BODYLIA LIFE SCIENCES LLP

Effective Date: 1 November 2026

Last Updated: 14 October 2026

Website: https://bodylia.in

Privacy, Data Protection and Grievance Portal: https://bodylia.com/contact

Bodylia Life Sciences LLP (“Bodylia”, “we”, “us”, “our” or the “Company”) respects the privacy of individuals and is committed to protecting personal information collected in connection with its websites, products, services and business operations.

This Privacy Policy (“Policy”) explains how we collect, receive, access, use, store, organise, disclose, transfer, retain, secure and delete personal information relating to individuals who visit our websites, register for pre-launch offers, purchase our products, subscribe to communications, submit enquiries, participate in promotional activities, or otherwise interact with us.

This Policy applies to:

a. Visitors to https://bodylia.in and associated pages operated by Bodylia;

b. Individuals registering for product launches, waitlists, referral programmes, promotional offers and customer accounts;

c. Customers purchasing nutraceuticals or other products offered by Bodylia;

d. Individuals submitting product reviews, feedback, customer-service requests or complaints;

e. Individuals submitting wellness-related questions or voluntarily sharing information about their health interests;

f. Business representatives, distributors, suppliers and prospective commercial partners interacting with Bodylia; and

g. Individuals communicating with Bodylia through https://bodylia.com/contact or any other channel authorised by us.

This Policy must be read together with the applicable Terms and Conditions, Shipping Policy, Cancellation and Refund Policy, Cookie Notice and other relevant policies published on our websites.

If a specific policy addresses a particular transaction or activity, that policy shall apply to that subject to the extent of any inconsistency, provided that no provision shall exclude or restrict a mandatory right available under applicable law.

Legal entity: Bodylia Life Sciences LLP

Principal business address: B208 Pavan Plaza, Opp Lifecare Hospital, Naranpura, Ahmedabad, Gujarat – 380013, India.

Designated contact person: Aryan Gajjar.

Telephone: +91 90819 00921.

Official contact and escalation portal: https://bodylia.com/contact.

For all privacy requests, data-protection concerns, consent withdrawals, correction or erasure requests, complaints, grievances and other communications relating to this Policy, individuals must use the official contact portal stated above.

Bodylia will publish any additional statutory officer designation or contact particulars required by applicable law through an appropriate public-facing channel.

This Policy is intended to operate in accordance with applicable Indian law, including, where relevant:

a. The Information Technology Act, 2000;

b. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable;

c. The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, as and when the relevant provisions become applicable;

d. The Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020, as amended and applicable;

e. Applicable provisions governing electronic records, electronic contracts, consumer rights, advertising and commercial communications;

f. Applicable food-safety, nutraceutical, packaging, labelling, tax, accounting and record-retention requirements; and

g. Any other applicable legislation, rules, regulations, directions or binding orders of competent authorities.

The applicability of individual statutes and provisions depends on their commencement, the nature of the information concerned, the relevant transaction and the circumstances of processing.

Nothing in this Policy shall be interpreted as representing that a provision not yet in force is already legally enforceable.

For purposes of this Policy:

“Personal Data” means information about an identifiable individual, including information capable of identifying an individual directly or indirectly, as recognised under applicable law.

“Digital Personal Data” means personal data in digital form within the meaning of the DPDP Act when the relevant provisions apply.

“Data Principal” means the individual to whom personal data relates, as defined under the DPDP Act when applicable.

“Data Fiduciary” means the person who, alone or together with another person, determines the purpose and means of processing personal data under the DPDP Act when applicable. Bodylia shall act in this capacity where the statutory definition applies to its activities.

“Data Processor” means a person processing personal data on behalf of a Data Fiduciary, where the relevant statutory framework applies.

“Processing” includes collecting, recording, organising, storing, retrieving, using, sharing, disclosing, transmitting, restricting or deleting information.

“Sensitive Personal Data or Information” has the meaning assigned under applicable Indian law, including the Information Technology Rules, 2011, where applicable.

“Website” means https://bodylia.in and any associated digital property operated by Bodylia that expressly adopts this Policy.

“Contact Portal” means https://bodylia.com/contact.

Depending on the services used and the information voluntarily provided, Bodylia may collect the following categories of information.

5.1 Identity and account information

This may include:

• Name and title;
• Username or account identifier;
• Date of birth or age-verification information, where required;
• Account credentials and authentication records;
• Customer or membership identifiers; and
• Information reasonably required to verify identity when processing a sensitive request.

Passwords, where used, should be protected using appropriate security controls and should not be stored in plain text.

