Privacy Policy

1. Scope and legal status

This Policy explains how M/s. NVK WELLNESS LLP, LLPIN ACR-7862, trading as MAAI (“MAAI”, “we”), processes digital personal data through https://maai.org.in, its applications, onboarding, bookings, payment, support, verification and safety operations. MAAI is the data fiduciary/controller for the purposes it determines; processors/service providers act on documented instructions for their services.

As at the Effective Date, the Information Technology Act, 2000 and applicable SPDI Rules remain relevant, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 are commencing in phases. We are implementing the substantive notice, consent, security, rights, breach and child-data controls prospectively; a statutory right or Board route applies from the date the relevant provision legally commences.

2. Information we collect

• Account and contact: Name, phone, email, profile photo, language, password/authentication events, address and emergency contacts.
• Parent/household: Guardianship/authority confirmation, service address, access notes, pets, home hazards, CCTV disclosure, preferences and support history.
• Child: Name or nickname, age/date of birth where needed, care routine, allergies, health/access needs, authorised collectors, emergency information and Booking notes supplied by the Parent.
• Professional onboarding: Date of birth/age, government ID, address, photograph, experience, training, references, qualifications, work eligibility, bank/tax information and emergency contact.
• Verification: Identity/address match results, reference responses, criminal/court or police-verification status, fraud signals and limited supporting records. No core biometric data is requested by MAAI.
• Platform-worker compliance: UAN/e-Shram or statutory identifiers and registration status where lawfully required, workdays, engagement/exit records, contribution/reporting data and benefit-support records.
• Booking and location: Requested/accepted times, approximate search location, precise service address after acceptance, check-in/out, attendance, instructions, extensions, cancellation and safety events.
• Payment and tax: Transaction ID/status, amount, refunds, invoices, bank account for payouts, limited instrument metadata, withholding and tax documents. Payment providers handle full card/UPI credentials.
• Communications and content: In-app messages, support correspondence, ratings/reviews, complaint evidence, call metadata and recordings only where disclosed/consented or lawfully needed.
• Device and usage: IP address, device/app/browser identifiers, logs, crash/security data, permissions, consent records, cookie/SDK events and interaction data.

3. How we obtain information

• Directly from you when you register, complete verification, make/accept a Booking, pay, message, review or contact support.
• From the other Booking party, for example a Parent’s care notes or a professional’s attendance record.
• From approved identity/background verification, reference, payment, maps, communications, analytics, fraud-prevention and government-interface providers.
• From public or official records where lawful and relevant to screening or legal compliance.
• Automatically from devices and use, subject to permissions and consent controls.

4. Purposes and grounds

• Create and secure accounts; authenticate users: To provide requested Platform services, act on a request before contract, and prevent misuse.
• Match, book and perform childcare: To fulfil Parent/professional requests and the Booking; process only necessary Child data supplied by an authorised adult.
• Payments, refunds, payouts, invoices and tax: To perform the transaction and comply with financial, tax and accounting law.
• Screen professionals and protect users: With notice/consent where required; to reduce fraud and child/user safety risk and meet legal duties.
• e-Shram/social-security compliance: To comply with law, register/report platform work and support applicable benefits.
• Support, complaints and disputes: To respond to you, perform obligations, preserve evidence and establish/exercise/defend legal claims.
• Safety and emergencies: To protect life/safety, report or respond to suspected offences, cooperate with authorities, and act under law.
• Service analytics and improvement: With consent where required and using aggregated/minimised data where practical; not to train public AI models on Child data.
• Marketing: Only with required consent/opt-out. We do not target advertising to Children and do not sell personal data.
• Legal and security operations: To meet law, enforce terms, audit access, investigate fraud/incidents and maintain systems.

Where the DPDP Act’s substantive processing provisions apply, processing will be based on valid consent or a permitted legitimate use, and the notice will specify the personal data and purpose. Consent is specific and informed, and withdrawal is designed to be as easy as giving it. Withdrawal does not invalidate earlier lawful processing and may prevent us from providing a feature that genuinely needs the data.

5. Child personal data

5.1 MAAI is not directed to Children for independent account use. A Parent/guardian must create the account, provide Child data and exercise privacy choices. Do not ask a Child to contact or upload data to MAAI independently.

5.2 Before processing Child data in circumstances requiring verifiable parental consent, MAAI will take reasonable technical and organisational measures to confirm the consenting adult’s identity/age and, where necessary, parent/guardian status using reliable information already available, an authorised identity/age token (including a Digital Locker service where available), or another lawful method.

5.3 We do not undertake processing likely to cause a detrimental effect on a Child’s well-being, track or behaviourally monitor Children, or direct targeted advertising to them. Booking safety/attendance information is not used to profile a Child for advertising. We minimise names, exact birth dates, photographs and health details and disclose them only on a need-to-know basis.

6. Aadhaar and identity information

MAAI will not make Aadhaar mandatory unless a specific law or government benefit process requires it. Where Aadhaar offline verification or an authorised authentication route is offered, it will be voluntary for that private verification purpose, follow a specific notice/consent, provide a lawful alternative, avoid collection of core biometrics, mask identifiers, use only authorised entities/interfaces and retain no authentication/offline data beyond necessity or law.

