 2027: to a summary of your information and of everyone it has been shared with, to nominate someone to act for you, and, after raising it with us first, to complain to the Data Protection Board of India. We intend to honour those rights now rather than wait.

If you are in the European Union or the United Kingdom, the data-protection law where you live may give you additional rights. Write to the Grievance Officer and we will deal with your request under it.

If a security breach affects your information, we will tell you and report it as the law requires.

Each version is dated above, and the version in force is recorded with every consent. If we change how we use information you have already given us, we will ask you again rather than assume.

For a question, a request or a complaint about your data, write to our Grievance Officer, Sadaf Fatima, at care@biolivon.com, or by post to BioLivon, F-65/2, Shaheen Bagh, Okhla, New Delhi 110025, India. We answer within one month.