Privacy Policy

Effective date: 1 October 2026  ·  Data Fiduciary: Elyvora Skincare Private Limited

Elyvora Skincare Private Limited ("1000 Days", "we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, store and protect your personal data across our website at https://1000days.co and the 1000 Days mobile application (together, the "Services"). 1000 Days is a maternal and child wellness and parenting support platform. The app offers self-tracking tools for personal recordkeeping, a journal, secure records, general wellness insights, and consultations with independent Experts — some of whom are qualified healthcare professionals and some of whom provide wellness and parenting support.

We are the Data Fiduciary responsible for your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules under the Information Technology Act, 2000 (including the SPDI Rules governing sensitive personal data). The Services are intended for users in India. By using the Services, you agree to this Policy.

1000 Days is a wellness and parenting support platform. It supports — and does not replace — professional medical judgement, in-person examination or emergency care. If you or your child face a medical emergency, contact your doctor, your local emergency number, or the nearest hospital immediately.

1. Who can use the Services

The Services are intended for adults aged 18 and over — typically mothers, expecting mothers and caregivers.

Data about your baby or child. Several features let you record information about your baby or child (health tracking, vaccination records, milestones, journal). This information is provided by you as the parent or legal guardian, on your child's behalf and with your consent. We process children's data only to provide the Services to you, and we do not use children's data for tracking or targeted advertising, in line with the DPDP Act.

2. The information we collect

We collect only what we need to provide the Services. Some data is collected only if you use the feature it relates to.

2.1 Account and identity

• Mobile phone number, used to sign in via a one-time password (OTP), and, where you provide them, your name and email address.
• Your baby's or child's name, date of birth or due date, and basic details you choose to add.
• Profile photo and preferences.

2.2 Health and sensitive personal data

Some of the information you choose to record or share is health information, which is sensitive personal data. Self-tracking data is a personal record kept for your own awareness and, if you choose, for sharing with a professional; we do not use it to diagnose you or your child.

• Maternal health: recovery, symptoms, mood, sleep, menstrual/cycle data, and pregnancy details you choose to record.
• Baby/child health: feeds, sleep, nappy/diaper logs, growth and measurements, milestones, pumping, illness and temperature, and vaccination records and schedules.
• Consultation records: appointments, notes made by the Expert (including clinician notes and any prescriptions from healthcare professionals), session summaries and care-team information from your consultations.
• Journal and self-logged notes, which may contain health information about you or your child.

2.3 Communications and content

• Chat messages with your care team, and the content of your teleconsultations (voice/video).
• Newsletter sign-ups and content preferences, where you provide them.

2.4 Payments and subscriptions

• Subscription and purchase records: plans, wallet top-ups, transaction history and status.
• Payment: card, UPI, net-banking or wallet transactions, including recurring subscriptions/mandates. Full card, UPI and bank credentials are entered directly into our payment provider's secure interface and are not stored by us — we receive only a transaction identifier, amount and status (see Section 4).

2.5 Information collected automatically

• Device and technical data: device identifiers, app version, and diagnostics needed to run and secure the Services.
• Crash and error diagnostics to detect and fix problems (via Sentry — see Section 4).
• Usage data about how the Services are used, to improve quality and reliability. We do not use advertising identifiers, and advertising and ad-conversion measurement are disabled in our app.
• Push token (if you enable notifications) to deliver care- and account-related messages.
• Security data such as IP address and phone number, for fraud prevention, rate-limiting and abuse protection.
• Website cookies and similar technologies (see Section 9).

We do not collect your precise device location, your contacts, your calendar, the content of your personal SMS/MMS, or your web-browsing history across other sites. Our app does not request location, contacts or calendar permissions.

3. How and why we use your information

• Provide the Services — account creation and sign-in; consultations, self-tracking, journal and records.
• Consultations and care — deliver consultations with the Experts you choose (healthcare professionals or wellness and parenting support Experts), keep consultation records, and enable your chosen care team to support you.
• Payments — process subscriptions, wallet top-ups and one-time purchases, and manage renewals.
• Communications — send service, appointment and care notifications, and, with your consent, newsletters and offers.
• AI-assisted insights — generate optional weekly general wellness insights and summaries from your tracker data (see Section 5). We do not use AI to diagnose, prescribe or make clinical decisions.
• Safety and security — prevent fraud and abuse, protect users and the platform, and comply with law.
• Improve the Services — diagnose issues, understand feature usage, and improve quality and reliability.

Legal basis (DPDP Act). We process personal data based on the consent you give and, where permitted, for certain legitimate uses under the DPDP Act (such as complying with law or preventing fraud). We process sensitive health data and children's data on the basis of your explicit consent, which you may withdraw at any time (see Section 10).

4. Who we share your information with

We do not sell your personal data, and we do not share health data for advertising. We share personal data only as described here.

