Privacy policy

Astitva, a product of Velcro Ventures (OPC) Private Limited
Last updated: 18 October 2026

This policy is for the people who use the Astitva app. It says what the app collects about you, why, where it is kept, who can see it and for how long. It also says what you can ask us to do with it, and how to ask.

The short version

What you log day to day stays on your phone: how each day felt, your dates, what you ate, how you moved and your body details. We never receive it.
Your account, your profile, your payment for Astitva and what you post in Talk are kept on our servers.
Talk shows your first name and the first letter of your last name, like Priya S. Your full name goes only to a practitioner or lab you book.
We do not sell your data. There are no adverts in Astitva, and no advertising or analytics trackers.
You can see, correct and delete your data, and you can delete your account at any time.

Who we are

Astitva is a product of Velcro Ventures (OPC) Private Limited, a company registered in India ("we", "us").

Registered address: Jaipur, Rajasthan, India
Email: support@astitvaapp.com

We decide what Astitva collects and why. That makes us responsible for your personal data under Indian law, including the Digital Personal Data Protection Act 2023 (the DPDP Act), which calls us the data fiduciary.

This policy covers the Astitva app. The practitioners you can book use a separate app, Astitva for Practitioners, which has its own privacy policy.

What stays on your phone

Some of what you tell Astitva never leaves your phone. We do not receive it and cannot see it.

Where you are. Your stage, and the dates you give the app: a transfer, a blood test, a negative result, the due date of a pregnancy you lost. The app uses these to choose what Home shows, to be quieter on hard days, and to time reminders and tests.
How each day felt. Your daily check-ins.
Workout and Diet. The poses you mark as done and the meals you mark as eaten.
Your body details, if you give them. Height, weight, how you eat (for example vegetarian or Jain), allergies, and conditions such as PCOS, endometriosis, thyroid, low ovarian reserve, unexplained infertility or a male factor. The app uses them to build your food plan. All of these are optional.
Your reminder settings.

How this is kept:

The app keeps it encrypted, with a key held in your phone's secure keystore.
It is left out of Android's backups, so it is not copied to your Google account. This also means it does not come with you to a new phone. Your account, your profile and your posts do.
It is kept for your account. Signing out does not erase it, but nobody sees it while you are signed out, and anyone who signs in to Astitva on this phone with another account sees only their own. Sign back in and it is there again.
It is erased when you delete your account in the app, or when you uninstall Astitva or clear its storage.

Reminders are made on your phone too, not sent by us. They never show their words on a locked screen, whatever your phone's own settings are; unlock it to read one. Some mention a date you gave the app, such as a transfer. You can turn each kind off under You.

What we keep on our servers, and why

Your account

Your email address and password. To make your account, let you sign in on any phone, send you a 6-digit code if you forget your password, and reply when you write to us. Your password is stored only in a scrambled, one-way form. Nobody can read it, including us.
Connection records. When you sign up and sign in, and technical details about each connection, such as your internet (IP) address and the time. To keep your account safe and to find faults.

Your profile

Your first name and last name, your date of birth and your gender, which you give when you make your account.

Your name. Talk shows your first name and the first letter of your last name, like Priya S. When you book a session or a test, the booking form starts with your first name and last name, and you can change them there.
Your date of birth. Astitva is for people 18 and over. Your date of birth is never shown to anyone else. A practitioner you book sees your age, worked out from it on the day you book. When you book a test, the lab form starts with your age.
Your gender. A practitioner you book sees it.

Our database lets only your own account read your profile. You can see and change it under You, Your details.

Talk, the circle

Your posts and replies, the topic you choose, and when you posted. To run the circle.
Who can read them: anyone signed in to Astitva, under your first name and initial. The circle is not on the open web, but anyone can make an account, so write only what you would be comfortable with a stranger reading. Other members could copy what you write.
Reports. When you report a post, we record the reason and the time on the post. We do not record who reported it, and the writer is never told.
Moderators, who today are the people who run Astitva, see reported posts and posts that have been taken down.

Before you post, the app checks your words for a few phrases that can mean someone is in danger, or is telling someone else what medicine to take. The check runs on your phone. It shows you the helplines or a short note, it never stops you posting, and its result is not sent to us.