7. Who receives information

• Booking participants: Minimum profile, approximate/general location before acceptance, then necessary address, care, contact and attendance information to perform the Booking.
• Verification providers: Minimum professional identity/address/reference or screening information under contract and documented instructions.
• Payment/banking partners: Payer/payee, amount, transaction, refund, bank or risk information to process money and meet financial law.
• Cloud, communications, maps, analytics and support vendors: Only data needed for hosting, messages, location, security, diagnostics and support under access/security/retention controls.
• Government/benefit systems: Platform-worker or other statutory data required for registration, reporting, contributions or benefits.
• Advisers, auditors, insurers and transaction counterparties: Minimum information for legal claims, compliance, insurance or a corporate transaction, subject to confidentiality and lawful safeguards.
• Police, emergency services, courts and regulators: Where required by law, valid process, mandatory child-safety reporting, emergency or protection of rights/safety.

We require processors to use personal data only for instructed services, implement appropriate safeguards, notify incidents, support rights and delete/return data. We do not allow a processor to repurpose Child, Parent or professional data for its own advertising or model training.

8. Location and international processing

MAAI aims to keep primary regulated records in India where practical. Some approved service providers may process data in another jurisdiction. We will use contractual, security and transfer safeguards and will not transfer to a country or territory restricted by the Central Government. A Booking’s precise location is accessed only where needed for matching after your choice, service delivery, safety or support, and permission may be controlled in device settings.

9. Retention

• Account/profile and consent records: While active, then ordinarily up to 3 years for support, fraud prevention and claims; longer only for legal hold or mandatory law.
• Booking, invoice, refund, payout and tax records: For the period required by tax/accounting/payment law, ordinarily up to 8 financial years where relevant.
• Raw identity/background documents: Only until verification and quality review are complete, then deleted or strongly masked within 90 days unless law, re-verification, dispute or safety need requires longer. Results/status may be retained for the engagement plus a reasonable claims period.
• Child care notes: Visible for the active Booking/account need, then minimised or deleted; safety/incident records may be retained longer to protect the Child, comply with law and preserve claims.
• Support, grievance and safety cases: For resolution and a proportionate legal/safety period based on severity, limitation periods, regulatory duties and the Child’s interests.
• Security/access logs: At least 1 year for relevant systems where required/planned for DPDP readiness; specific cyber logs are retained for the period required by CERT-In directions.
• Marketing preferences: Until withdrawal, plus a limited suppression/consent record so the choice is honoured and evidenced.

These periods may be shortened by minimisation or extended for a legal hold, investigation, statutory direction or unresolved claim. At expiry, we delete, anonymise or irreversibly aggregate information using reasonable processes and instruct relevant processors accordingly.

10. Security and incidents

We use safeguards proportionate to risk, including encryption or masking/tokenisation where appropriate, access control, role separation, secure authentication, monitoring/logging, backups/recovery, vulnerability management, vendor contracts, employee training and periodic review. No system is perfectly secure; protect your device and report suspicious activity.

On a personal-data breach, we will contain and assess it, preserve evidence, require processor cooperation and make notifications required by the law then in force. For DPDP readiness, affected individuals will be informed without delay in concise language where required, and the Board will receive required preliminary information without delay and further particulars within 72 hours or an allowed extension.

11. Your choices and rights

• Access a summary of personal data and processing, and identities/categories of recipients, where the applicable right is in force.
• Correct inaccurate or misleading data, complete incomplete data and update changed information.
• Request erasure when data is no longer necessary and retention is not required by law, safety, fraud prevention or legal claims. You can submit an official request online via our dedicated Account & Data Deletion Request Page, or request deletion directly within the mobile app.
• Withdraw consent through the same channel or with comparable ease, stop optional marketing and manage device/cookie permissions.
• Receive grievance redressal and, when available under the DPDP framework, nominate another individual to exercise rights after death or incapacity.
• Authorised Parents/guardians may exercise relevant choices for a Child. We may verify identity/authority and will not disclose data to an unverified requester.

Send a request to the Grievance Officer. We will authenticate proportionately, explain any lawful refusal/retention and respond within the legally applicable period. A request does not require you to waive another complaint or consumer right.

12. Cookies analytics and communications

Essential cookies/SDKs support login, security and core functions. Analytics, performance or marketing technologies will be described and consented to where required. You can use the available preference controls, although disabling essential storage may prevent core functions. Service/safety messages are not marketing. You may opt out of promotional email/SMS/WhatsApp using the message control or by contacting us.

13. Matching and automated tools

MAAI may use rules or models to order available professionals, detect fraud, estimate travel, prioritise support or flag anomalies. Material factors may include availability, distance, service fit, reliability, completed training, safety restrictions and genuine ratings. Sponsored influence, if any, will be clearly labelled. Urgent temporary safeguards may be automated, but permanent adverse account action will ordinarily offer meaningful human review.

14. Changes and complaints

We may update this Policy prospectively for service, security or legal changes. We will post the new date and give prominent notice of a material change; fresh consent will be requested where the purpose changes or law requires. Previous versions may be requested.

First contact the Grievance Officer below. MAAI will acknowledge within 48 hours and aim to resolve within one month. When the relevant DPDP remedy is legally available and internal redress is exhausted, you may complain to the Data Protection Board of India through its notified process. You may also use another competent statutory forum.

Contact Information

Grievance and Nodal Officer: Ms Nehal Rajendra Saraf

M/s. NVK WELLNESS LLP, LLPIN ACR-7862

F/504, Sterling Court, Maheshwari Nagar, Chakala MIDC, Andheri (East), Mumbai – 400093, Maharashtra, India