Privacy Policy

Section 1

Overview

ONIC (Nutrition Intelligence Council), operating under the India Chamber of Business and Commerce, provides the onenutrition.ai platform for product dossier submission, AI-assisted screening, and Institutional Review Board (IRB) scientific determination.

This Privacy Policy explains what personal and business data we collect when you use our platform, why we collect it, how it is used, who it may be shared with, and what rights you hold over it.

By creating an account or submitting a product application, you agree to the practices described in this policy. If you do not agree, please do not use the platform.

Section 2

Data We Collect

We collect the following categories of data from you when you register, submit an application, or use any part of the platform:

2.1 Account and Identity Data

• Full name - Required for account creation and correspondence
• Email address - Used for account login, OTP verification, and all communications
• Mobile number - Used for OTP-based authentication
• Username and password (hashed - we never store plaintext passwords)
• Email verification status and verification timestamp

2.2 Company and Regulatory Data

• Company / Organisation name - Required for all product applications
• Corporate Identification Number (CIN) - MCA-issued 21-character company identifier
• GSTIN (GST Identification Number) - Required for commercial invoicing
• Business type and category - Manufacturer, brand owner, importer, etc.
• Registered business address and contact details

2.3 Product and Dossier Data

When you submit a product application through the OCA Product Certification form or the Product Audition form, we collect:

• Product name and brand
• Product category (supplement type, formulation type)
• Full ingredient list with quantities and forms
• Manufacturing details - facility address, batch size, processing method
• Label and packaging files - uploaded PDFs, JPGs, or images of product labels
• Certificate of Analysis (CoA) - lab test reports for raw materials and finished product
• Regulatory filings - FSSAI license, import permits, third-party test certificates
• Product claims - health claims, benefit statements submitted with the dossier
• Safety, Traceability, Origin, and Finished-product (STOF) documentation
• Additional scientific literature or clinical study references submitted by the applicant

2.4 Technical and Usage Data

• IP address - Logged on login, form submission, and file upload
• Browser and device information - User agent string, screen dimensions
• Login timestamps and session activity
• Form completion timestamps at each step of a multi-step application
• File upload records - filename, file size, upload timestamp, SHA-256 hash
• Audit log entries - all significant case state changes are logged with actor and timestamp

Section 3

How We Use Your Data

We do not use your data for advertising, profiling for marketing purposes, or sale to third parties.

Section 4

Third-Party Sharing

We share data only where necessary for the operation of the platform. We do not sell data. The parties who may receive your data:

• NutraGene (AI Processing Partner) - receives product dossier data for AI-assisted ingredient and claim screening. See Section 5 for full details.
• Institutional Review Board (IRB) members - receive a tokenised, read-only view of the case dossier and AI screening report for the purpose of issuing a Scientific Determination. IRB members access data through a secure, time-limited link and cannot download or copy the raw files.
• ONIC Coordinators - internal authorised staff who review case progression and approve forwarding to the IRB. Coordinator access is 2-factor authenticated.
• India Chamber of Business and Commerce - receives anonymised aggregate statistics (approval rates, category breakdowns) for governance reporting purposes. No individual applicant data is shared.
• Cloud infrastructure provider (AWS) - hosts the platform and stores all data. Data is stored in the Mumbai (ap-south-1) region.
• Email delivery provider - email address and case-related notification content is passed to the email service to deliver transactional emails. No bulk marketing is sent.

Section 5

NutraGene - AI Processing Partner

ONIC uses NutraGene (accessed via onic.nutrifytoday.com) as its AI screening partner. NutraGene operates as a data processor on behalf of ONIC.

What is shared with NutraGene:

• Product name and category
• Full ingredient list with quantities
• Product claims and benefit statements
• Dossier metadata (case ID, submission date)
• Your company name

What NutraGene does with this data: NutraGene runs the dossier through its AI screening system and returns a structured assessment covering ingredient safety, claim plausibility, and regulatory alignment. NutraGene does not use your product data to train general-purpose models or share it with other clients.

