Privacy Policy

1. Who we are

Metabulix is operated by Metabulix Healthcare Pvt. Ltd.(“we”, “us”). We are the data fiduciary for the personal data described here. This policy covers https://metabulix.com and any service reached through it.

2. Information we collect

We collect only what a given interaction needs.

• Account details — your name, email address and, if you provide it, your phone number. If you sign in with Google we receive your name, email address and profile picture from Google; we never receive your Google password.
• Order details — delivery address, contact number, what you bought and when. We keep these as a record of the transaction.
• Payment information— handled entirely by our payment gateway. Card numbers, UPI PINs and net-banking credentials are entered on the gateway’s own secure page and are never seen or stored by us. We retain only a transaction reference and whether the payment succeeded.
• Health information you choose to share — answers to our quizzes and assessments, and anything you tell us when booking a consultation. This is sensitive personal data and is treated as such (section 5).
• Enquiries — the contents of contact and booking forms.
• Technical data — IP address, browser type and pages visited, used to keep the site working and secure. Administrator sign-ins and actions are logged with the originating IP address for security auditing.

3. Why we use it

• To create and maintain your account, and to sign you in.
• To process, deliver and support your orders, including refunds and returns.
• To respond to your enquiries and to arrange consultations you request.
• To send transactional messages — order confirmations, dispatch notices, password resets. These are not marketing and cannot be opted out of while you have an active order.
• To send health tips and offers, only if you have explicitly opted in. You can withdraw that at any time from your profile.
• To detect and prevent fraud and abuse, and to keep the service secure.
• To meet legal, tax and accounting obligations.

4. Who we share it with

We do not sell your personal data. We share it only with:

• Payment gateways, to take payment and issue refunds.
• Logistics partners, who receive the name, address and phone number needed to deliver your parcel — nothing more.
• Infrastructure providers who host our database, store product and article images, and send our email.
• Professional advisers and authorities, where we are required by law to disclose information.

Each of these receives only what it needs to perform its function, and is required to protect it.

5. Health information

Quiz answers and consultation notes are sensitive. They are used to give you relevant guidance and to brief the clinician you are booked with. They are not used for advertising, are not sold, and are not shared with anyone outside your care beyond what section 4 describes. You may ask us to delete them at any time.

6. How we protect it

• Traffic between your browser and our servers is encrypted in transit (HTTPS).
• Passwords are stored only as salted bcrypt hashes. We cannot read your password, and nobody at Metabulix can tell you what it is.
• Sessions use signed, httpOnly cookies that browser scripts cannot read. Changing your password signs out every other device.
• Administrative access is granted per-permission rather than wholesale, and every administrative action is recorded in an audit log.

No system is perfectly secure, but we take these measures seriously and review them as the service grows.

7. How long we keep it

Order records are retained for as long as tax and accounting law requires, typically eight years, because an invoice is a financial record we are obliged to keep. Account details are kept while your account is open. Security audit logs are kept for 180 days and then deleted automatically. Quiz answers and enquiries are kept only while they remain useful to your care, and are deleted on request.

8. Your rights

You may at any time:

• Access the personal data we hold about you, and ask for a copy.
• Correct anything inaccurate — most of it directly from your profile page.
• Ask us to delete your account and data, subject to records we must keep by law.
• Withdraw consent to marketing, without affecting the service you receive.
• Object to a particular use of your data, and ask us to explain it.

Write to us at the address below and we will respond within 30 days. We may ask you to confirm your identity first, so that nobody else can make a request in your name.

9. Cookies

We use cookies that are necessary for the site to function: keeping you signed in, remembering your cart between visits, and protecting forms from abuse. Blocking these will stop sign-in and checkout working. We do not use cookies to build advertising profiles.

10. Children

Metabulix is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service changes or the law requires. The revision date at the top always reflects the current version. Material changes will be announced on the site.