NURV PETS — PRIVACY POLICY

Last updated: 13 September 2026 Effective date: 13 September 2026 Version: 1.0

1. Who we are

This Privacy Policy explains how Nurv Pets ("Nurv Pets", "we", "us", "our") collects, uses, stores, shares and protects your personal data.

This Policy applies to:

the website www.nurvpets.com;
the Nurv Pets mobile application on Android and iOS;
Petrimony, our pet companionship and matchmaking feature;
our Marketplace (pet food, treats, accessories, gifting and grooming products);
our Services (grooming bookings, gifting and delivery); and
Nurv Vet Connect, our veterinary telemedicine feature

(together, the "Platform").

We are the Data Fiduciary in respect of the personal data described in this Policy, as that term is defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). You are the Data Principal.

By using the Platform, you confirm you have read and understood this Policy. Where the law requires your consent, we will ask for it separately and clearly.

2. Key definitions

Term	What it means here
Personal Data	Any data about you that identifies you, whether directly or in combination with other data.
Processing	Any operation on personal data — collection, storage, use, sharing, erasure, etc.
Pet Profile	Information about your animal companion (name, species, breed, age, sex, neuter status, temperament, photos, health and vaccination details).
Petrimony Data	The subset of your Pet Profile and preference data used to suggest, display and enable matches with other pet parents.
Consultation Data	Information generated during a veterinary teleconsultation — your questions, images, the pet's clinical history, the veterinarian's notes, advice and prescriptions.
Consent Manager	A DPDP Act-registered entity through which you may give, manage, review or withdraw consent, once such entities are operational.

A note on pets and personal data: Data about an animal is not, by itself, personal data. But because Pet Profiles are linked to your account and are often displayed publicly on Petrimony, we treat Pet Profiles with the same care as your own personal data.

3. What we collect

3.1 Information you give us

Category	Examples	Where it's used
Account data	Name, mobile number, email, password (hashed), profile photo, date of birth / age confirmation, city	All services
Pet Profile data	Pet name, species, breed, age, sex, sterilisation status, weight, photos, videos, temperament notes, likes/dislikes	Petrimony, Marketplace recommendations, Vet Connect
Pet health data	Vaccination records, deworming history, allergies, medical conditions, prior diagnoses, medication, uploaded lab reports or prescriptions	Vet Connect; Petrimony health verification badges
Petrimony preferences	Match intent (playdate / companionship / walking buddy / supervised breeding where lawful), preferred breed, size, age range, radius, availability	Petrimony
Communications	Chat messages with other users, messages to our support team, reviews, ratings, community posts, reports and complaints	Safety, moderation, support
Transaction data	Orders, delivery addresses, recipient details for gifting, booking history, subscription status, invoices, returns and refunds	Marketplace, Services
Payment data	Payment method type, UPI handle, masked card details, transaction reference, bank name	Payments. We do not store full card numbers, CVV or UPI PIN. These go directly to our PCI-DSS compliant payment gateway.
Verification data	Where you opt into verification: selfie, government ID for KYC (redacted where possible), address proof for sellers/groomers/breeders, veterinary registration number for vets	Trust and safety, regulatory compliance

3.2 Information collected automatically

Device and technical data — device model, OS version, unique device identifiers, app version, mobile network, IP address, browser type, language, crash logs.
Usage data — pages and screens viewed, features used, search terms, swipes and matches on Petrimony, time spent, referral source, clicks.
Location data — approximate location from your IP by default. Precise GPS location only with your explicit permission, and only to show nearby matches, groomers, vets and delivery serviceability. You can revoke this at any time in your device settings; Petrimony will then fall back to a city-level radius you set manually.
Cookies and similar technologies — see Section 9.

3.3 Information from third parties

Social / OAuth login (Google, Apple, Facebook) — name, email, profile picture, as permitted by you at the point of login.
Payment gateways — transaction success/failure status, fraud signals.
Logistics and delivery partners — delivery status, delivery attempts, proof of delivery.
Sellers, groomers, veterinarians and service partners — service completion records, clinical notes, prescription records.
Publicly available sources and analytics providers — aggregated audience insights.

