Privacy Policy · GEN YO-GEE

1. Introduction

YO-GEE ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our services.

We operate across multiple markets including New Zealand, India, and the UAE, and comply with applicable privacy legislation in each jurisdiction, including the New Zealand Privacy Act 2020, the India Digital Personal Data Protection Act 2023, and UAE data protection regulations.

2. Information We Collect

Information you provide to us:

Account information: Name, email address, and password when you create an account.
Wellness quiz responses: Health-related information including body metrics, lifestyle habits, health goals, dietary preferences, and current supplement use. This data is used solely to provide personalized Ayurvedic wellness insights.
Quiz access verification: Email address used for OTP verification to access the wellness quiz. If you opt in, this email may also be used for wellness newsletters.
Newsletter subscription: Email address, collected only with your explicit consent (opt-in checkbox). You can unsubscribe at any time by emailing hello@genyogee.nz or replying to any newsletter.
Contact information: Any information you provide when contacting us.

Information collected automatically:

Usage data: Pages visited, time spent, browser type, and device information.
Campaign tracking: When you scan a QR code or follow a marketing link, we collect campaign parameters (source, medium, campaign name) to understand how you found us. These are stored alongside your quiz access record.
Cookies & local storage: We use essential cookies for website functionality, and — only with your consent — Google Analytics and Google Ads cookies to understand how our website is used, to measure which advertisements lead to an order, and to show our advertisements to you rather than to everyone. That last use, and how to stop it, is set out under Advertising audiences in section 5. We also use browser local storage to remember your quiz access verification and cookie consent preferences.

3. How We Use Your Information

We use your personal information to:

Provide personalized Ayurvedic wellness insights based on your quiz responses.
Create and manage your account.
Send you wellness tips, educational content, and updates (with your consent).
Measure which advertisements lead to an order, and show our advertisements to you and to people with similar interests (with your consent — see section 5).
Maintain and develop our website and services.
Comply with legal obligations.

4. Health Information & Sensitive Data

We take the privacy of health-related information seriously. The wellness quiz may collect information about your body metrics, lifestyle habits, dietary preferences, current supplements and dosages, health conditions, and allergies. Under India's Digital Personal Data Protection Act 2023, this constitutes sensitive personal data requiring additional safeguards.

Your wellness quiz responses are:

Used only to generate your personalized dosha profile and educational wellness insights.
Stored securely with encryption in transit (HTTPS/TLS) and access controls.
Never sold to third parties.
Never used for advertising targeting.
Never shared with insurance companies, employers, or data brokers.
Accessible only to you through your account or email verification.

Important: Quiz results are for educational purposes only and do not constitute medical advice, diagnosis, or treatment. If you have health conditions, allergies, or take medications, consult a qualified healthcare provider before acting on any wellness suggestions.

5. Data Sharing & Third-Party Services

We do not sell your personal information. We may share limited data with the following service providers to operate our platform:

Payment processors: Stripe (NZ/UAE) or Razorpay (India) receive your order amount and email to process payments. Card details are handled directly by these providers and never stored on our servers.
Transactional email — Resend: sends verification codes, password resets and order confirmations. Only your email address and the message content are shared.
Newsletter — Klaviyo: if you opt in, your email, dosha and persona/age band are shared so we can send a Journal matched to you. You can unsubscribe at any time.
AI chatbot: Our educational wellness chatbot is powered by Anthropic's Claude AI. When you use the chatbot, your messages and your dosha type (if available) are sent to Anthropic's servers for processing. Your name, email, health conditions, and medications are never sent to the chatbot service.
Analytics: Google Analytics (consent-gated) collects anonymised usage data. No personally identifiable information is sent to Google.
Advertising measurement: Google Ads (consent-gated) records that an order was completed, along with the order number, amount and currency, so we can tell which advertisements are worth running. If you have accepted cookies, we also send a hashed version of your email address — an irreversible SHA-256 fingerprint, never the address itself — so Google can tell that an order came from someone who clicked an advertisement, without us sharing who you are. For this measurement purpose Google matches the fingerprint to an ad click and then discards it; the separate advertising-audience use described in the next bullet is the one case where a fingerprint is retained. If you decline cookies, none of this is sent. Your name, postal address, phone number, and health or quiz information are never sent to Google Ads.
Advertising audiences (Google Customer Match): we share a hashed version of your email address — the same irreversible SHA-256 fingerprint described above, never the address itself — so that Google can recognise you as an existing customer and show you our advertisements, and can show our advertisements to people whose interests resemble our customers'. This is a different purpose from measurement above and it works differently: instead of matching once and discarding, Google holds the fingerprint in an audience list for as long as we keep that list current, and applies its own expiry to membership. We include only people who have placed an order or accepted marketing. We never include your quiz responses, dosha results, health conditions, medications or allergies, and we never include your name, postal address or phone number — the boundary in section 4 holds here. To be left out, email hello@genyogee.nz and we will remove you; it changes nothing about your order, your account, or anything else you receive from us.
Google Customer Reviews: after you place an order you are invited to opt in to a review survey. If you accept, we send Google your order number, email address, delivery country and the estimated delivery date, and Google emails you a survey once your order should have arrived. Opting in is your choice and declining changes nothing about your order. Your name, address, health information and quiz results are never shared for this purpose, and your review is about the purchase, not about you.
Error monitoring: We use Sentry for error tracking. Personal data is scrubbed from error reports before transmission.
Media hosting: Uploaded images (avatars) may be stored on cloud services. No health data is included in uploaded files.
Legal requirements: When required by law, court order, or governmental authority.

5a. Data Residency

We are committed to keeping your data in your region wherever possible. Each market (New Zealand, India, UAE) is served by infrastructure located in or near that region. Sensitive health data from your quiz is stored in the database serving your market and is not transferred between markets.

Some third-party services (payment processors, email delivery, AI chatbot, and Google's advertising and review services) process data outside New Zealand, including in the United States. Where we disclose personal information to a service overseas, we rely on that provider's contractual and technical safeguards being comparable to the protections required by the New Zealand Privacy Act 2020, and we minimise what is shared — for advertising, that means a hashed email fingerprint and nothing that identifies you directly. We do not send your health conditions, medications, or allergy information to any overseas service.

6. Data Retention

We retain different types of data for different periods:

Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
Quiz results: Retained for 24 months to allow you to revisit your wellness profile, then automatically anonymised.
Quiz access verification (OTP): Email address and verification records are retained for 12 months for security and analytics purposes.
Newsletter subscriptions: Retained until you unsubscribe. To unsubscribe, email hello@genyogee.nz or reply to any newsletter email.
Order data: Retained for 7 years as required by tax and accounting regulations in New Zealand and India.
Advertising audiences: the hashed email held in a Google Customer Match list is refreshed while you remain a customer, and is removed when you ask to be left out, when you delete your account, or when we retire the list. Google applies its own expiry to audience membership independently of this.

You may request deletion of your personal data at any time by emailing hello@genyogee.nz. We will respond within 30 days.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your personal information.
Withdraw consent for marketing communications.
Ask to be excluded from advertising audiences, without affecting your order or account (see section 5).
Lodge a complaint with your local data protection authority.

8. Security

We implement appropriate technical and organizational measures to protect your personal information, including:

All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
Authentication uses industry-standard JWT tokens with automatic expiration.
Personally identifiable information is masked in analytics exports and server logs.
Error reports sent to monitoring services have personal data automatically scrubbed.
Staff access to analytics dashboards requires verified admin authentication.
Rate limiting protects against brute-force attacks on authentication endpoints.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website with a new "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Email: hello@genyogee.nz
Website: genyogee.nz