Privacy Policy.

This is the Privacy Policy for Vyoma Group ("Vyoma," "we," "us") and the products we operate, currently Helix. We wrote it the way we'd want one written for us — in normal sentences, without the lawyer maze.

If there is ever a conflict between what this page says and what we actually do, the strictest interpretation in your favour wins. That is a promise, not a footnote.

Section 1

What we collect

We collect three categories of data, and nothing else:

Account information

When you sign in with Google, Firebase Authentication gives us: your name, email address, profile photo URL, and a unique user ID. We do not see your Google password. We do not get a calendar, contacts, or any other Google scope — only the basic profile.

Conversation content

The messages you send to Helix, the images and files you attach, and the AI responses we generate. This content is processed so we can reply to you. Chat history is stored locally in your browser (localStorage) on the device you use Helix from. We do not maintain a copy on our servers after the response is generated.

Operational metadata

Standard request data: IP address (for rate-limiting and abuse prevention), browser user-agent, approximate city/country (only if you opt in to location metadata in Settings → Privacy), and aggregated usage counts for daily limits (e.g. "5 images today"). This is not stitched into your profile or sold.

Section 2

How we use it

We use the data we collect for exactly four things:

• To answer you. Your messages are sent to our model provider (NVIDIA-hosted open-weights models routing through our API), processed, and a response is streamed back. No human at Vyoma reads your conversations.
• To enforce limits. We track daily usage counts so free-plan users get a fair, equal share of capacity.
• To improve Helix. We may use anonymised, aggregated usage patterns — for example, "X% of users hit the file-upload limit on Monday" — to prioritise features. You can opt out of this in Settings → Privacy → Help improve Helix.
• To keep Helix safe. If a request looks abusive, malicious, or violates our guidelines, we may block it.

We do not use your conversations to train models without your explicit, opt-in consent. We do not currently have an opt-in training programme.

Section 3

Where your data lives

Your data lives in three places. We want you to know all of them.

• Your browser. Chat history, your profile preferences (nickname, style choice, web-search toggle), your project list, daily usage counters, and your authentication token all live in your browser's localStorage and IndexedDB. Clearing your browser data deletes them.
• Firebase Authentication (Google Cloud). Your account record — just the basic profile fields described above — lives in Firebase, project arkaai-b3d16, hosted by Google.
• Our server. Our PHP backend, hosted on Hostinger, processes individual messages in-flight and forwards them to the model. We do not persist the content of your conversations on our server.

Section 4

How long we keep things

• Conversation content: not retained on our servers beyond the request lifecycle (typically seconds). Stored on your device until you delete it.
• Account record: for as long as your account exists. Deleting your account in Settings → Account erases the Firebase record.
• Request logs (IP, status codes): 14 days, then permanently deleted. These exist only for abuse prevention and error debugging.
• Daily usage counters: reset every 24 hours.

Section 5

Who we share with

We share data with the smallest set of vendors required to operate Helix. Each handles a specific function and is bound by their own privacy policies.

• Google (Firebase Auth): handles sign-in and token issuance.
• NVIDIA NIM API: processes message content to generate responses. We pay them; they do not retain prompts.
• Hostinger: hosts our web server and serves static assets.
• CDN providers (cdnjs, jsdelivr, Google Fonts): serve fonts, KaTeX, highlight.js, and pdf.js. They see your IP when your browser fetches those assets.

We do not sell your data to anyone. We do not run third-party advertising trackers on our products. We do not have analytics SDKs in Helix.

Section 6

Your rights

Regardless of where you live, you can do the following with your data on Helix:

• See it. Open Settings → Account to view what's tied to your profile.
• Export it. Each chat can be exported as Markdown from the chat menu. We will add a full account-export tool soon.
• Correct it. Edit your name and preferences in Settings → General.
• Delete it. Settings → Account → Delete Account erases your Firebase record and clears your local data on that device.
• Withdraw consent. Settings → Privacy contains toggles for location metadata and product-improvement signals. You can turn either off at any time.
• Object. Email support@vyomagroup.online if you want us to stop processing your data for any reason permitted by law.

If you are in the EU, UK, or California, you also have rights under the GDPR, UK GDPR, and CCPA respectively. The list above already covers them. We do not require a special form — just email us.

Section 7

Children

Helix is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect data from anyone in that age range. If you believe a child has signed up, email support@vyomagroup.online and we will delete the account.

Section 8

Security

We use industry-standard measures to protect data:

• HTTPS everywhere — the entire site is forced to TLS via our .htaccess rules.
• Authentication tokens are short-lived JWTs issued by Firebase, persisted in your browser's IndexedDB with the standard browserLocalPersistence setting. We verify them on the server against Google's public certificates on every request.
• Sensitive config files (API keys, certs) are blocked from public access at the web-server level.
• Production assets are versioned and served behind a service worker that auto-invalidates stale caches when we ship a new build.

No system is perfectly secure. If you discover a vulnerability, please report it responsibly to developer@vyomagroup.online. We will respond within 72 hours.

Section 9

International transfers

Vyoma Group is based in India. Our servers (Hostinger) are in the EU. Firebase Auth is hosted by Google in the US. NVIDIA's inference is in the US. When you use Helix, your request and your authentication token transit through these countries.

For users in the EU/UK, transfers outside the EEA rely on the EU Standard Contractual Clauses adopted by Google and NVIDIA, and on the adequacy mechanisms that apply to them. We do not transfer data to jurisdictions without an adequate level of protection.

Section 10

Changes to this policy

If we change this policy in a way that affects your rights, we will say so — in the changelog, in an in-app notice, and via email if you have an account. Material changes take effect no sooner than 14 days after notification, so you always have time to react.

Minor edits (fixing a typo, clarifying a sentence) may happen at any time. The "Effective" date at the top of this page reflects the most recent revision.

Section 11

Contact us

For anything privacy-related — questions, requests, complaints — reach us at support@vyomagroup.online.

For security issues: developer@vyomagroup.online.

For everything else: Contact Vyoma.

This website

Visit counts on our websites

To know which pages help people, vyomagroup.online, Helix (arka.vyomagroup.online and helix.vyomagroup.online) and DiaCare (diacare.vyomagroup.online) count visits with a small counter of our own. It sets no cookies, stores no IP addresses and uses no third-party analytics. We keep only anonymous daily totals — pages viewed, the site that linked to us, phone or computer, and download clicks. To count each visitor once a day, a scrambled code is made from your connection and browser with a secret that is deleted the next day, so visits can’t be linked across days or traced back to you. It never sees what you type, your chats or your health profile — only which page was opened. It does not run inside our installed apps, Vero or Vyoma Pocket.

Help center

Vyoma Help and beta testers

Vyoma Help (vyomagroup.online/help/) is where our team and beta testers report bugs. If you join as a beta tester we keep your name, email, a password (stored only as a one-way bcrypt hash), the products and device you tell us about, and what you send us: reports, comments and screenshots. We use this only to fix problems and reply to you — never for ads, and we don’t sell or share it.

Beta testers see only their own reports. Vyoma developers and admins can read reports; only admins can see email addresses. Help uses one sign-in cookie (vh_session, 7 days) and nothing else — no trackers. Data is stored on our own hosting for vyomagroup.online, outside the public website folder. To limit abuse we keep a short-lived, scrambled code of your network address for failed sign-ins and sign-ups.

You can delete your account any time in Help → Settings: your name, email and password are removed and your reports stay without your name so the fix work isn’t lost. For a copy of your data or any question, email support@vyomagroup.online. Beta terms: beta builds can be unstable, please don’t share unreleased features publicly, and we may end the beta or remove accounts that abuse it.