PRIVACY POLICY

Our Policy

We, GOQii (collectively used to refer to GOQii Inc., GOQii Technologies Pvt. Ltd. and its affiliates, successors and assigns) bring to you a digital health and fitness subscription service that combines one-on-one mobile personal coaching and fitness tracking technology to help you shift to a healthier lifestyle and reach your goals. While fitness trackers and apps are useful tools, they are missing the elements of on-going engagement, motivation and accountability. GOQii solves this by connecting your activity tracker or smart watch to a professional health and fitness coach of your choice via the “GOQii App” (available on iOS and Android) and a wearable GOQii fitness band ("GOQii Tracker"). You can read more about GOQii and our product at website goqii.com (together with the GOQii App is hereby referred to as the "Platform"). For ease of reading and clarity, the Platform, the GOQii App and the GOQii Tracker are collectively referred to as the "Services". Your use of the Platform and Services are governed by the Terms of Use and other policies of GOQii.

We know that the privacy of your personal data is very important to you. This Privacy Policy sets forth GOQii’s policy with respect to information including personally identifiable data ("Personal Data") and other information that is collected from Platform visitors and users.

Notice under the Digital Personal Data Protection Act, 2023 (DPDP Act)

GOQii Technologies Pvt. Ltd. processes your personal data for the following purposes:

1. Providing personalised health coaching, fitness tracking, and wellness services;
2. Operating and improving our platform;
3. Communicating with you about your account and services;
4. Complying with legal obligations.

The categories of personal data we collect are described in the 'Information We Collect' section below. You have the right to access, correct, erase, and port your personal data; to withdraw consent; to nominate another individual to exercise your rights; and to raise grievances as described in this policy. To exercise any of these rights, please contact our Grievance Officer whose details are provided at the end of this policy.

GOQii is accessible to users aged 13 and above. Users under 18 (or under 13 in the USA) are subject to additional protections and parental consent requirements described in the Children's and Minor Users Data section.

Information We Collect

We collect Personal Data from you when you voluntarily provide such information, such as when you register for access to GOQii Services, use the GOQii Tracker, post information or comments, respond to surveys, or allow us to access your location information. The kinds of Personal Data we collect include: full name, email address, account credentials (hashed password), gender, profile picture, contact details, address, date of birth, height, weight, diet and digestive information, fitness and exercise details, medical history and conditions, and medication details.

By voluntarily providing us with Personal Data, you are consenting to our use of it in accordance with this Privacy Policy. If you provide Personal Data to us, you acknowledge and agree that such Personal Data may be transferred from your current location to the offices and servers of GOQii and the authorised third parties referred to herein, located worldwide, subject to the safeguards described in the 'International Transfer' section.

Lawful Basis for Processing

We process your personal data on the following bases:

1. Consent — for health data, sensitive personal data, and optional features such as AI skin analysis, location tracking, Apple HealthKit / Google Fit integration, and data sharing with insurance or wellness partners. For users under 18, consent must be provided by a parent or guardian.
2. Contractual necessity — for account registration, service delivery, and coaching.
3. Legitimate interests — for fraud prevention, service security, and aggregate analytics.
4. Legal obligation — for compliance with applicable law.

For health and sensitive personal data (fitness metrics, medical history, biometric data, HealthKit data, Health Connect data), we rely exclusively on your explicit consent.

Your Choices

You can use the Platform without providing any Personal Data. If you choose not to provide any Personal Data, you may not be able to use certain GOQii Services.

Apple Health (HealthKit) and Google Fit / Google Health Connect Data

GOQii integrates with Apple Health (HealthKit) on iOS and Google Fit / Google Health Connect on Android. If you choose to connect these platforms, the following applies:

Data types accessed

With your permission, GOQii may read and/or write the following health data types from Apple Health or Google Health Connect:

1. Steps, distance, and active energy burned
2. Heart rate, resting heart rate, and heart rate variability
3. Sleep analysis and sleep duration
4. Body weight, height, and BMI
5. Blood glucose and blood pressure (where entered by the user)
6. Workout and activity sessions

We request only the minimum data types necessary to provide your coaching and wellness service. You can see the exact permissions requested at the time of connection.

How we use this data

1. To provide personalised health coaching, activity tracking, and wellness insights within the Services.
2. To correlate wearable data with your coaching goals.
3. To display your health trends and progress within the GOQii app.
4. For users under 18, health platform integrations require explicit parental or guardian consent in addition to the user's own consent, and data is used solely for service delivery — never for any commercial purpose.

We do NOT use Apple HealthKit data or Google Health Connect data for advertising purposes. We do NOT sell this data to third parties. We do NOT share this data with third parties for advertising or marketing purposes.