3.4 App permissions (mobile)

We request only the permissions we need, and only at the point of use:

Permission	Why
Camera	Take pet photos, upload documents, show pet live on a video teleconsultation
Photos / Storage	Upload Pet Profile images and health records
Microphone	Audio/video veterinary teleconsultations
Location	Nearby matches, groomer discovery, delivery serviceability
Notifications	Match alerts, chat messages, order and booking updates, consultation reminders
Contacts (optional)	Only if you choose to invite a friend or send a gift. We do not upload your full address book without your action and consent.

Denying a permission will only disable the feature that needs it, not the whole app.

3.5 What we do not collect

We do not knowingly collect your caste, religious belief, political affiliation, sexual orientation, biometric templates, or financial account passwords. Please do not upload such information into free-text fields, chat or pet profiles.

4. Why we process your data

We process personal data for the following purposes. Where the DPDP Act requires consent, we take it; where processing is for a "legitimate use" under Section 7 of the DPDP Act (such as complying with a legal obligation or responding to a medical emergency), we rely on that.

Purpose	What this involves
Providing the Platform	Creating and maintaining your account; showing your Pet Profile; running Petrimony matching; processing orders, bookings and gifting; enabling teleconsultations
Matching on Petrimony	Using your preferences, pet attributes, location radius and activity to suggest compatible pets and pet parents
Veterinary teleconsultation	Connecting you to a Registered Veterinary Practitioner, sharing the pet's history with them, generating records and prescriptions
Payments and fulfilment	Processing payments, refunds, invoicing, GST compliance, delivery
Safety and trust	Verifying users, detecting fraudulent or abusive behaviour, moderating content, investigating reports, blocking repeat offenders
Customer support	Answering queries, resolving complaints and grievances
Improvement and analytics	Understanding which features work, fixing bugs, testing new features, measuring match quality
Marketing and personalisation	Sending offers, recommending products suited to your pet's breed, age and dietary needs. You can opt out at any time.
Legal and regulatory	Complying with the IT Act 2000 and rules thereunder, the DPDP Act, tax law, consumer protection law, the Prevention of Cruelty to Animals Act 1960 and rules made under it, and responding to lawful requests from courts, regulators and law enforcement

We do not sell your personal data.

5. Consent, and how to withdraw it

Consent is taken through a clear, affirmative action — a tick box, a toggle, or an on-screen "I agree". It is never pre-ticked.
Our consent notice is available in English and in the languages specified in the Eighth Schedule to the Constitution of India that we support, per Section 5(3) of the DPDP Act. You can switch language at [Settings → Language].
You may withdraw consent at any time at [Settings → Privacy → Manage Consent], or by writing to privacy@nurvpets.com. Withdrawing is as easy as giving consent.
Withdrawal is prospective. It does not affect processing already lawfully done, and it does not require us to delete data we must retain under law.
Withdrawing consent for a feature may make that feature unusable. For example, withdrawing consent to share your pet's health history with a veterinarian will end your ability to use Vet Connect.
Once Consent Managers are registered and operational under the DPDP Act, you may route your consent through one.

6. Petrimony — specific privacy terms

Petrimony is a social feature. Please read this section carefully.

What is visible to other users. Your pet's name, photos, breed, age, sex, temperament, your first name (or chosen display name), your approximate location (a distance band or locality, never your exact address or GPS coordinates), and any verification badges you have earned.

What is never shown automatically. Your full name, phone number, email address, exact home address, payment details, or your pet's detailed medical records. If you choose to share any of these in chat, that is your decision and your risk.

Matching. We use automated logic to rank and suggest profiles. This is a suggestion engine, not a decision that produces legal effects on you. You can request an explanation of the broad factors used by writing to us.

Chat. Messages between matched users are stored on our servers so that the conversation persists across devices and so that we can investigate reports of abuse. Our chats are not end-to-end encrypted. Please do not treat Petrimony chat as a confidential channel.

Meeting offline. Petrimony helps you find each other. It does not vet, background-check, or guarantee the identity, honesty, health status or intentions of any other user, or the temperament, health or vaccination status of any other animal. Meeting offline is entirely at your own risk. See the Terms & Conditions for safety obligations.

