Privacy Policy

The short version

• We collect what you send Myto on WhatsApp (your plan, workouts, goals and anything you tell us about how training is going) so we can coach you.
• We never sell your data and we do not use it for advertising.
• Your messages are processed by AI models from Anthropic and OpenAI to write Myto’s replies, and stored on Amazon Web Services.
• You can see, correct, export or delete your data at any time by messaging Myto or writing to us.
• Myto is for adults aged 18 and over.

Who we are

Myto (“Myto”, “we”, “us”) is operated by Myto Intelligence Labs Private Limited, a company incorporated in India. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this policy.

This policy applies to the Myto service on WhatsApp, the Myto web view for your logs and progress, and this website (https://myto.health), together the “Service”. By using the Service you agree to this policy and to our Terms of Use.

Information we collect

Information you give us

• Contact details: your WhatsApp phone number and the profile name WhatsApp shares with businesses.
• Messages and files: the text, voice notes, images and documents you send Myto, such as a coach’s PDF, a spreadsheet or a screenshot of a plan.
• Training information: your goals, training plan, workouts and sets you log, schedule, available equipment and experience.
• Health and body information you choose to share: for example soreness, injuries, sleep, energy or body weight. See Health and fitness information.
• Feedback and support requests you send us by WhatsApp or email.

Information collected automatically

• Message metadata: timestamps and delivery status provided by the WhatsApp Business Platform.
• Web view usage: when you open the Myto web view, basic technical data such as IP address, browser type and the pages you view, used to run and secure it.

What we don’t collect

We do not collect payment card details, your precise location, or your phone’s contacts. We cannot read your other WhatsApp chats.

How we use your information

We process your personal data on the basis of the consent you give when you start using Myto, and for the legitimate uses the DPDP Act allows. We use it to:

• understand your messages and reply to them;
• build, import and adapt your training plan, and explain each change;
• keep your training history so Myto remembers what you did and what changed;
• show your logs and progress in the web view;
• send you service messages you have asked for, such as session reminders;
• keep the Service safe, prevent abuse and fix problems;
• improve Myto, for example by reviewing where replies were unclear or wrong. Where possible we use de-identified or aggregated data for this;
• comply with the law and respond to lawful requests.

You can withdraw consent at any time (see Your rights). Withdrawal doesn’t affect processing that happened before it, but without it we can no longer coach you.

Health and fitness information

Training details like soreness, injuries, sleep or body weight can reveal information about your health. You decide what to share, and Myto works with whatever you choose to tell it. We use this information only to tailor your training and its explanations. We never use it for advertising, never sell it, and never use it to make medical diagnoses. Myto is not a medical service; see our health and safety terms.

How AI is used

Myto uses large language models to read your messages and draft replies and plan adjustments. To do this, the relevant parts of your conversation and training history are sent to our AI model providers, Anthropic and OpenAI, which process them on our behalf under contract. Under the commercial API terms we use, these providers do not use the content we send them to train their models.

Myto’s suggestions are recommendations, not decisions made about you: you, and your coach if you have one, stay in control of your plan. AI can make mistakes, which is why every change comes with its reason so you can check it.

Who we share it with

We share personal data only with service providers that help us run Myto (our Data Processors), and only as much as each needs:

WhatsApp is operated by Meta under its own terms and privacy policy, which also apply to your use of WhatsApp. Beyond our processors, we disclose personal data only when required by law, a court or a government authority; to protect the rights, safety or property of our users or others; or to a successor if Myto is merged or acquired, in which case this policy continues to protect your data. We do not sell or rent personal data.

Where your data is processed

Our processors may store or process data outside India, including in the United States. We transfer data only as permitted under the DPDP Act and require our processors to protect it to the standard described in this policy.

How long we keep it

We keep your data for as long as you use Myto, because your history is what lets Myto adapt your plan. If you ask us to delete your data, we delete it from our active systems within 30 days and from backups when they cycle out, except where the law requires us to keep something for longer. If you don’t use Myto for three years, we will notify you and then delete your data.

Your rights and choices

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you and how we process it;
• correct, complete or update inaccurate or incomplete data;
• erase your data and withdraw consent, after which we stop processing it;
• export your training history;
• nominate another person to exercise these rights if you die or become incapacitated;
• raise a grievance with our grievance officer and, if unresolved, with the Data Protection Board of India.

To use any of these rights, message Myto on WhatsApp (+91 63637 26725) or email pushp@myto.health. We may ask you to confirm the request from your registered WhatsApp number. We respond within 30 days.

Security

We protect your data with encryption in transit and at rest, access limited to the people who need it to run Myto, and logging of that access. Messages between you and the WhatsApp Business Platform are encrypted; because Myto has to read your messages in order to reply, they are decrypted on our side to be processed, which is different from a chat between two people. No system is completely secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

Children

Myto is only for people aged 18 and over. We do not knowingly process the personal data of children. If you believe a child is using Myto, contact us and we will delete their data.

This website and cookies

This website does not set cookies, run advertising trackers or load third-party scripts. Our hosting provider, Cloudflare, processes standard request data such as IP addresses to deliver the site and protect it from attacks. If we add privacy-friendly analytics in future, we will update this section.

Changes to this policy

We may update this policy as Myto changes or the law requires. We will change the “Last updated” date above and, for material changes, tell you on WhatsApp before they take effect.

Grievance officer and contact

If you have a question or complaint about how we handle your data, contact our grievance officer. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

Pramod GS, Grievance Officer
Myto Intelligence Labs Private Limited
5th Floor, BHive Premium, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India
Email: pramod@myto.health

For anything else, write to pushp@myto.health.