Privacy & Data Protection Policy

1. Introduction

1.1 Purpose of the Policy

At VeloriX PainRelief Solutions Private Limited, we value your privacy. This Privacy & Data Protection Policy explains how we collect, use, store, and protect your personal information when you use our app, website, or any of our services. Our goal is to be transparent about what data we collect and how we use it to serve you better.

1.2 Scope of the Policy

This policy applies to all users, customers, patients, physiotherapists, physiotherapist partners, and other individuals who interact with VeloriX digital platforms, including our mobile applications, website, administrative systems, partner platforms, and related services. It covers the collection, use, storage, disclosure, and protection of information in connection with account registration, physiotherapist onboarding and verification, patient or lead management, exercise and wellness services, professional physiotherapy support, guidance reports, product orders, customer support, communications, marketing, payments, withdrawals, and other services provided or facilitated by VeloriX.

1.3 Consent

By accessing or using our app, website, or services, you agree to the collection and use of your information as described in this policy. If you do not agree with our policies, please do not use our services. You can withdraw your consent at any time by contacting us, although this may limit your access to some services.

This Policy should be read together with our Terms of Service & User Agreement, Health & Guidance Disclaimer Policy, Order & Return Policy, Marketing, Communications & Advertising Policy, Physiotherapist Partner Terms & Conditions, Physiotherapist Professional Conduct & Practice Policy, and any other applicable policy or notice displayed by VeloriX.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly, such as:

• Your name, email address, phone number, location, shipping address, and billing address.

• Login credentials if you register on our app or website.

• Communication data like emails or support messages.

• Information relating to physiotherapist registration and professional onboarding, such as professional name, profile information, qualifications, registration or verification information, professional experience, profile documents, and other information required for verification or partner participation.

• Information relating to patient or lead management, such as assigned lead information, patient profile information, service-related communications, appointment or interaction details, and information necessary to facilitate communication between users and assigned physiotherapist partners.

• Payment, earnings, wallet, withdrawal, and transaction-related information where applicable to physiotherapist partner services or other paid services.

2.2 Non-Personal Information

We may collect certain non-identifiable information to improve our service, such as:

• Device type and browser used

• Language preferences

• App version and usage patterns

2.3 Health and Other Sensitive Information

Depending on the services used by a user, VeloriX may collect or process health-related and other sensitive information voluntarily provided by the user or generated during the provision of health, wellness, exercise, or professional physiotherapy services. Such information may include pain location, symptoms, pain severity, activity level, age range, occupation, relevant health information, exercise-related information, physiotherapy assessment information, guidance-related information, progress information, and other information reasonably necessary to provide or facilitate the applicable service.

2.3.1 Purpose of Health Information Processing

Health-related information may be used to understand a user's requirements, facilitate appropriate exercise or wellness guidance, support professional physiotherapy services where applicable, prepare or maintain guidance or progress records, communicate with an assigned physiotherapist, improve service quality, maintain service records, and perform other purposes disclosed to the user.

2.3.2 Access by Physiotherapist Partners

Where a user is assigned to or receives services from a physiotherapist partner through VeloriX, relevant information may be made available to that physiotherapist through authorized VeloriX systems to the extent reasonably necessary for providing the applicable service. Access may be restricted according to the user's service relationship, role-based permissions, and operational requirements.

2.3.3 User Choice and Accuracy

Users should provide accurate and relevant information when requesting or receiving health-related or physiotherapy services. Users should avoid providing information that is unrelated to the service. Where consent or another lawful basis is required for processing particular information, VeloriX will process such information in accordance with the applicable requirements.

2.4 Information Collected Automatically

We use tools such as cookies, app trackers, and analytics to collect information automatically:

• IP address and geolocation (only general location, not GPS-based)

• Pages viewed, time spent on the app/website, and clicks

• Device ID and crash logs (for improving app performance)

This data helps us improve your experience but is always handled securely and never sold to third parties.

3. Purpose of Data Collection

3.1 To Provide and Improve Our Services

We collect your data primarily to deliver a smooth and personalized experience. This includes:

• Enabling user registration and login

• Recommending relevant pain-relief exercises or products

• Tracking user activity to improve app features and functionality

• Providing customized support based on user behavior and needs

• To facilitate physiotherapy-related services, including physiotherapist onboarding, verification, lead assignment, patient management, professional guidance, guidance reports, service communication, and follow-up activities.

