Privacy Policy

1. Who we are

Lean Protocol Private Limited is a technology-enabled weight-management and care-coordination company incorporated in India.

CIN: U86201UP2025PTC238980 Registered office: Plot No. 20, Block H-1/A, Sector 63, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India.

For personal data where Lean Protocol decides how and why it will be processed, Lean Protocol acts as the Data Fiduciary.

Registered medical practitioners, laboratories, pharmacies, payment providers and other independent service providers may separately determine how they process information for their professional or legal responsibilities. Their respective privacy notices may also apply.

2. Scope of this Policy

This Policy applies when you:

• Visit leanprotocol.in or a Lean Protocol landing page;
• Submit an enquiry through our website or a Meta, Google or other advertising-platform form;
• Use a health calculator or eligibility questionnaire;
• Speak with us by telephone, WhatsApp, SMS, email or chat;
• Create an account or use the Lean Protocol application;
• Participate in a consultation or programme;
• Connect a smart scale or another supported health device;
• Upload reports, prescriptions, photographs or other documents;
• Participate in a Lean Protocol community channel; or
• Interact with us as a doctor, dietitian, partner or prospective service provider.

Information processed by Meta, Google, WhatsApp, an app store or another third-party platform before it is received by Lean Protocol is also governed by that platform's privacy policy.

3. Personal data we may collect

The information collected depends on how you interact with us.

Identity and contact information

This may include your name, age or date of birth, gender, mobile number, email address, city, postal address and account identifiers.

Enquiry and lead-form information

When you submit an enquiry, we may collect your weight-management goals, preferred programme duration, type of support sought, preferred contact time, current weight, city and any health conditions you choose to disclose.

Submitting an enquiry does not constitute a medical consultation, diagnosis, prescription or confirmation of programme eligibility.

Health and lifestyle information

If you proceed with screening or enrolment, we may collect information such as:

• Height, weight, BMI and body-composition measurements;
• Medical history, existing conditions, allergies and family history;
• Current and previous medicines or supplements;
• Symptoms, side effects and adverse events;
• Diet, meal logs, hydration and food preferences;
• Physical activity, sleep, stress and lifestyle information;
• Pregnancy or breastfeeding status where clinically relevant; and
• Weight-management goals and programme progress.

Consultation and care information

This may include consultation notes, clinical assessments, treatment plans, prescriptions, dosage instructions, nutrition plans, adherence information, follow-up records, referrals, intervention history and communications between authorised members of your care team.

Diagnostic information

We may process test bookings, sample-collection details, laboratory reports and health markers such as blood glucose, HbA1c, lipid, liver, thyroid and other results relevant to your care.

Medicine and fulfilment information

Where you request pharmacy coordination, we may process your prescription, dispensing status, pharmacy order reference, delivery details and limited information required to coordinate fulfilment.

Medicines, when prescribed, are separately dispensed and invoiced by a licensed third-party pharmacy.

App and connected-device information

The Lean Protocol application may collect:

• Account and profile information;
• Weight and body-composition readings from connected smart scales;
• Meal, hydration, medication and activity logs;
• Symptoms and side-effect check-ins;
• Appointment, reminder and adherence information;
• Device identifiers, operating system, app version and language;
• Login activity, feature usage, crash reports and security logs; and
• Information from third-party health services that you expressly choose to connect.

Communications and recordings

We may retain emails, support tickets, chats, WhatsApp messages, call notes, feedback and other communications.

A consultation or call will be recorded only after appropriate notice and consent where required.

Payment information

We may receive payment status, transaction references, invoice details, package information and refund records.

Complete card, UPI or banking credentials are ordinarily processed directly by the payment provider and are not stored by Lean Protocol.

Website and advertising information

We may collect IP address, browser type, device information, referring page, campaign identifier, pages viewed, form activity, cookie identifiers and conversion events.