5.2 Contact information

This may include:

• Mobile telephone number;
• Electronic contact address;
• Postal or billing address;
• Delivery address; and
• Communication preferences.

Contact information is used only for relevant operational, transactional, customer-service, legal or consent-based purposes.

5.3 Transaction and order information

This may include:

• Order numbers and order history;
• Products viewed, ordered or returned;
• Cart contents;
• Coupon, discount and referral-code usage;
• Invoices and tax information;
• Delivery and dispatch records;
• Refund, return, chargeback and payment-status records; and
• Customer-service correspondence relating to transactions.

5.4 Payment-related information

Payments may be processed by third-party payment service providers.

Bodylia may receive transaction identifiers, payment status, payment method type, limited billing information, refund status and information necessary for reconciliation or dispute resolution.

Complete card credentials, authentication secrets and other highly sensitive payment information should ordinarily remain with the relevant payment service provider and should not be collected or stored by Bodylia unless lawfully necessary and supported by appropriate security arrangements.

5.5 Technical and usage information

When individuals access our websites, certain information may be generated or collected automatically, depending on the website configuration and applicable consent requirements.

This may include:

• Internet Protocol (IP) address;
• Browser type and operating system;
• Device characteristics;
• Session identifiers and timestamps;
• Pages visited and referring pages;
• Website interaction and performance information;
• Security logs; and
• Cookie or similar technology identifiers.

5.6 Wellness-related information

Individuals may voluntarily submit information concerning wellness objectives, dietary preferences, nutritional interests, product suitability questions or other health-related matters.

Such information may be treated as sensitive information under applicable law, depending on its nature and the relevant legal framework.

Bodylia requests individuals not to submit medical records, detailed diagnoses, prescription information, government identity documents or other sensitive information unless it is genuinely necessary for the particular request and the submission is made through an appropriate channel.

5.7 Reviews, feedback and submitted media

Where supported by our systems, individuals may provide product reviews, feedback, photographs, videos or other supporting material for customer-service or product-related purposes.

Individuals should not submit images or documents containing another person's personal information unless they are authorised to do so.

5.8 Business and professional enquiries

Business enquiries may involve the collection of:

• Name and professional designation;
• Business or organisation name;
• Business contact particulars;
• Country or market of interest;
• Product, distribution or manufacturing requirements; and
• Information relevant to a proposed commercial relationship.

Bodylia may use personal information, as relevant and lawful, for the following purposes:

a. Creating and administering customer accounts;

b. Registering individuals for product launches, waitlists and promotional programmes;

c. Issuing and validating coupons, referral codes and eligible promotional benefits;

d. Processing orders, payments, invoices, shipping, delivery, returns and refunds;

e. Responding to questions, requests, complaints and grievances;

f. Providing product information and customer support;

g. Preventing fraud, unauthorised transactions, abuse of promotional programmes and other unlawful activity;

h. Maintaining records required for tax, accounting, regulatory and legal compliance;

i. Protecting the security, integrity and availability of our websites and systems;

j. Analysing website performance and improving the customer experience;

k. Sending service-related notices and transactional communications;

l. Sending marketing or promotional communications where permitted by law and supported by the required consent or other lawful basis;

m. Evaluating distributor, supplier, manufacturing and other business enquiries;

n. Responding to lawful requests from courts, regulators, law-enforcement agencies or other competent authorities; and

o. Establishing, exercising or defending legal claims.

Bodylia shall not knowingly use personal information for a materially unrelated purpose without providing any notice or obtaining any consent required under applicable law.

The legal basis for processing will depend on the applicable legislation and the purpose concerned.

Where the DPDP Act applies, processing shall be undertaken on a lawful basis recognised by that Act, including consent or a permitted certain legitimate use, as applicable.

Where consent is required:

a. The request for consent shall be presented clearly and separately from unrelated matters, as required by applicable law;

b. Individuals shall be informed of the categories of information collected and the purposes for which it is processed;

c. Consent shall not be inferred merely from silence or from the submission of information for an unrelated purpose;

d. Individuals shall be able to withdraw consent through an accessible mechanism where required; and

e. Withdrawal shall not invalidate processing lawfully undertaken before withdrawal, but subsequent processing shall be adjusted as required by law.

Where processing is necessary to perform a transaction, comply with a legal obligation, protect a lawful interest recognised by applicable law or address a security incident, Bodylia shall assess and document the appropriate legal basis.

A contractual relationship or operational necessity shall not be treated as a blanket authorisation to process unrelated personal information.

Our websites may use cookies, pixels, local storage or similar technologies to support essential website functionality, preserve shopping-cart information, maintain sessions, improve security and measure performance.

Subject to the actual technologies deployed, these technologies may be classified as:

Essential technologies: Necessary for core functions such as checkout, account security and shopping-cart operation.

Preference technologies: Used to remember language, region or other selected preferences.

Analytics technologies: Used to understand website usage, diagnose errors and improve website performance.

Advertising technologies: Used, where enabled and lawful, to measure promotional effectiveness or deliver relevant advertising.

Non-essential technologies shall be activated only in accordance with applicable consent and notice requirements.

Individuals may manage cookies through available website controls or browser settings. Disabling certain cookies may affect website functionality.

Third-party technologies may be subject to the privacy policies of their respective providers.

Bodylia may send promotional messages concerning product launches, offers, discounts, new formulations, loyalty programmes and related services where permitted by applicable law.

Where consent is required, promotional communications shall be sent only after obtaining the appropriate consent.

Transactional messages, such as order confirmations, payment updates, dispatch notifications and security alerts, may be sent where necessary to complete or administer a transaction or otherwise permitted by law.

Individuals may withdraw marketing consent or opt out of promotional communications through an available unsubscribe mechanism, communication preference control or the Contact Portal.

Opting out of marketing shall not ordinarily prevent essential transactional or legally required communications.

Where telecommunications or commercial messaging rules apply, Bodylia shall comply with applicable requirements, including relevant preferences, consent records, sender identification and restrictions on unsolicited commercial communications.

Bodylia may disclose personal information to third parties where reasonably necessary for the purposes described in this Policy and where permitted by applicable law.

These parties may include:

a. E-commerce hosting and website service providers;

b. Cloud storage, infrastructure and technical support providers;

c. Payment gateways, banks and payment-processing service providers;

d. Courier, shipping, logistics and returns-management partners;

e. Customer-support and communication service providers;

f. Analytics, security and fraud-prevention service providers;

g. Marketing or referral-programme providers, where lawfully engaged;

h. Accountants, auditors, legal advisers and other professional advisers;

i. Manufacturers, suppliers or fulfilment partners where disclosure is necessary for a legitimate operational purpose; and

j. Courts, regulators, law-enforcement authorities or other persons where disclosure is legally required or lawfully necessary to protect rights and safety.

We aim to limit disclosure to information reasonably necessary for the relevant purpose.

Where a third party processes information on our behalf, appropriate contractual and security arrangements should be maintained, as required by applicable law.

Third parties processing information for their own independent purposes may act under their own privacy policies and legal responsibilities.

Our online store may use Shopify or another e-commerce platform. Depending on the services enabled, we may also use cloud infrastructure providers, payment gateways, logistics providers, analytics services and communication platforms.

The actual providers and their functions may change as our operations develop.

Each provider may process certain information in accordance with its contractual obligations, technical role and applicable privacy terms.

Bodylia does not represent that every provider listed or contemplated in an internal operational plan has been activated, independently audited or certified for every relevant purpose.

Individuals should review the privacy notices of third-party services when interacting directly with those services.

Certain service providers may store or process information outside India.

Where cross-border processing occurs, Bodylia shall assess applicable Indian legal requirements, contractual obligations and any restrictions imposed by the competent authorities.

Transfers shall be subject to applicable legal restrictions and appropriate contractual, organisational and technical safeguards.

This Policy does not represent that all personal information is stored exclusively in India unless that position has been verified against the actual infrastructure and service-provider arrangements.

Bodylia retains personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, regulatory, contractual, accounting and dispute-related requirements.

Retention periods may vary according to the nature of the information and the purpose concerned.

Indicative retention principles include:

a. Waitlist and promotional records: Retained while necessary to administer the relevant launch, offer, referral programme or related customer request, and thereafter for a reasonable period where justified by legal or operational requirements.

b. Customer account records: Retained while the account remains active and for any further period reasonably necessary for security, dispute resolution, compliance or other lawful purposes.

c. Order, invoice and tax records: Retained for the periods required under applicable tax, accounting and other record-keeping laws.

d. Payment and refund records: Retained as necessary for reconciliation, chargebacks, fraud prevention, financial compliance and dispute resolution.

e. Consent and preference records: Retained as necessary to demonstrate consent, manage withdrawals and establish compliance.

f. Customer-support and grievance records: Retained for the period reasonably necessary to resolve the matter and meet applicable legal or evidentiary requirements.

g. Technical and security logs: Retained for a period proportionate to security, investigation, system integrity and applicable legal requirements.

h. Wellness-related information: Retained only for the period reasonably necessary to address the request, subject to any applicable legal obligations.