Sessions with a practitioner

The booking: the practitioner, the date and time, the price and how it is split, the time you agreed to the session terms, the name you give for the session (it starts as your first name and last name), your age on the day you book and your gender. Cancellations and missed sessions. If you raise a dispute, its reason and what you write.
Payment references from Razorpay: the order, payment and refund numbers. Not your card, UPI or bank details. Razorpay handles those, and we never see them.
Why: to hold the time, take payment, pay the practitioner, deal with cancellations, refunds and disputes, and keep the records tax law requires.
Who can see it: you; the practitioner, who sees the name you gave, your age, your gender and the time, but not your email address or anything you log in the app; and the people at Astitva who handle payments and disputes.

What you say in a session is between you and the practitioner. Every practitioner agrees with us to keep what you tell them confidential, as the rules of their profession require. Sessions are video calls inside the app, carried by 100ms. Astitva and 100ms never record your calls. The practitioner may keep a private clinical note, as their profession requires. Astitva never sees it.

The call itself:

Your picture and your voice travel through 100ms's servers while the call is on, to reach the practitioner, and are not kept.
Your camera and microphone: the app asks for them the first time you join a call. You can turn your camera off during the call, or refuse it and talk by voice. The call cannot work without the microphone.
Bluetooth earbuds or a headset: if they are connected when you join, your phone may ask whether Astitva can connect to nearby devices. This lets the call play through them, and Astitva uses it for nothing else. If you refuse, the call still works.
What 100ms is told: that someone is joining as the patient, or as the practitioner, and never your name, email address or account. While the call is on it also sees what any call service needs, such as your phone's internet address and the quality of the connection.
When each of you joined and left the call, kept with the booking. If one of you says the other never came, this is how we can check. You, the practitioner and the people at Astitva who handle disputes can see it.

Tests from home

For a test from home, our partner laboratory, named in the app before you book, collects and tests your sample. When you book one:

Your lab details: the name on your ID, your mobile number, age, address and pincode, and the time you agreed to share them. For a panel that tests your partner's sample, his name and age, kept on that order only.
Your orders: the test, the collection date and slot, where the order has got to, the lab's report and the clinician's reading.
Why: so the lab can send someone to collect your sample, test it and send the report, and so that a clinician reads every result.
Who can see it: you; our partner laboratory (named in the app before you book), which receives your lab details and the test with each booking; and the clinician who reads reports for us. Nobody else at Astitva can open your report in Astitva's own tools.

The lab keeps its own records, under the law for laboratories and its own privacy policy. If you book a panel for your partner's sample, please do it with his agreement: his name, age and results will be in your account.

You can change or delete your lab details at any time in Book, Tests. Deleting them does not delete your past orders.

Your payment for Astitva

You pay for lifetime access inside the app. On Android you pay through Google Play, where Google takes the payment. On iPhone you pay through the App Store, where Apple takes it. Each store sees your account with it, what you bought and how you paid, under its own privacy policy. With each purchase the app gives the store a one-way hash of your Astitva account id: a code worked out from the id that cannot be turned back into it, so that the purchase can be matched to your account. With your account we keep the store's reference for the purchase (Google Play's order number, or Apple's transaction number), the day you paid, whether it was a test purchase, and any refund, with the day you asked for it, or the day Apple refunded it. When the app asks us to check a purchase, we also record the time, so that no account can ask more than twenty times an hour. Each time is deleted at a later check, once it is an hour old. We never see your card, UPI or bank details.

If we gave you access without payment, we keep who gave it, when and why. If we take it back, we keep the same. Our staff's log records each time they give access, take it back or mark a refund as made: who did it and when, and why access was given or taken back. When our staff look up an account by its email, to give access or to check it, we record who looked and when, and whether an account was found, but not the email.

If you delete your account, these records are deleted with it, and your access ends without a refund. Our staff's notes on why access was given or taken back are erased; what stays is that it was, and that the account was deleted. A refund you asked for that we have not made yet still goes through: we keep its order number and the day you asked, without your email or your account, until it is made. If you paid through Google Play, the purchase itself stays with your Google account: a new Astitva account on the same Google account can use it again. If you paid through the App Store, it stays with your Apple Account: a new Astitva account on the same Apple Account can use it again, with Restore purchases.