4. How we collect information

We may collect personal data:

• Directly from you;
• Through our website, app, forms, calls and communications;
• From your registered medical practitioner or care team;
• From a referring doctor or programme partner, with an appropriate basis and notice;
• From laboratories, pharmacies, logistics and payment providers;
• From connected devices and integrations authorised by you;
• From Meta, Google or another platform when you submit a lead form; and
• Automatically through cookies, logs and similar technologies.

Please ensure that information provided by you is accurate and current. Incorrect health information may affect the safety and quality of services.

5. Why we use personal data

We may process personal data to:

• Respond to an enquiry and arrange a requested call;
• Conduct preliminary programme-fit or eligibility screening;
• Create and secure your account;
• Verify identity for consultations;
• Coordinate consultations and programme services;
• Support clinical evaluation and care continuity;
• Prepare and monitor nutrition, lifestyle and adherence plans;
• Monitor weight, symptoms, side effects and programme progress;
• Coordinate laboratory testing and receive reports;
• Facilitate pharmacy fulfilment when requested by you;
• Operate smart-scale and connected-device features;
• Send appointments, reminders, safety messages and service updates;
• Process payments, invoices, cancellations and refunds;
• Provide customer support and resolve complaints;
• Protect the Platform against fraud, misuse and security threats;
• Maintain appropriate clinical, operational and audit records;
• Improve Platform reliability and user experience;
• Produce aggregated or de-identified analysis;
• Meet legal, regulatory, safety and pharmacovigilance obligations; and
• Establish, exercise or defend legal claims.

We will not use personal data for a materially unrelated purpose without providing an appropriate notice and, where required, obtaining fresh consent.

6. Consent and other permitted processing

Depending on the purpose, we may process personal data:

• With your free, specific, informed and unambiguous consent;
• To respond to a service or communication voluntarily requested by you;
• To provide services you have requested or purchased;
• To comply with applicable law or a lawful order;
• To respond to a medical emergency or immediate health threat;
• To prevent fraud, misuse or security incidents; or
• For another purpose permitted under applicable Indian law.

Separate choices may be requested for health-data processing, telemedicine, consultation recordings, connected devices, promotional communication, testimonials or partner-sponsored programmes.

You may decline optional processing. However, certain health and identity information may be necessary to provide clinical services safely.

7. Advertising and lead forms

When you submit a form through Meta, Google or another advertising platform, that platform may process your information independently under its own privacy terms. Lean Protocol receives the information that you choose to submit.

We may use lead-form information to respond to your enquiry, arrange a call, understand the type of support requested and assess whether an appropriate Lean Protocol service may be available.

We may use advertising and analytics tools to measure limited events such as page visits, campaign attribution, form completion or purchase conversion. Where reasonably possible, identifiers used for measurement will be minimised, hashed or pseudonymised.

Lean Protocol does not intentionally provide consultation notes, prescriptions, laboratory reports or identifiable clinical records to advertising platforms for targeted advertising.

Submitting an enquiry permits us to contact you regarding that enquiry. Unrelated promotional communication will be based on a separate choice where required, and you may opt out at any time.

8. Mobile application and permissions

The Lean Protocol application may request device permissions only where required for a feature you choose to use. These may include:

• Notification permission for reminders, appointments and safety updates;
• Bluetooth or nearby-device access for smart-scale connectivity;
• Camera or photo access for uploading meal photographs, reports or prescriptions; and
• File access for selecting documents that you choose to upload.

The application will not access these features unless permission is granted through your device settings. Refusing a permission may prevent the related feature from working but should not restrict unrelated functions.

We do not require access to your phone contacts for routine Lean Protocol services. If a future feature requires a materially new permission or category of information, we will explain the purpose before requesting access.

You may change app permissions through your device settings.

9. AI-assisted monitoring and clinical dashboards

The Platform may use rules-based systems, analytics or artificial-intelligence tools to assist authorised care-team members.

These tools may help:

• Identify missed check-ins or reduced adherence;
• Organise longitudinal health information;
• Highlight possible symptom or side-effect patterns;
• Generate risk or review-priority flags;
• Identify possible non-response indicators; and
• Support timely follow-up and escalation.

