This policy explains how LIVWELL handles customer information, including meal orders and optional wellness profiles, and the choices available to you.
I. Overview
Scope and operator
K.A.D Rndima Kariyawasan, trading as LIVWELL, operates this Sri Lankan business from 03, Salawa, Kosgama, Sri Lanka and determines how personal information is used for the services described here. This policy covers the LIVWELL website, customer web app and Android and iOS applications.
App name: LIVWELL
Google Play developer display name: LIVWELL
Apple App Store developer/seller display name: LIVWELL
Privacy contact: [email protected]
Support: [email protected] / +94767019359
LIVWELL supports healthy living through the meal ordering and general wellness features offered in the service. This policy explains the information involved, why we use it, who receives it, and your choices. Information displayed on public meal pages can be viewed without entering a personal health profile.
Adults and children
LIVWELL account registration and personalised wellness features are intended for people aged 18 or over. We do not knowingly create health profiles for children. If you believe a child has supplied personal information inappropriately, contact [email protected] so that we can investigate and take appropriate action.
II. Data collections and uses
A. The data we collect
A.1 Sources and categories
We receive information you submit, information generated when you use the service, and service results from providers such as payment, authentication and fulfilment providers. The table identifies the source and purpose for each category.
| Information | Where it comes from | Main purposes |
|---|---|---|
| Name, email, telephone number, account ID and verification details | You and the verification service | Create and secure your account, verify contact details, provide support and send essential notices |
| Password hash and session or authentication tokens | Account and sign-in systems | Authenticate you, maintain sessions and prevent unauthorised access; passwords are not stored in readable form |
| Delivery address, recipient telephone number, pickup selection and delivery instructions | You and your order selections | Determine service availability, fulfil orders and contact the recipient |
| Ordered items, dates, prices, promotion use, loyalty activity and fulfilment history | Your purchases and service activity | Process purchases, handle refunds, maintain records and analyse business performance |
| Payment status, transaction reference, card brand and masked card details | Our payment provider | Confirm one-time payments, reconcile accounts and issue refunds; complete card numbers and security codes are handled by the payment provider |
| Optional height, weight, activity level, wellness goals, dietary preferences and measurement history; calculated BMI and calorie estimates | Information you choose to enter and calculations based on it | Provide personalised meal suggestions and general wellness progress features |
| Allergy information and relevant meal preparation instructions | Information you choose to provide | Identify dietary restrictions and communicate relevant preparation instructions to fulfilment staff; this does not establish that every request can be safely accommodated |
| Support messages, order issue descriptions and attachments you choose to send | Your communications with us | Investigate complaints, resolve service problems and keep a record of the outcome |
| IP address, browser or device type, operating system, app version, timestamps, authentication and security logs | Requests made to our services | Operate the service, detect abuse and investigate technical problems |
| Marketing communication preferences | Your selections in account notification settings | Apply your optional email or SMS marketing choices |
Only information needed for the relevant feature is requested. A health profile is optional for ordinary meal browsing and ordering. If you do not provide information necessary to deliver an order, take payment or authenticate an account, we may be unable to provide that particular service.
Please avoid sending identity documents, full payment card details, unrelated medical records or another person's sensitive information in support messages.
A.2 Device permissions and optional integrations
You can enter a delivery address manually. If you use the location shortcut, we request foreground device location permission and use the location you select to suggest an address or nearby service options. A confirmed delivery address or map coordinate can be saved with your order. We do not track your location in the background.
The current release does not register mobile push-notification tokens or use a third-party push-notification provider. If this changes, we will update this policy and the relevant store disclosures before enabling the service.
If you use Google sign-in, we receive the account identifier and profile information you authorise, such as your name, email and profile picture, to create or link your LIVWELL account. We do not receive your Google password or access your Gmail messages or contacts through sign-in.
If you select an image for a profile or support request, we access the particular image you choose through the system picker. We do not require access to your entire photo library. You can use ordinary support messages without attaching an image.
The permissions and integrations in this section apply only to features included in the released version. Permission prompts identify the feature requesting access. You may deny or revoke optional permissions, although the related shortcut or feature may then be unavailable.
B. How we use data
B.1 Accounts, purchases and service operations
We use the categories listed above to authenticate accounts, accept and fulfil purchases, communicate service updates, resolve support issues and maintain necessary records. Access is limited to the people and providers who need it for the task.
B.2 Optional health personalisation
We treat health measurements, allergy details and health-related preferences as sensitive. The optional health profile is separate from registration and can be skipped without preventing ordinary meal browsing or ordering. In the current release, an answer is saved when you select Save & continue or finish the profile. LIVWELL does not currently store a separate health-data consent record or the Privacy Policy version alongside those answers. We use submitted health information only for the requested personalisation and general wellness features described here, not to make a clinical diagnosis.
