Privacy policy

The short version: we collect what we need to cook and deliver food built around your body, we never sell or share it, and it stays private with the Helicious team until you ask us to delete it.

1. What we collect

Only what is needed to build and run your plan — nothing extra, nothing guessed:

• Contact details — name, phone number, delivery address.
• Health & diet information — weight, height, activity level, food preference, allergies, medical notes you choose to share, and the targets your dietitian sets from them.
• Plan & payment records — what you ordered, what was billed, what was paid, and by what method. We do not store card or bank details ourselves.
• Day-to-day records — delivery logs, pauses, complaints, messages with your dietitian, so your history is on hand if you ever have a question about it.

2. Who can see it

Access follows the job, not the login. Not everyone on the Helicious team sees everything about you:

Team member	Sees
Your dietitian	Your health data, targets, menu and plan.
Kitchen staff	What to cook and any allergy warning — never a diagnosis, a lab value, or your bill.
Delivery rider	Your name, address and an allergy flag if one applies — nothing about your health or what you paid.
Owner / admin	The full record, to run the business and answer for it if something goes wrong.

This is enforced by the system itself, not just a rule someone is trusted to follow — each login is only ever sent the slice of data its role is allowed to see.

3. How it is kept safe

• Your PIN is never stored as typed — only a one-way scrypt hash of it, the same technique banks use. Nobody at Helicious, including the person building this system, can read it back.
• All traffic between your device and our server is encrypted (HTTPS).
• Repeated wrong PIN attempts lock a login out automatically.
• Every change to your record — who made it and when — is kept in an activity log for accountability.

4. How long we keep it

For as long as you are a member, and after that, kept privately and used for nothing — not marketing, not sharing, nothing — unless and until you ask us to delete it.

5. Deleting your account

You can ask us to delete your account and the data tied to it at any time. Message us on WhatsApp or tell your dietitian. Deletion is carried out by the Helicious owner/admin team only — never automatic and never by a third party — so a mistaken or malicious request cannot wipe a record by accident. We will confirm with you before it happens.

Billing and activity records tied to a completed payment may be kept as required by Indian tax and accounting law even after an account is deleted, with everything else removed.

6. Referrals

If you use or share a referral code, we record who referred whom so credit reaches the right person — that is the only data referrals adds, and it is visible only to the two members involved and the admin team.