Notifications from our servers

When a booking changes (confirmed, cancelled, marked as missed, under review), our servers keep a short note for you and send it to your phone through Firebase Cloud Messaging, a Google service. A note may show on your locked screen, depending on your phone's own settings. To send these notes, the app gives us a device token: a code that lets us reach Astitva on your phone.

When you write to us

What you send us and our reply. To answer you, and to keep the record of complaints the law requires.

Who else receives your data

Each receives only what it needs, for the reason given.

Practitioners you book. Independent professionals, responsible for the care they give.
Our partner laboratory (named in the app before you book) and the clinician who reads your results. What each of them receives is written under Tests from home.
Razorpay Software Private Limited, which takes payment for sessions. Your card, UPI and bank details go to Razorpay, under its own privacy policy.
Google. Google Play delivers the app, and takes the payment for lifetime access. Firebase Cloud Messaging carries notifications.
Apple. The App Store delivers the iPhone app and takes the payment for lifetime access on iPhone. Apple's push service carries notifications to iPhones.
Supabase, Inc., which runs our database, sign-in and file storage for us, as our data processor. Its servers for Astitva are in Mumbai, India.
100ms Inc, which carries the picture and sound of a session's video call while it is on, as our data processor. Astitva and 100ms never record your calls, and 100ms is never told your name. It keeps its own record of each call, the times each side joined and left, as the service needs. Its servers for Astitva's calls are in India.
Resend, which sends our email, including your sign-in and password codes, from its servers in Tokyo, Japan. It receives your email address and the words of each email.
Courts and government agencies, when the law requires us to, for example under a court order.

We do not sell, rent or trade your personal data, and we do not use it for advertising or marketing. If that ever changes, we will ask you first. If Astitva is ever sold or merged into another company, your data would move only under this policy, and we would tell you first.

Most of what you tell Astitva is about your health. Indian law treats health information, and your password and payment details, as sensitive. We collect it only with your consent, and use it only for the reasons in this policy.

You give consent step by step, when each thing is needed:

When you make your account: to this policy and the terms of use.
Before your first post: to the community guidelines.
When you book a session: on the "Before you book" screen. The time you agreed is recorded.
When you join a session's call: your phone asks you for the camera and the microphone the first time, and for nearby devices when Bluetooth earbuds or a headset are connected.
When you save your lab details. The time you agreed is recorded.

You can withdraw consent at any time, as easily as you gave it:

Delete your lab details in Book, Tests.
Cancel a booking.
Turn your camera off during a call, or take the camera, the microphone or nearby devices away from Astitva in your phone's settings.
Turn reminders off under You, or notifications off in your phone's settings.
Ask us to remove a post.
Delete your account, which withdraws everything.

Withdrawing consent does not undo what was done before it. Some things cannot happen without the data they need: a session needs a booking, and an account needs an email address.

Astitva is for adults

Astitva is for people 18 and over. When you sign up, you give your date of birth before any account is made. If you are under 18, the app stops there and keeps nothing you typed. If you later change your date of birth to one under 18, the app signs you out.

We do not check dates of birth against documents. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you know of one, please write to support@astitvaapp.com.

Your rights

You have the right to:

Know what we hold: a summary of your personal data, what we do with it, and who we have shared it with.
Correct it or bring it up to date. Your first name, last name, date of birth and gender are under You, Your details. Your stage and your treatment dates are under You. Your lab details are in Book, Tests. For anything else, write to us.
Have it erased. Delete your lab details in Book, Tests. Delete your account in the app, in the You tab, or through our account deletion page. There is no button to delete a single post: write to us and we will remove it.
Withdraw your consent, as above.
Nominate someone to use these rights for you if you die or become unable to act for yourself. Write to us with their name and how to reach them.
Complain, to us first, and then, if you are not satisfied, to the Data Protection Board of India.