Where information is no longer required, Bodylia shall take reasonable steps to delete it, anonymise it or otherwise render it unusable, unless retention is required or permitted by applicable law.

Deletion from active systems may not immediately remove every backup, archival copy or record maintained by an independent service provider. Such copies shall be managed under appropriate retention and deletion procedures.

A request to delete personal information does not require Bodylia to destroy records that it is legally required to preserve.

Where applicable law requires advance notice before erasure, or prescribes a specific inactivity period, notice period or retention exception, Bodylia shall follow that requirement. No universal 48-hour pre-erasure period is promised by this Policy.

Bodylia shall implement reasonable technical and organisational safeguards appropriate to the nature of the information processed and the risks involved.

Depending on the systems and services deployed, safeguards may include:

a. Access controls and role-based permissions;

b. Appropriate authentication and password-protection measures;

c. Encryption in transit and, where appropriate, at rest;

d. Secure configuration and maintenance of systems;

e. Monitoring and logging of relevant security events;

f. Backup and recovery arrangements;

g. Vendor due diligence and contractual security requirements;

h. Staff awareness and confidentiality obligations;

i. Procedures for investigating suspected unauthorised access; and

j. Secure deletion and disposal practices.

No electronic system, transmission method or storage environment can be guaranteed to be completely secure. However, Bodylia shall take reasonable measures to reduce risks and respond appropriately to identified vulnerabilities.

Individuals should protect their account credentials, avoid sharing authentication codes and promptly report suspected unauthorised use through the Contact Portal.

A personal data breach may include unauthorised access, disclosure, alteration, loss, destruction or other compromise of personal information.

If Bodylia becomes aware of a suspected or confirmed breach, it shall assess the incident and take appropriate steps, which may include:

a. Containing the incident and preventing further unauthorised access;

b. Investigating the nature and extent of the incident;

c. Preserving relevant evidence and security logs;

d. Taking remedial measures;

e. Notifying affected individuals, regulators or other authorities where required; and

f. Reviewing controls to reduce the likelihood of recurrence.

The timing, content and recipients of any legally required notification shall be determined under the applicable law in force at the relevant time.

Where the DPDP Act and Rules impose applicable notification requirements, Bodylia shall comply with the relevant requirements, including prescribed timelines and information disclosures.

This Policy does not promise that every incident will be notified within a fixed 72-hour period irrespective of the applicable statutory requirements.

Subject to applicable law, individuals may request that Bodylia:

a. Provide information about the personal information held concerning them;

b. Correct inaccurate or incomplete information;

c. Update information that has changed;

d. Delete personal information that is no longer required or that is otherwise eligible for erasure;

e. Withdraw consent where processing depends on consent;

f. Address concerns about the processing or disclosure of their information;

g. Explain the categories of third parties with whom information has been shared, where disclosure is required by applicable law; and

h. Recognise a lawful representative or nominee where required under applicable law.

The availability, scope and procedure for exercising a particular right shall depend on the legal framework in force and any applicable exceptions.

Requests may be submitted through https://bodylia.com/contact.

To protect individuals against unauthorised disclosure, Bodylia may request reasonable information to verify the identity and authority of the requester. Verification shall be proportionate to the nature and sensitivity of the request.

Bodylia may decline or limit a request where permitted by law, including where the request is manifestly unfounded, legally restricted or inconsistent with a mandatory record-retention obligation. Any such decision shall be handled in accordance with applicable law.

Bodylia's online purchasing and account services are intended for individuals who are at least 18 years old and legally competent to enter into the relevant transaction.

We do not knowingly seek to collect personal information directly from children in connection with services restricted to adults.

Where age verification is reasonably required, Bodylia may request an age confirmation or other proportionate verification information.

If we become aware that personal information has been collected from a child in circumstances where the collection or processing is not permitted, we shall assess the matter and take appropriate steps under applicable law.

Nothing in this Policy authorises the processing of children's personal information in breach of applicable consent, parental-verification, tracking, behavioural-monitoring or advertising restrictions.

Where the DPDP Act's child-data provisions become applicable to the relevant processing, Bodylia shall follow those provisions and the applicable Rules.

Bodylia may receive enquiries concerning nutrition, wellness objectives, dietary preferences and the general characteristics of its products.

Individuals should share only information reasonably necessary to address their enquiry.