These outputs are decision-support information only. They do not independently diagnose, prescribe, counsel, change a medicine or replace a registered medical practitioner.

Lean Protocol will not rely solely on an automated output to prescribe or change medication or make a final clinical decision. Authorised practitioners remain responsible for clinical judgment and communication.

We do not use identifiable health or consultation data to train unrelated general-purpose AI models. Where data is used for research or model improvement beyond providing the requested service, we will use appropriately de-identified information or obtain separate consent where required.

10. When we share information

We do not sell or rent personal data.

We may share only the information reasonably necessary with:

Care-team professionals

Doctors, dietitians, nutritionists, trainers and other authorised professionals may access information relevant to providing and coordinating your care.

Access is role-based. A professional should not receive information unrelated to their responsibilities.

Referring doctors and programme partners

Where you have been referred by a doctor, clinic or programme partner, relevant progress or care information may be shared only with an appropriate basis, notice and consent where required.

A referring doctor is not automatically given access to your entire health record.

Laboratories

Information required to book tests, collect samples, receive reports and coordinate follow-up may be shared with the selected laboratory.

Pharmacies and logistics providers

Where you request medicine fulfilment, necessary prescription, identity, contact and delivery information may be shared with the dispensing pharmacy and its delivery provider.

Payment providers

Payment and transaction information may be shared with authorised payment gateways, banks and financial-service providers.

Technology and operational providers

We may use contracted providers for cloud hosting, databases, communications, customer support, analytics, cybersecurity, app operations and connected-device services.

Such providers are permitted to process data only for authorised purposes and are expected to implement appropriate safeguards.

Authorities and safety reporting

We may disclose information where required by law, court order or a competent authority, or where reasonably necessary to address fraud, cyber incidents or an immediate threat to health or safety.

Information concerning an adverse event may be reported to an appropriate practitioner, pharmacy, manufacturer, programme partner or regulatory authority where required by law or an applicable safety protocol.

Business restructuring

Information may be reviewed or transferred during a merger, financing, acquisition or restructuring, subject to confidentiality, lawful processing and continued protection.

11. Pharmaceutical and white-labelled programmes

This Policy does not, by itself, authorise Lean Protocol to provide identifiable health information to a pharmaceutical company for its independent advertising, sales or product promotion.

If a programme is sponsored, supported or white-labelled by a pharmaceutical company, hospital, clinic or another organisation, a separate programme notice will identify:

• The participating organisation;
• The respective data responsibilities;
• The information proposed to be shared;
• The purposes of the sharing; and
• The choices available to you.

Any unrelated commercial upselling or promotional use of identifiable health information will require an appropriate separate choice or consent.

12. Service and promotional communications

We may contact you by telephone, WhatsApp, SMS, email, app notification or another channel you provide for:

• Enquiry follow-up;
• Appointment coordination;
• Programme delivery;
• Safety and adherence reminders;
• Payment or account information; and
• Support and complaint resolution.

These operational communications may be necessary to provide requested services.

Promotional messages are optional. You may opt out through an unsubscribe facility, app setting or by writing to support@leanprotocol.in. Opting out of marketing will not stop essential care, account, transaction or safety messages.

WhatsApp and similar services are operated by third parties and have their own privacy practices. Avoid sharing unnecessary medical information in group channels.

13. Testimonials and community information

We will not publish your name, photograph, health journey, before-and-after material or testimonial without separate permission.

Community posts may be visible to other participants and moderators. You should not post information that you do not want other members to see.

Withdrawal of testimonial permission will apply to future use. It may not always be possible to retrieve material already lawfully printed or independently reshared by others, but we will stop further use under our control.

14. Cookies and similar technologies

The website and app may use:

• Essential technologies needed for security and core functionality;
• Preference technologies that remember selected settings;
• Analytics technologies that help us understand performance and usage; and
• Advertising technologies that measure campaign effectiveness.