Apple HealthKit — specific restrictions (required by Apple App Store §5.1.3)

1. Data read from Apple HealthKit will not be used for advertising, sold to data brokers, or shared with third parties for any advertising or marketing purpose.
2. HealthKit data will not be used for any purpose not described in this Privacy Policy.
3. HealthKit data will only be shared with third parties when necessary to provide or improve health or fitness features, with your explicit consent, or as required by law.
4. GOQii complies with all Apple HealthKit developer guidelines and the Apple Developer Program License Agreement.

Google Health Connect — specific disclosures (required by Google Health Connect Permission Policy)

1. GOQii's use of Google Health Connect data is limited to providing and improving the health and fitness features within the Services.
2. Health Connect data is not used for advertising, profiling, or any purpose unrelated to health and fitness services.
3. GOQii complies with the Google Health Connect Permission Policy (https://developer.android.com/health-and-fitness/guides/health-connect/develop/permissions-and-data-types).

How to connect or disconnect

1. Apple Health: iPhone Settings > Health > Data Access & Devices > GOQii
2. Google Fit / Health Connect: Android Settings > Health Connect > App permissions > GOQii
3. GOQii App: Settings > Privacy > Connected Platforms > Disconnect

Disconnecting a health platform stops future data sync. Data already imported will be retained for 3 months after disconnection and then deleted, unless you request earlier deletion via the data erasure process described in 'Your Data Principal Rights'.

Non-Identifiable Data (Cookies)

When you interact with GOQii through the Platform, we receive and store certain non-identifiable information using technologies such as cookies, web beacons, and device identifiers. We use cookies and similar technologies as follows:

1. Strictly necessary cookies: Required for the Platform to function. Cannot be disabled.
2. Analytics cookies: Help us understand how users interact with our Platform (e.g., pages visited, session duration). Optional.
3. Preference cookies: Remember your settings and preferences. Optional.
4. Marketing cookies: Deliver relevant content. We do not use marketing cookies to target you with health-related advertisements without your explicit consent.

You may manage your cookie preferences at any time via the cookie settings link in the footer of our website or under Settings > Privacy in the GOQii app. We endeavour to honour Do Not Track (DNT) browser signals for optional tracking technologies.

Location Information

Our Service may collect and use your location information (for example, by requesting your location in your profile or by using the GPS on your mobile device or the GOQii Band) to provide certain functionality of our Service. We may use your location information in conjunction with your Personal Data or in an aggregate way as described in the 'Aggregated Personal Data' section above.

Data Retention and Deletion

GOQii retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

After the applicable retention period, data is securely deleted using NIST 800-88 compliant methods. You may request early deletion of your data as described in the 'Your Data Principal Rights' section below.

Use of TrueDepth API for AI Skin Analysis

Our Skin Wellness Assessment (Skinalyze) feature uses your device's TrueDepth camera API. We handle this data with the following principles:

1. On-Device Processing: All TrueDepth camera data is processed in real time on your device only. Raw TrueDepth scan data is NEVER transmitted to or stored on GOQii's servers.
2. AI Analysis Results: AI-generated skin analysis results (e.g., numeric scores, identified conditions) are NOT stored by default.
3. User-Saved Results: If you explicitly choose to save your results by tapping 'Save Results', only the analysis output (not the underlying facial scan) is stored securely in your profile. Saved results are retained for 6 months or until you delete them, whichever is earlier. Delete via Settings > Health Data > Skin Analysis.
4. No Advertising Use: TrueDepth data is never used for facial recognition, user identification, advertising, or marketing.
5. No Third-Party Sharing: TrueDepth data is never shared with any third parties, even in anonymised or aggregated form.
6. No Model Training: TrueDepth data is never used to train AI models or for analytics beyond real-time on-device analysis.

GOQii complies with all Apple TrueDepth API privacy requirements.

The AI skin analysis (Skinalyze) feature using the TrueDepth camera is available only to users aged 18 and above. This feature is automatically disabled for accounts where the registered age is under 18.

Our Use of Your Personal Data and Other Information

GOQii uses the Personal Data you provide in a manner consistent with this Privacy Policy. If you provide Personal Data for a certain reason, we may use the Personal Data in connection with the reason for which it was provided. GOQii and its Related Companies may use your Personal Data to help us improve the content and functionality of the Platform, better understand our users, and improve GOQii Services.

Email communications we send you will contain instructions permitting you to opt out of receiving future communications. SMS/IVR communications can be opted out by writing to support@goqii.com.