Breeding. Where Petrimony is used in connection with breeding, all parties must comply with the Prevention of Cruelty to Animals Act, 1960 and the Prevention of Cruelty to Animals (Dog Breeding and Marketing) Rules, 2017, including mandatory registration of breeders with the relevant State Animal Welfare Board. We may collect and verify your breeder registration number for this purpose and may share it with authorities on lawful request.

Blocking and reporting. You can block or report any user at any time. Blocked users cannot see your profile or message you. Reported content and the associated account data are retained for investigation for up to [180] days, and longer where an investigation or legal proceeding is ongoing.

7. Nurv Vet Connect — veterinary telemedicine data

Teleconsultation data is handled with heightened care.

Consultations are conducted only by veterinarians registered with the Veterinary Council of India or a State Veterinary Council under the Indian Veterinary Council Act, 1984.
We collect your express consent before the first consultation and before sharing your pet's history with the veterinarian.
Consultation Data is accessible to: the treating veterinarian; the veterinarian's authorised clinical support staff; a small, access-logged group of our medical-operations personnel for quality audit and complaint handling; and you.
Consultation Data is not used for advertising or product targeting, and is not shared with sellers, brands or advertising partners.
We maintain consultation records, including any prescription issued, for [3] years from the date of consultation, consistent with prevailing veterinary practice standards and to support continuity of care and grievance handling.
Video and audio consultations are not recorded unless both you and the veterinarian consent on screen at the start of the call. Recording status is always displayed.
Teleconsultation is not a substitute for physical examination and is not an emergency service. If a veterinarian advises immediate in-person care, we may share the minimum necessary information with a partner clinic to help you get there quickly — this is a legitimate use under Section 7(f) of the DPDP Act (medical emergency).

8. Who we share your data with

We share personal data only as set out below, and only the minimum necessary.

a) Other users — as described in Section 6 (Petrimony).

b) Service partners acting on our instructions (Data Processors):

Partner type	What they receive
Cloud hosting and storage providers	Encrypted data at rest
Payment gateways and PSPs	Transaction and payment instrument data
Logistics and last-mile delivery partners	Recipient name, phone, delivery address, order contents
SMS, email, WhatsApp and push notification providers	Contact details and message content
Analytics and crash-reporting providers	Pseudonymised device and usage data
Customer support tooling	Ticket content and contact details
KYC and fraud-prevention providers	Verification documents and signals

All processors are bound by written contracts requiring confidentiality, purpose limitation, security safeguards and deletion on termination, as required by Section 8(2) of the DPDP Act.

c) Independent third parties:

Sellers and brands on the Marketplace — order details needed to fulfil and to handle returns.
Groomers and service providers — booking details, pet name, breed, temperament notes, and any handling instructions you provide.
Veterinarians — as described in Section 7.

d) Legal and regulatory disclosure — to courts, tribunals, law enforcement, the Data Protection Board of India, tax authorities, Animal Welfare Board of India or State Animal Welfare Boards, where required by law or a valid legal process, or where necessary to establish, exercise or defend legal claims, or to prevent imminent harm to a person or an animal.

e) Corporate transactions — in the event of a merger, acquisition, restructuring or sale of assets, subject to the acquirer being bound by protections no less protective than this Policy. You will be notified.

9. Cookies and tracking

We use cookies and SDKs for:

Strictly necessary — login sessions, security, cart persistence, fraud prevention. These cannot be switched off.
Performance and analytics — understanding usage and errors.
Functional — remembering language, city, and preferences.
Advertising and retargeting — showing you relevant offers on and off the Platform.

On your first visit we present a cookie banner allowing you to accept all, reject non-essential, or choose individually. You can change this at [Settings → Cookie Preferences] and through your browser settings. On mobile, you can reset or limit your advertising identifier through your device settings.

We honour "Do Not Track" signals where technically feasible.

10. How long we keep data

Data	Retention
Account and Pet Profile data	For as long as your account is active, then [90] days after deletion request
Petrimony chat and match history	[12] months from last activity, or until account deletion
Transaction, invoice and GST records	8 years, as required under tax and company law
Veterinary consultation records and prescriptions	[3] years from consultation
KYC and verification documents	Duration of relationship + [5] years
Safety reports, blocks and abuse investigations	[180] days, or until the investigation and any proceedings conclude
Server, security and access logs	[180] days (IT Rules, 2021)
Marketing preferences and opt-out records	Until you re-consent, so we can honour your opt-out

After these periods, data is deleted or irreversibly anonymised. Anonymised, aggregated data (for example, "37% of Golden Retrievers on the Platform are in Jaipur") is not personal data and may be retained indefinitely.