After screening: ONIC's platform receives the NutraGene output, strips any third-party branding, generates the ONIC-branded AI Screening Report, and then permanently deletes the case from NutraGene's system via a deletion API call.

Section 6

Security

We implement multiple layers of technical and organisational controls to protect your data:

• HTTPS everywhere - all traffic is encrypted in transit using TLS. HTTP requests are redirected to HTTPS.
• Password hashing - passwords are hashed using Django's PBKDF2-SHA256 algorithm. We never store or transmit plaintext passwords.
• OTP authentication - user accounts use one-time passcodes sent to your registered email or mobile for login verification.
• CSRF protection - all forms are protected against Cross-Site Request Forgery using Django's CSRF framework.
• Rate limiting - login attempts, OTP requests, and form submissions are rate-limited by IP address to prevent brute-force attacks.
• Token-based IRB access - ethics committee members access case data only through a tokenised, time-limited, read-only URL. The token cannot be reused after expiry.
• Webhook signature verification - all callbacks from NutraGene are verified using an HMAC signature before processing.
• Audit logging - every significant action (login, case state change, file upload, approval) is logged with actor identity, IP address, and timestamp.
• Data stored in India - all primary data is stored on AWS infrastructure in the Mumbai region (ap-south-1).

Despite these controls, no system is completely impenetrable. In the event of a data breach affecting your personal data, we will notify affected users within 72 hours of becoming aware, as required under applicable law.

Section 7

Data Retention

When retention periods expire, data is permanently deleted. Backups containing deleted data are purged within 90 days of the scheduled deletion.

Section 8

Your Rights

As a registered user of onenutrition.ai, you have the following rights regarding your personal data:

• Right to Access - You may request a copy of the personal data we hold about you and a summary of how it is used.
• Right to Correction - You may request correction of inaccurate personal data (name, email, company details). Note: product dossier data submitted for scientific review cannot be amended after IRB review has commenced, as the reviewed record must remain intact.
• Right to Deletion - You may request deletion of your account and personal data. Deletion of data tied to completed scientific reviews may be subject to legal retention obligations (Section 7).
• Right to Withdraw Consent - Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect processing already completed.
• Right to Data Portability - You may request an export of your account data and submitted dossiers in machine-readable format (JSON or PDF).
• Right to Object - You may object to processing based on legitimate interest. We will assess whether the processing can continue in light of your objection.

To exercise any of these rights, email us at the contact address in Section 12. We will respond within 30 days. We may require identity verification before processing your request.

Section 9

Cookies and Session Data

We use only the cookies necessary to operate the platform. We do not use tracking pixels, advertising cookies, or analytics SDKs that transmit data to third parties.

• Session cookie - Stores your login session. Expires when you close the browser or after 2 hours of inactivity.
• CSRF token cookie - Protects form submissions against cross-site request forgery. Required for all form submissions. Does not contain personal data.
• Coordinator session cookie - Stores coordinator 2-factor authentication state separately from the user session. Expires after 8 hours or on logout.

No third-party cookies are set by this platform. We do not use Google Analytics, Facebook Pixel, or any other third-party tracking service.

Section 10

Children's Data

This platform is designed exclusively for registered businesses and professionals in the nutraceutical industry. It is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered on this platform, please contact us immediately and we will delete the account.

Section 11

Changes to This Policy

We may update this Privacy Policy from time to time as the platform evolves or as regulatory requirements change. When we make material changes, we will notify registered users by email and update the "Last Updated" date at the top of this page.

Continued use of the platform after the effective date of a revised policy constitutes acceptance of the updated terms. If you disagree with any changes, you may close your account by contacting us.

Section 12

Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India, including the Information Technology Act 2000 and its amendments, and the Digital Personal Data Protection Act 2023. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of New Delhi, India.

ONIC operates as a programme of the India Chamber of Business and Commerce, a registered body under the laws of India.