• To provide authorized physiotherapist partners with the information reasonably necessary to serve assigned users or patients.

• To administer physiotherapist partner accounts, earnings, wallet records, withdrawal requests, and related operational activities.

3.2 To Process Orders and Transactions

Your personal and payment-related information is used to:

• Complete orders placed via our app or website

• Manages deliveries, returns, and refunds

• Send order confirmations, invoices, and shipping updates

• Ensure secure payment processing through trusted gateways

3.3 To Process Premium Subscriptions

If you purchase a Premium subscription, we may collect and process information necessary to create, manage, verify, and maintain your subscription. This may include your selected subscription plan, subscription status, transaction details, payment status, subscription start and expiry dates, and related account information.

• Process and confirm Premium subscription payments

• Activate, maintain, and provide access to Premium benefits

• Maintain subscription and transaction records

• Handle subscription-related support, cancellation, refund, and payment queries

Premium subscription payments may be processed through third-party payment gateway providers such as Razorpay. VeloriX does not directly store sensitive card or other payment credentials. Payment-related information is handled according to the applicable payment gateway's security and privacy practices.

3.4 To Communicate with Users

We use your contact information to:

• Respond to your queries and support requests

• Share important service-related updates or changes

• Send reminders related to exercise plans or purchases

We do not spam. You’ll only receive relevant and necessary communication.

3.5 For Marketing, Surveys, and Feedback

With your consent, we may use your data to:

• Send newsletters, offers, and product recommendations

• Conduct user satisfaction surveys

• Request reviews or feedback to improve our services

You can choose to opt out of promotional emails or notifications at any time.

3.5 For Legal and Security Purposes

We may access or disclose your data when necessary to:

• Prevent fraud, misuse, or unauthorized access

• Comply with applicable laws, government requests, or court orders

• Enforce our terms of use or protect our legal rights

4. Use of Collected Information

4.1 Internal Use

We use your information internally to:

• Maintain user accounts and preferences

• Analyze user behavior for app or website improvement

• Develop new features or services based on user needs

• Train our team to better assist you

Your data is only accessible to authorized personnel and stored securely with appropriate encryption and access control.

4.2 Sharing with Trusted Partners and Service Providers

VeloriX may share or provide access to relevant information with authorized service providers, technology providers, payment processors, logistics providers, communication providers, analytics providers, and physiotherapist partners where reasonably necessary to provide, administer, secure, or improve the applicable service. Physiotherapist partners may receive access to information relating to users or patients assigned to them through VeloriX systems, subject to applicable access controls, confidentiality requirements, professional obligations, and the terms applicable to their participation as VeloriX partners.

• Delivery partners for order fulfillment

• Payment gateways to process transactions

• Technical service providers (e.g., analytics tools, cloud storage)

• Marketing or survey tools (only if you've opted in)

We do not sell your personal data. We ensure our partners follow strict confidentiality and data protection guidelines.

4.3 Compliance with Laws

We may disclose your information if required by:

• Local, state, or central authorities under Indian law

• Legal proceedings or lawful investigations

• Regulatory compliance like taxation, e-commerce guidelines, or digital security policies

5. Cookies and Tracking Technologies

5.1 What are Cookies?

Cookies are small text files stored on your device (computer or smartphone) when you visit a website or use an app. These files help us remember your preferences, improve user experience, and analyze how our services are used.

Cookies do not contain personally identifiable information and cannot harm your device.

5.2 How We Use Cookies

We use cookies and similar tracking technologies to:

• Keep you logged in to your account

• Remember items in your cart or Wishlist

• Analyze app/website traffic and performance

• Offer a personalized browsing experience

• Track usage patterns to improve app features

We may also use third-party cookies (e.g., Google Analytics) to understand user interaction.

5.3 Managing Your Cookie Preferences

You can manage, disable, or delete cookies at any time via:

• Browser settings on web platforms

• App permissions in your mobile device

• Cookie consent options shown on our website

Note: Disabling cookies may limit some functionalities of our app or website.

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We may share limited data with trusted third-party partners who help us operate, manage, or improve our services. These include:

• Delivery and logistics providers

• Payment gateway services

• Cloud storage and hosting services

• Analytics and email marketing tools

All partners are contractually bound to protect your data and only use it for the intended purposes.

