Privacy Policy & Data Protection

1. Identity of the Data Fiduciary

This policy governs data collection and processing activities of Luce Vistaa Technologies Pvt. Ltd. (referred to herein as "Luce Vistaa", "we", "our", or "us"), having its primary office at Tech Hub, Bandra Kurla Complex, Mumbai, Maharashtra - 400051, India.

For all privacy inquiries, grievance redressal, or data erasure requests, our designated Grievance Officer can be contacted at: support@lucevista.com.

2. Scope and Application

This policy applies to:

• Visitors to our official website (https://lucevista.com)
• Optical store owners, optometrists, and staff submitting demo requests, academy applications, or inquiries
• Authorized users of the Luce Vistaa practice management software platform

3. Data We Collect & Minimalist Collection Principle

In accordance with the DPDP Act 2023 principle of purpose limitation, we collect only data necessary to fulfill your specific request:

• Lead and Demo Requests: Name, 10-digit Indian mobile number, email address, optical store name, city, number of store branches, current practice software, and priority requirements.
• Technical Metadata & Telemetry: Anonymized/hashed IP addresses (processed via one-way SHA-256 cryptographic hashing to eliminate plain-text IP storage), timestamp, browser user-agent header, and referral source (UTM parameters).
• Practice Data within Software: Optical customer refraction measurements (OD/OS Sphere, Cylinder, Axis, Add, PD) and eyewear invoices are stored within isolated tenant partitions strictly on behalf of the subscriber practice. Luce Vistaa acts as a Data Processor for such patient data.

4. Lawful Basis & Consent

We process personal data solely with your explicit, informed consent collected at the time of form submission. Every submission captures:

• The exact consent disclosure text displayed to you
• The precise ISO-8601 UTC timestamp of submission
• The one-way hashed IP representation of the submitting client

5. Zero Third-Party Monetization

We do not sell, rent, license, trade, or monetize your personal data or optical store records to any third party, marketing brokerage, lens supplier, or advertising network. Data is shared only with trusted infrastructure subprocessors (e.g., cloud hosting in Indian data centers, transactional email delivery) strictly bound by data confidentiality agreements.

6. Rights of the Data Principal (Your Statutory Rights)

Under Chapter III of the DPDP Act 2023, you enjoy statutory rights regarding your personal data:

To exercise your Right to Erasure, send a written request to support@lucevista.com with the subject line "DPDP Data Erasure Request". Requests are executed within 72 hours via our automated admin anonymization pipeline.

7. Security Safeguards & Retention

All communication is protected by HTTPS with TLS 1.3 and HSTS. Lead capture records are retained for a maximum duration of twenty-four (24) months from your last interaction, unless earlier erasure is requested. Database backups are kept in encrypted Indian cloud repositories.

8. Contact & Grievance Officer

In accordance with Section 10(2) of the DPDP Act 2023, the Grievance Officer for Luce Vistaa Technologies Pvt. Ltd. is: