Privacy Policy

Last Updated: August 2026

At HabitBloom, we believe your habits are deeply personal. We are fundamentally committed to protecting your privacy, ensuring you have complete control over your data, and maintaining strict compliance with global privacy regulations, including the Digital Personal Data Protection (DPDP) Act, 2023 (India).

1. Your Personal Data Rights (Data Principals)

Under the DPDP Act, you have the right to access, correct, erase, and nominate representatives for your personal data. You may withdraw your consent at any time. By November 2026, our platform will be fully integrated with government-registered Consent Managers, allowing you to seamlessly manage your consent across the HabitBloom platform from a unified dashboard.

2. Our Role as Fiduciary vs. Processor

HabitBloom operates in dual roles depending on the context:

  • As a Data Fiduciary: We act as a fiduciary for your account creation data (e.g., email, name) and our direct interactions with you. We determine the purpose and means of this processing.
  • As a Data Processor: When you use HabitBloom "Spaces" via your organization or employer, we act as a Data Processor on their behalf. The organization remains the Data Fiduciary and holds the primary responsibility for securing your consent.

3. AI & Machine Learning Restrictions

HabitBloom uses advanced heuristics and AI to provide personalized insights. However, we adhere to strict "Privacy by Design" principles. We absolutely do not use your personal habit data to train, fine-tune, or develop our AI models by default. If we introduce features requiring data for model training, we will request explicit, itemized consent ("Opt-In") prior to any data usage.

4. Sub-processors and Data Security

We utilize secure third-party infrastructure (e.g., Firebase) to host your data. All sub-processors we use are contractually bound to uphold the same strict DPDP compliance standards. We employ enterprise-grade encryption for data in transit and at rest. In the unlikely event of a data breach, we will notify you and the Data Protection Board of India (DPBI) promptly as legally required.

5. HabitBloom Spaces

When you join a HabitBloom Space (e.g., a corporate team or fitness group), your progress for specific shared challenges becomes visible to that group. Space Admins may view aggregated, anonymized analytics (e.g., "75% of members completed the daily walk"), but they cannot access individual identifiable data without your explicit consent.