Where required, non-essential cookies or technologies will be activated only after an appropriate choice. You may manage your choices through the cookie settings or browser controls.

Disabling certain technologies may affect Platform functionality.

15. Data retention

We retain personal data only for as long as reasonably necessary for the stated purpose or as required by applicable law.

Ordinarily:

• An unenrolled enquiry may be retained for up to 12 months after the last meaningful interaction, unless you request earlier deletion or consent to continued communication;
• Marketing information may be retained until you opt out, after which limited suppression information may be retained to respect that choice;
• Programme, consultation and health records may be retained for the period required for care continuity, medical-record obligations, safety, dispute resolution and applicable law;
• Payment, invoice and tax records are retained for applicable statutory periods;
• Consent, security and audit records may be retained as necessary to demonstrate compliance and investigate incidents; and
• Backup copies may remain for a limited backup cycle before secure deletion or overwriting.

Removing the application from your phone does not delete your account or records.

When personal data is no longer required, it will be deleted, anonymised or securely placed beyond ordinary use. Properly de-identified information that no longer identifies an individual may be retained for statistical, safety and service-improvement purposes.

16. Security and data breaches

We use reasonable technical and organisational safeguards appropriate to the nature of the information processed. These may include:

• Role-based access restrictions;
• Secure authentication;
• Encryption or masking where appropriate;
• Access logs and audit trails;
• Backups and availability controls;
• Staff confidentiality and access training;
• Vendor security obligations; and
• Incident-detection and response procedures.

No electronic system is completely secure. You should keep account credentials confidential and notify us promptly of suspected unauthorised access.

If a personal-data breach is likely to affect you, we will provide notice and relevant protective information as required by applicable law.

17. Cross-border processing

Some cloud, communication, analytics or technology providers may process information outside India.

Where cross-border processing occurs, we will take reasonable steps to use appropriate contractual, technical and organisational safeguards and comply with restrictions imposed under applicable Indian law.

18. Your rights and choices

Subject to applicable law, you may request:

• A summary of the personal data being processed;
• Information about relevant processing and sharing;
• Correction, completion or updating of inaccurate information;
• Erasure of information that is no longer required;
• Withdrawal of consent;
• Closure or deletion of your account;
• Changes to promotional communication preferences;
• Grievance redressal; and
• Nomination of another individual to exercise applicable rights in the event of death or incapacity.

Requests may be made through available in-app account controls or by emailing support@leanprotocol.in with the subject "Privacy Request".

Deleting an account may prevent continued service. Certain clinical, payment, safety or legal records may be retained even after account deletion where retention remains necessary or legally required.

We may verify your identity before acting on a request. We will acknowledge privacy grievances within 48 hours and endeavour to resolve them within 30 days, or within another period required by applicable law.

Withdrawal of consent does not affect processing lawfully completed before withdrawal.

19. Children

Lean Protocol's programmes and application are intended for adults aged 18 years and above.

We do not knowingly collect personal data from children through the Platform. If you believe a person under 18 has provided personal data, contact us so that we can investigate and take appropriate action.

20. Third-party services and links

The Platform may contain links to third-party websites, app stores, pharmacies, laboratories, payment services or communication platforms.

Their processing activities are governed by their respective terms and privacy policies. We encourage you to review them before providing information directly to those organisations.

21. Changes to this Policy

We may update this Policy to reflect legal, technical or service developments. The updated date will be displayed at the top of the Policy.

Material changes will be communicated through the website, app, email or another appropriate channel. If a change introduces a materially new purpose requiring consent, we will request that consent rather than treating continued use alone as acceptance.

22. Privacy contact and grievance mechanism

For privacy questions, rights requests or complaints, contact:

Privacy and Grievance Officer: Muskan Nagar Company Email: support@leanprotocol.in Phone: +91 96504 91267 Address: Lean Protocol Pvt Ltd, 20, Block H-1/A, Sector 63, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India.

You may approach the appropriate statutory authority after using our grievance mechanism, where such right is available under applicable law.