4.1 Service providers (processors) acting on our behalf

• Razorpay — payments for consultations and other services, website payments and, where applicable, recurring UPI/card mandates. Card, UPI and bank details go directly to Razorpay; we receive only a transaction identifier, amount and status.
• Apple App Store and Google Play billing — in-app purchases of subscriptions and digital content made in the iOS or Android app. Apple or Google processes your payment details; we receive confirmation of the purchase, its status and renewal information.
• GetStream — in-app chat and video teleconsultations, including messages, attachments and call audio/video.
• Amazon Web Services (AWS) — secure storage of documents, records and media, hosted in India.
• MSG91 — delivery of one-time passwords (OTP), transactional SMS and email. Processes your phone number and email address to send these messages.
• Google Firebase — push notifications and remote configuration. (Firebase Analytics and Crashlytics are not used.)
• Sentry — crash and error diagnostics to keep the app stable and secure.
• AI/large-language-model provider — generating optional weekly insights from your tracker data (see Section 5).
• Google and Apple — app distribution and delivery of push notifications (FCM and APNs).

We work only with providers that offer appropriate safeguards. This list may change as our Services evolve; we will keep this Policy updated.

4.2 Practitioners and care team

Health and consultation information you share is made available to the practitioners providing your care. Sharing of your tracking data with practitioners happens only where you have enabled it.

4.3 Legal, safety and business transfers

We may disclose information where required by law, regulation or legal process, to protect rights and safety, or in connection with a merger, acquisition or asset transfer (subject to this Policy).

5. AI-assisted insights

To help you make sense of your logs, we can generate optional weekly insights and summaries from your tracker data. To do this, we send the relevant data to a third-party large-language-model (LLM) provider through a secure AI gateway. We share only the data needed to produce the insight, and we do not use this data to train third-party models. This processing may take place outside India; where it does, we take steps to ensure your data is protected in accordance with this Policy and applicable law.

What AI insights do not do. AI-generated insights are general wellness information only. The AI does not diagnose any condition, does not prescribe or recommend treatment or medication, and does not independently provide clinical recommendations. AI insights are separate from consultations with Experts and are not reviewed by a healthcare professional before you see them. They do not constitute medical advice.

Your choice. AI insights are optional. You can turn them off at any time in the app, after which we will stop sending your tracker data to the AI provider for this purpose.

6. Where your data is stored

Your data is primarily stored and processed on our infrastructure located in India. Some service providers — for example our crash-diagnostics, push-notification and AI-insights providers — may process limited data outside India. Where they do, we take steps to ensure it is protected in accordance with this Policy and applicable law.

7. Data security

We use reasonable technical and organisational measures to protect your data, including encryption in transit, secure on-device storage of authentication tokens, access controls, and restricting payment credentials to our PCI-compliant payment provider. No system is completely secure, and we cannot guarantee absolute security; please keep your device and account credentials safe.

8. Data retention

We retain your personal data for as long as your account is active and as long as necessary to provide the Services. We may retain certain data longer where required to comply with legal, regulatory, tax or medical-record obligations, or to resolve disputes and enforce our terms. When data is no longer needed, we delete or anonymise it.

9. Cookies and similar technologies (website)

Our website uses cookies and similar technologies to operate the site, remember your preferences, measure performance, and understand how the site is used. You can control cookies through your browser settings and, where shown, our cookie banner. Some cookies are necessary for the site to function.

10. Your rights and choices

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you;
• Correct, complete or update inaccurate or incomplete data;
• Erase your personal data, subject to legal retention requirements;
• Withdraw consent at any time (this will not affect prior lawful processing and may limit certain features);
• Grievance redressal — raise a concern and receive a response (Section 12);
• Nominate another individual to exercise your rights in the event of your death or incapacity.

Marketing choices. With your consent, we may send you newsletters, product updates and offers by email, SMS or push notification. You can opt out at any time — using the unsubscribe link, replying STOP, or adjusting your notification settings. We will still send essential service and care messages (for example appointment or account updates).

To exercise these rights, contact us at support@1000days.co or use in-app options where available. We may need to verify your identity before acting on a request.

11. Account and data deletion

You can request deletion of your account and associated personal data in any of these ways:

• In the app — use the delete-account option in your account settings;
• On the web — visit our delete account page, which lets you request deletion without the app installed; or
• By email — write to support@1000days.co from, or quoting, the phone number registered to your account.

What is deleted and what is kept. Deletion covers your account details, your child's profile, tracker data, journal entries, uploaded documents and chat history. On a valid request we will delete or anonymise your data, except where we must retain certain information to meet legal, regulatory, tax or medical-record obligations, or to resolve disputes and enforce our agreements.

12. Grievance Officer and contact

In accordance with Indian law, you may contact our Grievance Officer with any question, concern or complaint about your personal data or this Policy:

• Grievance Officer: Ragini Misra
• Email: support@1000days.co
• Data Fiduciary: Elyvora Skincare Private Limited
• Registered address: Floor 3, A Block, Shivsagar Estate, Dr. Annie Besant Road, Worli, Mumbai – 400018, Maharashtra, India

We will acknowledge and respond within the timelines required by applicable law. For general privacy queries: support@1000days.co.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified via the website or app. The "Effective date" above reflects the latest revision. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.