GOQii limits the collection, use, and disclosure of health information and Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose of each specific use or disclosure. We do not use your health data for targeted advertising without your explicit, separate consent.

Additional restrictions for users under 18: GOQii does not use the personal data or health data of users under 18 for:

1. targeted or behavioural advertising;
2. sale or sharing with data brokers or advertising networks;
3. profiling for commercial purposes;
4. any purpose beyond direct delivery of coaching and wellness services.

HealthKit and Health Connect data of users under 18 is never shared with third parties without explicit parental/guardian consent.

Our Disclosure of Your Personal Data and Other Information

GOQii is not in the business of selling your information. There are, however, certain circumstances in which we may share your Personal Data with certain third parties:

Business Transfers

As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganisation, dissolution or similar event, Personal Data may be part of the transferred assets.

Related Companies

We may share your Personal Data with our Related Companies for purposes consistent with this Privacy Policy.

Data Processors and Sub-processors

We share your Personal Data with the following categories of third-party service providers who process data on our behalf under written Data Processing Agreements:

1. Cloud infrastructure: Amazon Web Services (AWS) — hosting and storage under a HIPAA Business Associate Addendum.
2. Health platform integrations: Apple (HealthKit) and Google (Health Connect) — subject to platform-specific restrictions described above.
3. Diagnostics and health partners: e.g. Thyrocare Technologies Ltd., Max Hospitals — only with your prior explicit consent.
4. Insurance partners: Only when you have specifically authorised this before purchasing a product.
5. Analytics and product improvement: Using aggregated or pseudonymised data only.
6. Customer support tools.

All processors are contractually required to protect your data, process it only on our instructions, and comply with applicable data protection laws including the DPDP Act 2023. We will notify you of material changes to our processor list.

Legal Requirements

GOQii may disclose your Personal Data if required to do so by law or in the good faith belief that such action is necessary to

1. comply with a legal obligation,
2. protect and defend the rights or property of GOQii,
3. act in urgent circumstances to protect personal safety,
4. protect against legal liability.

We do not share the personal data of users under 18 with insurance partners, analytics companies, or wellness partners for commercial purposes without fresh, explicit parental/guardian consent for each specific third party.

Children's Data

1. India DPDP Sec. 9 — users 13–17 need verifiable parental consent, no tracking/profiling;
2. USA COPPA — under-13 not permitted, 5-day deletion response;
3. EU GDPR Art. 8 — country-specific age gates (13–16);
4. Universal under-18 protections for all users regardless of location (no ads, no profiling, no commercial sharing, data minimisation, TrueDepth/Skinalyze disabled for under-18).

Parental and Guardian Rights

'Parental and Guardian Rights' listing: review data, request correction/deletion, withdraw consent (including health platform integrations), object to commercial use, request portable copy. Response SLA: 15 days (faster than standard 30 days). Contact: privacy@goqii.com with subject 'Minor Account Request'.

Exclusions

This Privacy Policy does not apply to any Personal Data collected by GOQii other than Personal Data collected through the Services. General product feedback, feature suggestions, and non-personal unsolicited information you share with GOQii may be used by GOQii without obligation of confidentiality or compensation. However, any personal data, health data, or sensitive personal data you include in such communications remains subject to this Privacy Policy and applicable data protection law, and will not be treated as freely usable non-confidential information.

Links To Other Web Sites

This Privacy Policy applies only to the Platform and to the services provided. Our Platform may contain links to other web sites not operated or controlled by GOQii (Third Party Sites). The policies and procedures we describe here do not apply to those Third Party Sites. We suggest contacting those sites directly for information on their privacy policies.

Social Media

GOQii may allow you to access certain Social Media Services (such as Facebook and Twitter) through the Platform. When you add Social Media Service accounts to GOQii Services or log in using your Social Media Services account, we will collect relevant information necessary to enable the Platform to access that Social Media Service. The manner in which Social Media Services use, store and disclose your information is governed by the policies of those Social Media Services.

Advertising

GOQii may display third-party advertisements on the Platform and via the Services. GOQii will not share your health data, medical history, biometric data, HealthKit data, Health Connect data, or sensitive personal data with advertisers for targeting purposes. Any interest-based advertising using your non-sensitive activity data will be disclosed in this Privacy Policy and subject to your consent preferences manageable via Settings > Privacy > Advertising. For users under 18: no advertising of any kind — interest-based or contextual — will be served. Accounts identified as belonging to users under 18 have all advertising disabled by default and this cannot be changed.

