Privacy Policy
Effective date: 10 April 2026 · Last updated: 8 November 2026
Applies to the Ease mobile application for iOS and Android and the website at easetracker.app
In short. Ease keeps your cycle and health logs in your own account, stored in India. Other users cannot see them, and our personnel do not access them except in the limited cases set out in Clause 7.3. We do not sell your Personal Data, and we do not use it for advertising. A small number of service providers, some outside India, receive limited data so that the App can work; they are listed in Clause 8. You can withdraw your consent, and you can delete your account at any time from within the App.
Highlighted text in [square brackets] is a placeholder or a point to confirm. It must be completed or removed before publication.
1.WHO WE ARE
1.1This Privacy Policy is issued by Charvaya Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at [Registered Office Address] and corporate identity number [CIN] (the "Company", "we", "us" or "our"). The Company owns and operates the App and the Services.
1.2For the purposes of the DPDP Act, the Company is the Data Fiduciary for the Personal Data described in this Privacy Policy, and you are the Data Principal.
1.3This Privacy Policy forms part of, and is incorporated by reference into, the Ease Terms of Use (the "Terms"). It also serves as the notice we are required to give you under section 5 of the DPDP Act.
2.DEFINITIONS AND INTERPRETATION
2.1In this Privacy Policy, unless the context requires otherwise:
2.1.1"App" means the Ease mobile application for iOS and Android, including any updates to it;
2.1.2"Applicable Law" means all laws, rules, regulations, guidelines and binding directions in force in India from time to time that apply to the Company, the App or the Services, including the DPDP Act and the Information Technology Act, 2000;
2.1.3"Board" means the Data Protection Board of India established under the DPDP Act;
2.1.4"Consent" has the meaning given to it in Clause 6.1;
2.1.5"DPDP Act" means the Digital Personal Data Protection Act, 2023 and the rules made under it, each as amended from time to time;
2.1.6"Data Fiduciary", "Data Principal", "Data Processor", "Personal Data" and "Personal Data Breach" have the meanings given to them in the DPDP Act;
2.1.7"Grievance Officer" means the person designated in Clause 14.1;
2.1.8"Health Data" means Personal Data about your menstrual cycle, symptoms, physical or mental wellbeing, sleep, nutrition, exercise or lifestyle, including the data listed in Clause 4.2.2. The DPDP Act does not create a separate category for health data, but we apply the additional safeguards in Clause 7 to it;
2.1.9"Platform Provider" means Apple Inc. or Google LLC, together with their respective affiliates, as the operator of the app store from which you obtained the App or as the provider of a sign-in or calendar service you choose to use;
2.1.10"Premium Subscription" has the meaning given to it in clause 6.2 of the Terms;
2.1.11"Services" means the App, the website at easetracker.app and all related features, content and support that the Company provides; and
2.1.12"User", "you" or "your" means an individual who creates an account on, or otherwise uses, the Services.
2.2Headings are for convenience only. The words "including" and "in particular" are illustrative and do not limit the words before them. A reference to a Clause is to a clause of this Privacy Policy, and a reference to a "clause of the Terms" is to a clause of the Terms. A reference to a statute includes the rules made under it, as amended or re-enacted.
3.SCOPE
3.1This Privacy Policy applies to Personal Data that the Company processes in connection with the Services. It does not apply to any Platform Provider or other third-party service you reach from the App. Each of those processes your data as an independent Data Fiduciary under its own privacy policy.
3.2The Services are offered in India only. If we make them available in any other territory, we will publish an updated policy for that territory before doing so.
4.PERSONAL DATA WE COLLECT
4.1We collect only the Personal Data you give us, or that is generated when you use the Services, as itemised in Clause 4.2. The App contains no advertising software development kit, no analytics software development kit and no tracking pixel. It does not collect your location, contacts, photos, or microphone or camera input. It does not read from or write to Apple Health or Google Fit.
4.2We process the following categories of Personal Data:
4.2.1Account data: your email address; your name, if you give it; your date of birth, which is mandatory and is used to confirm that you are 18 or over (see Clause 12); and a randomly generated account identifier. If you sign in with Apple or Google, we receive only the identity token the Platform Provider issues. This contains your email address (or Apple's private relay address, if you choose to hide yours) and your name, where provided. We never receive your Apple or Google password.
4.2.2Health Data: bleeding days and flow; symptoms and their severity; typical cycle length, period length and last period start date; energy, mood, stress, sleep and water entries; movement and exercise entries; meals and their nutritional breakdown; free-text notes; and the focus areas and baseline symptoms you select during onboarding.
4.2.3Calendar data (optional): if, and only if, you connect Google Calendar, we have read-only access to your upcoming events. We store the title, date, times, location and notes of each event, together with its Google event identifier. We never write to, change or delete anything in your Google Calendar.
4.2.4Subscription data: your plan, subscription status, start date and expiry date. Payment is processed entirely by the Platform Provider, and we never receive your card or other payment instrument details.