6.2 Legal Disclosures

We may disclose your information:

• When required by law, legal process, or regulatory authority

• To protect our rights, property, or safety

• To detect and prevent fraud or security issues

Example: Complying with a government order or responding to a court summons.

6.3 Business Transfers

In the event of a business merger, acquisition, or sale, your data may be transferred as part of business assets to the new owner or entity.

We will notify users of such changes if your data usage or protection terms are affected.

6.4 Physiotherapist and Professional Service Access

Where VeloriX facilitates professional physiotherapy services, relevant user or patient information may be shared with or made accessible to the physiotherapist assigned to that user or patient. The information shared will depend on the service being provided and the information reasonably necessary for that service.

Physiotherapist partners are required to maintain confidentiality and use user or patient information only for authorized service-related purposes. Additional obligations applicable to physiotherapist partners are set out in the Physiotherapist Partner Terms & Conditions and Professional Conduct & Practice Policy.

7. Data Security Measures

7.1 Technical Safeguards

We implement strong technical protections to secure your data, including:

• SSL encryption for all data transmission

• Secure cloud infrastructure with firewalls

• Regular vulnerability testing and software updates

7.2 Organizational Controls

Our internal policies ensure that:

• Only authorized personnel have access to user data

• Staff are trained on privacy and data security practices

• Data access is role-based and monitored

7.3 Protection of Payment Information

We do not store your card details directly. All payment transactions are securely handled by PCI-DSS-compliant third-party payment gateways. These gateways use:

• End-to-end encryption

• Tokenization for payment info

• Secure APIs for transactions

We also use OTP and Secure authentication for added safety in online payments.

8. Data Retention Policy

8.1 Retention Periods

We retain your personal and usage data only as long as necessary for:

• The purposes outlined in this policy

• Fulfilling legal, regulatory, and contractual obligations

For example, order history is kept for tax and accounting compliance.

8.2 Criteria for Retention

The length of time we retain data depends on:

• Type of information (e.g., personal details, transaction data)

• Legal requirements (e.g., record-keeping under applicable laws)

• Ongoing service needs (e.g., maintaining your user account)

8.2.1 Health and Physiotherapy Records

Health-related, physiotherapy, guidance, patient, and professional-service records may be retained for as long as reasonably necessary to provide or administer the applicable service, maintain appropriate service records, resolve disputes or complaints, comply with legal or contractual obligations, protect the rights and safety of users and VeloriX, or satisfy other legitimate operational requirements. Retention periods may vary depending on the nature of the information and the circumstances in which it was collected.

8.3 Data Disposal

Once data is no longer needed, we securely delete or anonymize it using:

• Secure digital deletion protocols

• Scheduled backups and database cleanup routines

Physical records, if any, are shredded securely.

9. Your Rights and Choices

9.1 Right to Access and Update

You can access and update your personal information at any time through:

• Your account settings in the app or website

• A written request to our privacy team

9.2 Right to Data Portability

You may request a copy of your personal data in a readable format for transfer to another service, where technically feasible.

9.3 Right to Withdraw Consent

You can withdraw consent for data use (e.g., for marketing) at any time. However, doing so may impact your ability to use some features.

Withdrawing consent will not affect lawful processing done prior to your request.

9.4 Right to Object and Restrict Processing

You have the right to:

• Object to processing for direct marketing

• Request limitations on processing under specific circumstances (e.g., data inaccuracy, legal investigations)

10. Children’s Privacy

10.1 Data Collection from Minors

We do not knowingly collect personal data from children under the age of 18. If we become aware of such data being collected, we will delete it promptly.

10.2 Parental Consent

If a child uses our services with parental approval, consent from the parent or legal guardian is required before data collection.

Parents can request deletion of their child’s information by contacting our support team.

11. Grievance Redressal and Contact Information

11.1 How to Reach Us

If you have any concerns, complaints, or questions about your personal data, please contact:

We aim to respond within 7 working days.

11.2 Nodal Officer or Grievance Officer

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer:

12. Policy Updates

12.1 How We Update This Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in legal or regulatory requirements

• Updates in our data handling practices

• Introduction of new features or services

12.2 User Notification of Changes

We will notify users of any significant changes via:

• Email (if registered)

• In-app or website banners

• Updated policy date shown at the top

Your continued use of our services after such updates constitutes acceptance of the revised policy.