Security

GOQii takes reasonable steps to protect the Personal Data provided via the Platform and the Services from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. We have adopted reasonable security practices and procedures as further described in our information security policy. While we implement robust security measures, no system is completely immune to security incidents. In the event of a personal data breach affecting your rights and freedoms, we will notify you and, where required, relevant regulatory authorities in accordance with applicable law. Our liability for data breaches resulting from our failure to maintain reasonable security measures will not be excluded or limited to the extent prohibited by applicable law.

Data Breach Notification

1. user notification within 72 hours;
2. DPBI notification under DPDP Sec. 17;
3. CERT-In notification within 6 hours per CERT-In Directions 2022;
4. HHS notification for HIPAA breaches. Contact: security@goqii.com.

Your Data Principal Rights

Under applicable data protection laws including the DPDP Act 2023 and GDPR, you have the following rights:

1. Right to Access: Request a copy of the personal data we hold about you. We will respond within 30 days.
2. Right to Correction: Request correction of inaccurate or incomplete personal data within 30 days.
3. Right to Erasure: Request deletion of your personal data. Where processing is based on consent, we will delete within 30 days of consent withdrawal, subject to legal retention obligations.
4. Right to Withdraw Consent: Withdraw consent for any processing based on consent at any time, including HealthKit and Health Connect data access. Withdrawal does not affect lawfulness of prior processing.
5. Right to Data Portability: Request your personal data in a machine-readable format (JSON or CSV) within 30 days. Use Settings > Privacy > Download My Data.
6. Right to Grievance Redressal: If dissatisfied, you may raise a grievance with our Grievance Officer and escalate to the Data Protection Board of India.
7. Right to Nominate (DPDP Sec. 13): You may nominate another individual to exercise your data rights in the event of your death or incapacity. Submit nominee details to grievance@goqii.com.

To exercise any right, contact us via in-app Settings > Privacy, or email privacy@goqii.com. We will respond within 30 days. If we deny a request, we will provide written reasons and inform you of your right to escalate to the Data Protection Board of India.

International Transfer

Your personal data may be transferred to and processed in the following countries: India (GOQii Technologies Pvt. Ltd. headquarters) and the United States (Amazon Web Services infrastructure, GOQii Inc.). For transfers of personal data outside India, we rely on the following safeguards:

1. Standard Contractual Clauses (SCCs) for GDPR-covered transfers;
2. The AWS Business Associate Addendum and Data Processing Addendum for health data;
3. Contractual protections consistent with DPDP Act 2023 requirements.

We do not transfer your personal data to countries restricted by the Government of India under the DPDP Act. By using our Services, you consent to these transfers under the safeguards described above.

Other Terms and Conditions

Your access to and use of this Platform is subject to the Terms of Service at goqii.com/terms

Changes to GOQii's Privacy Policy

GOQii reserves the right to update or modify this Privacy Policy at any time. For material changes, we will notify you via email or in-app notification at least 30 days before the changes take effect. Your continued use of the Platform after that notice period constitutes acceptance of the revised Privacy Policy. The current version number and last updated date are stated at the top of this policy.

HIPAA Notice of Privacy Practices

If you are a user in the United States and your health information constitutes Protected Health Information (PHI) under HIPAA, you have additional rights including: the right to request restrictions on uses and disclosures of your PHI; request confidential communications; receive an accounting of disclosures of your PHI; and file a complaint with the U.S. Department of Health and Human Services (HHS). A full HIPAA Notice of Privacy Practices is available by contacting privacy@goqii.com or by writing to our Grievance Officer at the address provided at the end of this policy.

Grievance Officer

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines) Rules, 2011, and the Digital Personal Data Protection Act, 2023, GOQii has designated a Grievance Officer for data privacy matters:

1. Name: Pravin Shelki (or such other person as may be designated by GOQii from time to time)
2. Designation: Data Protection Officer & Privacy Officer
3. Organisation: GOQii Technologies Private Limited
4. Address:
   101, Satyam Towers, Sanghavi Corporate Park,
   Off BKSD Marg, Deonar, Govandi East,
   Mumbai 400 088, Maharashtra, India
5. Email: grievance@goqii.com
6. Phone: +91 84199 40404 (Mon to Sat 10 AM to 7 PM)

You may also raise concerns via the in-app Help & Support section. We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days. If unresolved to your satisfaction, you may escalate to the Data Protection Board of India or seek other remedies under applicable law.

Contacting Us

Please feel free to contact us if you have any questions about GOQii's Privacy Policy or our information practices.

1. General privacy queries: privacy@goqii.com
2. Data Protection Officer (GDPR): dpo@goqii.com
3. Grievance (DPDP / IT Rules): grievance@goqii.com
4. Security incidents: security@goqii.com
5. In-app: Settings > Privacy > Contact Us