4.2.5Support data: the content of any email or other correspondence you send us, and our replies.
4.3On-device analysis. The App identifies patterns in what you log (for example, whether short nights coincide with heavier symptoms). This analysis runs on your device. The results are shown to you and are not transmitted to us, stored on our servers or used to build a profile of you.
5.PURPOSES OF PROCESSING
5.1We process each category of Personal Data only for the purposes set out below:
Category
Purpose
Basis
Account data
Creating and securing your account; letting you sign in on another device; confirming you are 18 or over; communicating with you about the Services
Consent
Health Data
Showing where you are in your cycle; displaying your history; enabling on-device pattern analysis; tailoring the general guidance you see
Consent
Calendar data
Displaying your events alongside your cycle phases
Separate Consent, given when you connect Google Calendar
Subscription data
Confirming your entitlement to the Premium Subscription
Consent; and performing the Terms
Support data
Responding to your queries, requests and grievances
Consent; and compliance with Applicable Law
5.2We may also process Personal Data without Consent where the DPDP Act permits this for a legitimate use under section 7, including to comply with a law or a lawful order of a court or authority.
5.3We do not use Personal Data to profile you for advertising. We do not make automated decisions that produce legal or similarly significant effects for you, and we do not use your Personal Data to train machine-learning models.
6.CONSENT AND WITHDRAWAL OF CONSENT
6.1How Consent is given. During onboarding, before any Health Data is collected, the App shows you an itemised notice summarising Clauses 4 and 5. You give your consent ("Consent") by a clear affirmative action on that screen. This is separate from your acceptance of the Terms. Consent to the processing of calendar data is requested separately, at the point you choose to connect Google Calendar. [CONFIRM: onboarding flow to be built as a separate, unbundled notice and consent screen.]
6.2Withdrawing Consent. In accordance with section 6(4) of the DPDP Act, you may withdraw your Consent at any time, with ease comparable to that with which you gave it:
6.2.1calendar data: by disconnecting Google Calendar in Settings. This withdraws your Consent to the processing of calendar data, ends our access, and [deletes previously imported events from our servers] [CONFIRM product behaviour]; and
6.2.2all other Personal Data: by selecting [Settings → Privacy → Withdraw consent] in the App [CONFIRM: in-app control to be built], or by writing to the privacy contact in Clause 16. Because the App cannot function without account data and Health Data, withdrawing this Consent will result in the closure of your account and the erasure of your Personal Data in accordance with Clause 10. Deleting your account under clause 5.3 of the Terms also withdraws your Consent.
6.3Withdrawal does not affect the lawfulness of processing carried out before it. After withdrawal, we will stop processing the relevant Personal Data, and cause our Data Processors to stop processing it, within a reasonable time, except to the extent that Applicable Law requires or permits its retention.
7.SAFEGUARDS FOR HEALTH DATA
7.1We do not use Health Data for advertising or marketing, and we do not allow anyone else to do so.
7.2We do not disclose Health Data to any insurer, employer, data broker or advertiser.
7.3Access to Health Data within the Company is restricted to a limited number of authorised personnel who are bound by confidentiality obligations. [CONFIRM: access logging.] We do not access your Health Data except: (a) to resolve a support issue that you have raised and for which you have given permission; (b) where Applicable Law or a lawful order requires it; or (c) to the extent strictly necessary to investigate or remedy a security incident.
7.4Other Users cannot access your Health Data. This restriction is enforced by row-level security within the database itself, not only by application code.
7.5We collect and keep only the Health Data that the App needs in order to provide the Services.
8.STORAGE, SECURITY, DATA PROCESSORS AND TRANSFERS OUTSIDE INDIA
8.1Storage. Your account data, Health Data, calendar data and subscription data are stored in a managed PostgreSQL database operated for us by Supabase, hosted in Mumbai, India (AWS ap-south-1). A copy of your data is also stored on your device, so that the App works offline.
8.2Security. We maintain reasonable security safeguards to prevent a Personal Data Breach. These include row-level security on every database table, encryption in transit using TLS, encryption at rest, and restriction of server-side privileges to operations such as account deletion.
8.3Recipients. We share Personal Data only with the recipients listed below:
Recipient
Data received
Role
Location
Supabase
All categories in Clause 4.2 other than support data
Data Processor: database and authentication hosting
India (Mumbai) [CONFIRM: whether any Supabase support or sub-processor access occurs outside India]
RevenueCat, Inc.
Account identifier; subscription status
Data Processor: subscription management
United States of America
Apple / Google (payment)
Payment details; purchase record
Independent Data Fiduciary under its own policy
Outside India
Apple / Google (sign-in)
Identity token, if you use their sign-in
Independent Data Fiduciary under its own policy
Outside India
Google Calendar
Nothing; read-only access
Source of calendar data only
Not applicable
8.4Transfers outside India. Some of your Personal Data is therefore processed outside India, in particular by RevenueCat in the United States and by the Platform Providers. Section 16 of the DPDP Act permits such transfers, except to a country or territory that the Central Government has restricted by notification. We will not transfer Personal Data to any restricted country or territory. [CONFIRM: counsel to approve this wording.]
