Data security is part of wellbeing.
HydroVana is designed around responsible data handling, limited access and clear information about how data is used, for users in India, Europe and every market we serve. Our public commitments must always match the technical controls actually in place.
Our security principles
These principles reflect the HydroVana legal content pack and the security expectations of data-protection laws such as the EU GDPR, the UK GDPR and India’s DPDP Act. They describe our intended approach, not a claim of independent certification or a completed security audit.
Privacy by design
Collect only the information needed for the features users request, with privacy-protective defaults built in from the start.
Restricted access
Limit access to personal information to authorised people and service providers with a legitimate need, on a least-privilege basis.
Care with wellness data
Treat hydration, weight and other health-related data as sensitive: use it only with explicit consent, for disclosed purposes, and never for advertising.
Responsible vendors
Review third-party services and SDKs, keep an inventory, and put written data-processing agreements in place with each processor.
Retention and deletion
Keep information no longer than necessary, and delete or anonymise it on request or when it is no longer needed, subject to legal retention duties.
Delete your accountIncident response
Assess security incidents through a documented process, and notify regulators and affected users within the timeframes the law requires.
Protecting data for EU, EEA, UK and Swiss users.
For people in Europe, HydroVana aims to meet the security and accountability requirements of the GDPR, the UK GDPR and the Swiss FADP.
- Appropriate safeguards (Article 32 GDPR). Technical and organisational measures matched to the risk. These may include encryption in transit, access controls, secure storage of credentials and secrets, and regular review of security issues.
- Data protection impact assessment. Because HydroVana may process health-related data, we assess privacy risks before launching or materially changing features that process such data.
- Processor agreements (Article 28 GDPR). Every service provider that processes personal data for us is bound by a written agreement covering confidentiality, security, sub-processors, assistance with rights requests and deletion at the end of the service.
- Safe international transfers. When data from Europe is transferred to India or other countries without an adequacy decision, we use Standard Contractual Clauses (and the UK and Swiss equivalents), together with a transfer assessment and supplementary measures where needed.
- Breach notification. Where required, we notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach. We tell affected users without undue delay when a breach is likely to pose a high risk to them.
- Records and accountability. We keep records of processing activities and document our security and privacy decisions.
- Your rights, supported. Access, correction, deletion, portability, restriction and objection requests are answered within one month. See the Privacy Policy for details.
Clear information.
Responsible choices.
We aim to explain what information may be processed, why it is needed, where it is processed, and how you can contact us with a privacy or data request, wherever you live.
- ✓ Review the Privacy Policy
- ✓ Ask a question or submit a data request
- ✓ Withdraw consent for health-related data at any time
- ✓ Manage device notification permissions
Encryption, access controls, secure secret storage, logging, backup protection, transfer safeguards and incident-response procedures are technical and contractual controls that must be verified against the live system before launch. This page does not claim that HydroVana has been independently certified, audited or penetration-tested.