11. Security

We maintain reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000 and Section 8(5) of the DPDP Act, including:

TLS 1.2+ encryption in transit and AES-256 encryption at rest;
hashed and salted passwords;
role-based access control and the principle of least privilege;
access logging for Consultation Data and verification documents;
periodic vulnerability assessment and penetration testing;
employee confidentiality undertakings and privacy training;
an incident response plan.

No system is perfectly secure. You are responsible for keeping your password and OTPs confidential and for notifying us immediately at security@nurvpets.com if you suspect unauthorised access to your account.

Personal data breach. In the event of a breach, we will notify each affected Data Principal and the Data Protection Board of India in the form and within the timelines prescribed under the DPDP Act and the rules made under it.

12. Your rights

As a Data Principal under the DPDP Act, you have the right to:

Access — obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of Data Fiduciaries and Processors with whom it has been shared.
Correction, completion and updating — fix inaccurate or incomplete data. Most of this can be done yourself at [Settings → Profile].
Erasure — request deletion of your data where we no longer need it for the purpose it was collected and are not required by law to retain it.
Grievance redressal — raise a complaint with us and receive a response (see Section 16). You must exhaust this route before approaching the Data Protection Board.
Nominate — nominate another individual to exercise your rights in the event of your death or incapacity. Do this at [Settings → Privacy → Nomination].
Withdraw consent — as set out in Section 5.

How to exercise: use the in-app controls, or email privacy@nurvpets.com from your registered email address. We will respond within [30] days. We may ask you to verify your identity before acting, to protect your account.

Duties of a Data Principal. Under Section 15 of the DPDP Act, you must not impersonate another person when providing data, must not suppress material information, must not register a false or frivolous grievance, and must provide only authentic information when exercising the right to correction.

13. Children and minors

The Platform is intended for users aged 18 and above. Petrimony, Vet Connect and the Marketplace all require you to be an adult with the capacity to contract under the Indian Contract Act, 1872.
We do not knowingly collect personal data of children (under 18) or of persons with disabilities who have a lawful guardian, without verifiable consent from the parent or lawful guardian, as required by Section 9 of the DPDP Act.
We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
If we learn that we hold a child's data without valid parental consent, we will delete it. If you believe a minor has registered, write to privacy@nurvpets.com and we will act promptly.

14. Data location and cross-border transfers

Personal data is primarily stored on servers located in India. Some processors may store or process data outside India. Where that happens, we transfer data only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and only under contractual safeguards requiring protection equivalent to this Policy.

Veterinary Consultation Data and KYC documents are stored in India.

15. Third-party links and services

The Platform may contain links to third-party websites, seller storefronts, brand pages or payment pages. We do not control them and are not responsible for their privacy practices. Please read their policies before sharing data with them.

16. Grievance Officer and Data Protection Officer

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the DPDP Act:

Grievance Officer / Data Protection Officer Name: [Full Name] Designation: [Designation] Email: grievance@nurvpets.com Phone: +91 78910 11407 Hours: [Monday to Friday, 10:00 – 18:00 IST]

We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt. Complaints concerning non-consensual intimate imagery or impersonation will be actioned within 24 hours.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India in the manner prescribed under the DPDP Act.

17. Changes to this Policy

We may update this Policy. Material changes will be notified to you at least [7] days in advance by email, in-app notice or push notification. The "Last updated" date at the top will always reflect the current version. Continuing to use the Platform after a change takes effect means you accept the updated Policy. Where a change requires fresh consent under law, we will ask for it.

Previous versions are archived at www.nurvpets.com/privacy/archive.

18. Contact us

Nurv Pets General: support@nurvpets.com Privacy: privacy@nurvpets.com Grievances: grievance@nurvpets.com Phone: +91 78910 11407

This Privacy Policy is governed by and construed in accordance with the laws of India. Courts at Jaipur, Rajasthan shall have jurisdiction, subject to the dispute resolution clause in our Terms & Conditions.