Relevant kitchen staff may receive allergy or dietary instructions attached to an order. Delivery and pickup staff receive only the details needed for handover and any relevant handling instructions, not your weight history or complete health profile. Cloud providers processing the data for us act under restricted service arrangements.
You can edit optional profile information through Profile > Health status. To request deletion of only the health profile while keeping the ordering account, contact [email protected]. To delete the full account, use Profile > Account > Delete account. A verified health-profile deletion request stops future personalisation based on the deleted information. You can continue using ordinary ordering features. Information independently required for an existing food safety issue, legal claim or other applicable obligation is handled under the limited retention rules below.
We do not sell personal or sensitive information. We do not use your health information for advertising, sell it to insurers or employers, or use it to train a general-purpose AI model.
B.3 Operational analysis and public information
We use order and service records to understand sales, operational performance and reliability. No optional analytics or tracking technology is enabled in the current release. Any future technology will be identified by name, purpose and retention period in our Cookie and Similar Technologies Policy, and we will request consent where required before activation. Health profile fields and allergy details are excluded from advertising and general analytics event payloads.
Your health profile and order history are not public. We do not publish identifiable testimonials, photographs or progress stories without separate permission.
B.4 Security and incident handling
We use encrypted network connections, password hashing, role-based access, restricted administrative access, session controls and security monitoring to protect information. We limit sensitive information in logs and support records. Payment card entry is handled through the payment provider's payment flow.
No system can be guaranteed completely secure. Contact [email protected] if you suspect a security problem. Where a security incident requires notification under applicable law, we will notify the relevant people and authorities as required.
C. Core automated processes
LIVWELL uses calculations and configured rules to estimate BMI and calorie needs and suggest meals based on the profile, goals, preferences and available menu. You can change the input information, decline a recommendation or use ordinary meal browsing. A suggested meal is not a medical decision or an allergy clearance.
Checkout systems calculate prices, applicable taxes, fees and discounts from the selections and offer rules displayed before purchase. Your health profile is not used to increase the price you pay.
Security controls can temporarily limit repeated sign-in or verification attempts and flag suspicious activity for review. Contact [email protected] if you believe a restriction or calculation is incorrect. We do not use a solely automated process to make clinical decisions or decisions producing legal or similarly significant effects about you.
D. Cookies and related technologies
We use necessary browser and app storage to maintain sessions, shopping carts, security and interface coordination. The Cookie and Similar Technologies Policy identifies the technologies, providers, purposes, durations and controls, including any optional analytics included in the released service. We obtain consent where required before activating optional technologies.
E. Data sharing and disclosure
We provide access only where needed for the stated purpose:
| Recipient | Information and purpose |
|---|---|
| Authorised LIVWELL customer service, operations and finance staff | The account, order, payment status or support information needed for their duties |
| Kitchens and meal preparation partners: the LIVWELL-assigned kitchen staff preparing the relevant order | Ordered items and relevant dietary or allergy instructions needed for preparation |
| Pickup and delivery providers: the LIVWELL-assigned delivery or pickup personnel handling the relevant order | Order reference, recipient contact details, address or pickup selection and handover instructions |
| Payment provider: PayHere (Private) Limited | Payment and billing information needed to process one-time purchases and refunds; its own privacy notice is https://www.payhere.lk/privacy/ |
| Hosting, database, file storage and security providers: Hostinger (application and database hosting) and Cloudinary (menu media storage and delivery) | Information stored or transmitted through the infrastructure needed to operate and protect LIVWELL |
| Email, SMS, sign-in and push services: Zoho Mail, text.lk, Google Sign-In and Sign in with Apple; no third-party push provider is enabled in the current release | Contact details, verification messages, sign-in details or device tokens needed for the selected communication or authentication function |
| Contracted technical support provider: Expendables SE Solutions | Restricted access when needed to maintain the service or investigate a specific incident |
| Professional advisers or competent authorities | Limited information required for legal advice, valid legal requests, fraud investigation or compliance obligations |
Service providers are required to safeguard information and use it for the authorised service. Some parties, including banks and payment providers, also act independently for their legal and security responsibilities. Their privacy notices explain that processing.
If a restructuring, sale or transfer of the business affects personal information, we will provide appropriate notice and apply the safeguards and choices required by law. This does not authorise the sale of sensitive information for unrelated purposes.