To ask, write to support@astitvaapp.com from the email address of your account, so we can find it. If you write from another address, we will ask you to show the account is yours before we act. We reply within the times on our grievances and contact page.

The law also asks something of you: give us true information, and do not use anyone else's name or details.

How long we keep things

What is on your phone: until you delete it, delete your account in the app, or remove the app.
Your account and profile: until you delete your account. After that, a locked record of your email address, first name and last name, date of birth and gender, when the account was made and closed, and when you agreed to this policy and the terms, is kept for 180 days, because India's IT Rules 2021 require platforms that host posts to keep it. Then it is erased.
Accounts nobody uses: deleted after 3 years without a sign-in, with an email 48 hours before.
Your posts and replies: until you ask us to remove them or you delete your account. When you delete your account, each one shows "Removed by its author", without your words or your name, and the replies other members wrote under them stay. A post or reply of yours that a moderator took down, or that was hidden after a report, is kept locked with its words for 180 days after you delete your account, in case the law needs it, and then erased. While your account is open, a post a moderator takes down is hidden at once and kept locked, and erased at 180 days.
Bookings and payment records: until 8 years after the end of the financial year of the last payment or refund on them, the longest period company and tax law ask us to keep accounts. If you delete your account, your account, your name, age and gender, and what you wrote in a concern are removed from them at once.
Disputes: 3 years after the decision. If you delete your account, the reason and what was decided stay with the payment records, without what you wrote.
When each side joined and left a call: with the booking, for 3 years after the session, the same as disputes. After an account is deleted, it stays with the booking's payment records. The call's picture and sound are never kept.
Lab details: until you delete them or your account. Lab orders, reports and readings: until you delete your account. After that, each order, with the name and age its sample was taken under, its results and the doctor's reading, is kept locked without your account for 3 years, as medical records, and then erased. An order called off before any sample was taken is erased at once. The lab's PDF of each report is deleted when you delete your account.
Notifications from our servers: 90 days, and deleted when you delete your account.
Device tokens: until you sign out or delete your account.
Your payment for Astitva: until you delete your account, and then deleted with it, except a refund you asked for that we have not made yet, which keeps its order number and the day you asked until it is made.
Emails and complaints you send us: 3 years after the last message.
Sign-in records: each sign-up, sign-in, password reset and account deletion, with the email address and the internet address (IP address) it came from. Kept for 180 days, because India's CERT-In directions ask for logs to be kept that long, and then erased, a deleted account's too.
Technical logs: 1 year.
Backups: Supabase backs up our database, and each backup keeps a copy for 7 days. Deleted data leaves the backups when that period ends.

How we protect it

Everything between the app and our servers is encrypted in transit (HTTPS).
Our database checks every request against your account. You can read only what is yours, or what is meant to be shared, like posts in Talk. Members cannot change or delete each other's data.
Supabase encrypts what is stored on its servers.
Card, UPI and bank details go straight to Razorpay, Google or Apple, never to us.
The people who run Astitva can reach data on our servers through Supabase's own tools. We use that access only to keep Astitva working, to act on a request from you, or when the law requires it.
No system is perfectly safe. A screen lock on your phone protects what Astitva keeps there.
If a breach affects your data, we will tell you, the Data Protection Board of India and CERT-In, as the law requires.

Where your data is kept

Our servers are run by Supabase in Mumbai, India. Razorpay processes payments in India. Video calls run on 100ms's servers in India. Our email is sent by Resend, whose servers are in Tokyo, Japan. Resend receives your email address and the words of each email. Google's services may process data in other countries.

Changes to this policy

When we change this policy, we change the date at the top and tell you in the app before the change takes effect. If a change means using your data in a new way, we ask for your consent first.

Complaints and contact

Our grievance officer: The Grievance Officer, Velcro Ventures (OPC) Private Limited, Jaipur, Rajasthan, India. Email: support@astitvaapp.com, with "Grievance" in the subject.

We acknowledge every complaint within 24 hours and resolve it within 7 days. Some complaints have shorter limits, set out on our grievances and contact page. If you are not satisfied with how we handled a complaint about your personal data, you can complain to the Data Protection Board of India.