8.5We engage Data Processors only under a valid contract that requires them to process Personal Data on our instructions and to maintain appropriate security safeguards.
9.DISCLOSURE
9.1We do not sell your Personal Data.
9.2We may disclose Personal Data where Applicable Law, a court or a competent authority requires it. Where we lawfully can, we will tell you before doing so.
9.3If the Company undergoes a merger, acquisition, restructuring or transfer of all or part of its business, Personal Data may be transferred to the successor entity. In that case, the successor will be bound by this Privacy Policy, and we will notify you before your Personal Data becomes subject to a different privacy policy.
10.RETENTION AND ERASURE
10.1We keep your Personal Data while your account is open, so that your history remains available to you.
10.2When you delete your account (see clause 5.3 of the Terms) or withdraw your Consent under Clause 6.2.2:
10.2.1your account data, Health Data, calendar data and subscription data are permanently erased from our production database without delay, together with your authentication record;
10.2.2we instruct RevenueCat to delete the records it holds about you [CONFIRM: deletion call to be implemented before launch];
10.2.3the copy stored on your device [is removed when the account is deleted from that device][CONFIRM product behaviour]. In any event, it is removed when you uninstall the App;
10.2.4support correspondence is retained for up to 12 months from the date of the last correspondence, and is then deleted;
10.2.5deleted data may remain in encrypted database backups for up to [Backup Retention Period] days, after which it is overwritten. We do not restore or use backup data except for disaster recovery; and
10.2.6purchase records held by a Platform Provider are retained by it under its own policy.
10.3We may retain limited records (for example, records of grievances and logs relating to the processing of Personal Data) where, and for as long as, Applicable Law requires. [CONFIRM: counsel to confirm any log-retention period prescribed under the DPDP Act.]
11.YOUR RIGHTS AND DUTIES
11.1Subject to the DPDP Act, you have the right to:
11.1.1obtain a summary of the Personal Data we process about you, the processing activities we undertake, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared (section 11);
11.1.2have your Personal Data corrected, completed, updated or erased (section 12). Most Personal Data can be edited directly in the App, and erasure is available at Settings → Delete my account;
11.1.3withdraw your Consent, as described in Clause 6;
11.1.4have your grievances redressed, as described in Clause 14 (section 13); and
11.1.5nominate another individual to exercise your rights if you die or become incapacitated (section 14), by writing to the privacy contact in Clause 16. [CONFIRM: nomination mechanism.]
11.2You may exercise any of these rights by using the relevant feature in the App or by writing to the privacy contact in Clause 16. We will respond within 30 days, or within any shorter period that Applicable Law prescribes. We may need to verify your identity first.
11.3Under section 15 of the DPDP Act, you must comply with Applicable Law when exercising your rights. In particular, you must not impersonate another person, suppress material information, or register a false or frivolous grievance or complaint.
12.CHILDREN
12.1The Services are intended only for individuals aged 18 or over. Under the DPDP Act, a person under 18 is a child, and processing a child's Personal Data requires the verifiable consent of a parent or lawful guardian (section 9). We do not offer the Services to children.
12.2Entering your date of birth is mandatory during onboarding. If the date entered shows that you are under 18, no account is created. We do not knowingly process the Personal Data of children. If you believe that a person under 18 holds an account, please contact us under Clause 16, and we will delete the account.
12.3We do not track, behaviourally monitor or serve targeted advertising to any User, whatever their age.
13.PERSONAL DATA BREACH
13.1If a Personal Data Breach occurs, we will notify the Board and each affected Data Principal in the form and manner, and within the time, that the DPDP Act prescribes. We will also take prompt steps to contain and remedy the breach.
14.GRIEVANCE REDRESSAL
14.1The Grievance Officer is: Name: [Grievance Officer Name]; Designation: [Designation]; Email:[Grievance Email]; Postal address: [Postal Address].
14.2We will acknowledge your grievance within 48 hours of receipt and will resolve it within 30 days of receipt.
14.3If you are not satisfied with our resolution, you may make a complaint to the Board. Under section 13(3) of the DPDP Act, you must first exhaust the grievance redressal process in this Clause 14 before approaching the Board. [CONFIRM: counsel to approve wording.] Nothing in this Clause affects your rights under the Consumer Protection Act, 2019.
15.CHANGES TO THIS PRIVACY POLICY
15.1We may update this Privacy Policy. If we make a material change, we will update the "last updated" date and notify you in the App before the change takes effect. If a change involves a new purpose, or a materially different way of processing Health Data, we will ask for your fresh Consent and will not assume it.
16.CONTACT
16.1Privacy enquiries and requests: [Privacy Contact Email]. Grievances: the Grievance Officer at [Grievance Email]. Postal address: [Company Legal Name], [Registered Office Address].