F. Data retention and deletion
We retain identifiable information only for the service purpose or a specific justified legal, safety or security need. The schedule below explains the normal periods; a documented legal hold can extend the particular records required, not the whole account unnecessarily.
| Record | Normal retention and deletion |
|---|---|
| Account details, saved addresses and optional profile data | While the account is active; removed from active systems within 14 days after a verified deletion request, unless a specific exception below applies |
| Optional health profile, progress measurements and related personalisation records | Until you edit them, request health-profile deletion or delete the account; removed from active systems within 14 days of the verified request |
| Order, invoice, payment and refund records | 14 days from completion of the order or closure of the related refund or dispute for ordinary support and reconciliation, unless a longer period is required for tax, accounting, payment, fraud-prevention, food-safety or another legal purpose; unnecessary health profile information is excluded |
| Food safety, complaint and dispute records | 14 days after the complaint is resolved, or for a specific applicable claim or safety obligation |
| Security and access logs | 14 days, unless identified records are needed for an active incident or legal obligation |
| Marketing contact records | Until you unsubscribe or the applicable permission expires; a limited suppression record may be kept for 14 days after the opt-out request, after which the contact is not added again without a new opt-in to respect your opt-out |
| Restricted backups | Expire within 14 days after the relevant active-system deletion; not used for ordinary service access, and deletions are reapplied if a recovery is required |
Information that has been irreversibly anonymised so it can no longer identify you may be used for aggregate reporting. Replacing your name with an identifier alone is not treated as irreversible anonymisation.
Account deletion
Request deletion in the app through Profile > Settings > Account > Delete account, or visit Account and Data Deletion without reinstalling the app. The web page provides a direct request route and explains verification, timing, deletion and any limited retention. Uninstalling the app or logging out does not delete your account.
III. Choice and transparency
Your information and privacy requests
You can ask to see, correct, export or delete information, change an optional marketing preference, request deletion of the optional health profile, or raise an objection or restriction request by contacting [email protected]. We provide the service controls described in this policy and apply statutory rights where the relevant law is in force and applies to you. Available statutory rights and exemptions depend on your jurisdiction.
We may verify your identity using proportionate information before acting. Do not email your password, OTP, full card details or identity documents unless we explain why a secure verification method is necessary. We aim to respond within 14 days, subject to any shorter applicable legal deadline. If we cannot grant a request in full, we will explain why and what options remain.
You may raise concerns with the competent data protection or consumer authority where applicable, without first using our internal process if the law allows you to do so.
Marketing and permission choices
You can choose whether to receive promotional email or SMS messages. Use the unsubscribe option, your notification preferences or [email protected] to withdraw. Essential order, security and billing communications are separate from marketing.
You can deny or revoke optional location and notification permissions through device settings. Use Profile > Health status to edit the optional health profile, contact [email protected] to request health-profile-only deletion, or use Profile > Account > Delete account to delete the full account. Closing a notice or continuing to browse is not treated as permission for optional health processing or marketing. The signup checkbox and optional profile submission are not represented as a durable, versioned server-side consent record.
IV. Legal information
A. Data controller and privacy contact
The controller for these customer services is K.A.D Rndima Kariyawasan, trading as LIVWELL, operating from 03, Salawa, Kosgama, Sri Lanka. Direct privacy requests to the designated privacy lead at [email protected]. LIVWELL has not represented this contact as a statutory Data Protection Officer; a suitably qualified officer will be appointed and published if section 20 of the Sri Lankan Personal Data Protection Act requires one.
B. Our legal bases for using your data
We process account, order and payment information to deliver services you request and perform our agreement with you. We also process relevant records to meet applicable legal obligations, protect accounts, prevent fraud, maintain food safety and resolve disputes. Where applicable law permits a legitimate-interest basis, we assess the purpose, necessity and effect on your privacy.
Optional health information is processed when you actively submit it to request the personalisation described in this policy. The current release does not represent the Terms checkbox or health-profile submission as a separate durable server-side consent record. Optional marketing follows the preference you set in account notification settings, and non-essential tracking is not enabled. Before introducing processing that legally requires separate recorded consent, LIVWELL will implement that control and obtain the required choice or will not activate the processing.
C. Legal framework for data transfers
Our primary hosting and database location is Singapore. Approved providers may also process information in Sri Lanka and the service locations used by PayHere, Google, Apple, Zoho Mail, text.lk and Cloudinary as described in their current notices for hosting, authentication, communications, payment processing, media delivery and technical support.
Where information moves across borders, we apply the contractual, technical and other safeguards required by applicable law, including provider contracts, access restrictions, encryption in transit, vendor review and any transfer instrument required by Sri Lankan law. Contact [email protected] for relevant information about these arrangements.
D. Updates to this Privacy Policy
We update this policy when our practices change. The effective date and version appear at the top. We provide additional notice of material changes. If a new activity requires separate consent, that processing will not begin until the required choice and record are available.
Privacy contact: [email protected]
Operator and postal address: K.A.D Rndima Kariyawasan, trading as LIVWELL, 03, Salawa, Kosgama, Sri Lanka
Telephone: +94767019359