Bodylia's customer-support communications are not a substitute for medical diagnosis, treatment or professional advice from a qualified healthcare practitioner.

Product-related information should be read together with the relevant product label, instructions, warnings and applicable regulatory disclosures.

Where an individual submits health-related information voluntarily, Bodylia shall use it only for the stated or otherwise lawfully permitted purpose and shall apply appropriate safeguards.

Bodylia shall not knowingly disclose such information for unrelated advertising or other unrelated purposes without an applicable lawful basis.

Bodylia may operate referral programmes, promotional offers, loyalty benefits or launch discounts.

To administer such programmes, we may process a participant's name, contact information, referral identifier, redemption history, transaction status and information necessary to detect duplicate, fraudulent or abusive claims.

Referral information may be shared with the relevant service provider where necessary to operate the programme.

Promotional benefits remain subject to the terms communicated for the particular offer.

Participation in a referral or promotional programme does not automatically constitute consent to receive unrelated marketing communications.

Bodylia may use automated systems to assist with website security, fraud prevention, transaction verification, operational analytics, customer-support routing and promotional-code validation.

Such systems may analyse technical indicators, transaction patterns or account activity.

Where an automated process materially affects an individual's rights or is subject to specific legal requirements, Bodylia shall take appropriate steps in accordance with applicable law.

This Policy does not represent that Bodylia currently uses artificial intelligence or automated decision-making for every purpose described in this section.

Bodylia may preserve, use or disclose information where reasonably necessary to:

a. Comply with applicable legislation, regulations, court orders or lawful directions;

b. Maintain statutory records;

c. Investigate suspected fraud, abuse or unlawful activity;

d. Protect the rights, property, safety or security of Bodylia, its customers or others; or

e. Establish, exercise or defend legal claims.

Where legally permissible, disclosures shall be limited to the information reasonably necessary for the relevant purpose.

Individuals may raise privacy concerns, submit data-related requests or lodge grievances through the following official portal:

https://bodylia.com/contact

Designated contact person: Aryan Gajjar.

Telephone: +91 90819 00921.

The portal is the central channel for all privacy requests, complaints, escalations and customer-support matters under this Policy.

Bodylia shall acknowledge and address consumer grievances within the time limits prescribed by applicable law. Under the Consumer Protection (E-Commerce) Rules, 2020, the applicable grievance mechanism requires acknowledgment within 48 hours and redressal within one month of receipt, subject to applicable amendments and legal requirements.

Where a statutory role, such as a Grievance Officer or other designated officer, must be appointed, Bodylia shall make the required designation and disclosures through an appropriate public-facing channel.

Individuals should include sufficient information to identify the relevant account, transaction or request, while avoiding unnecessary disclosure of sensitive information.

Where a request concerns another individual's information, Bodylia may require proof of legal authority before proceeding.

Nothing in this section removes an individual's right to approach a competent consumer forum, regulator, court or other authority where such recourse is available under applicable law.

Our websites may contain links to external websites, payment pages, social media platforms or other third-party services.

Bodylia does not control the privacy practices, security or content of external services operated independently by third parties.

Accessing such services may subject individuals to separate privacy notices and terms.

Individuals should review the applicable terms and privacy notices before providing personal information to an external service.

Bodylia may revise this Policy to reflect changes in applicable law, regulatory guidance, business operations, website functionality, technology or data-processing practices.

The revised Policy shall be published on the relevant website with an updated effective date or revision date.

Where a change requires advance notice, renewed consent or another prescribed action, Bodylia shall take the steps required by applicable law.

Continued use of a website shall not, by itself, be treated as consent to a new purpose where affirmative consent is legally required.

This Policy shall be interpreted in accordance with the laws of India.

Subject to mandatory statutory jurisdiction, consumer-protection rights and any other applicable legal requirements, disputes relating to this Policy shall be subject to the jurisdiction of the competent courts at Ahmedabad, Gujarat, India.

Nothing in this clause limits any non-waivable rights or remedies available under applicable Indian law.

For all questions relating to this Privacy Policy, personal information, consent, correction, deletion, data security, complaints or grievances, please use:

Official Privacy and Grievance Portal: https://bodylia.com/contact

Bodylia Life Sciences LLP

B208 Pavan Plaza, Opp Lifecare Hospital, Naranpura, Ahmedabad, Gujarat – 380013, India.

Contact Person: Aryan Gajjar.

Telephone: +91 90819 00921.

All privacy-related communications and escalations should be routed through the official portal.

✆ +91 9081900921