This policy explains what personal data Prachyam Ayurveda collects, why, how long it is kept, and what you can require us to do with it. It is written to the Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Who is responsible for your data
Prachyam Ayurveda, 106/1 , Vaidya Laxmi Shankar Trivedi Marg , P.Road , Kanpur , Uttar Pradesh - 208012 ., is the Data Fiduciary for the data described here. GSTIN 09ABCFP3225D1ZK. You can reach us at prachyamayurveda@gmail.com or +91 9838109090.
What we collect
We separate ordinary personal data from health data, because they are handled differently and kept for different lengths of time.
Ordinary personal data
- Name, mobile number and email address.
- Delivery and billing addresses, including PIN code.
- Order history, payment status and invoice records.
- Technical data your browser sends — IP address, device and browser type — used for security and fraud prevention.
- Any message you send us, and our reply.
Health data
Health data is "sensitive personal data or information" under the 2011 Rules and is collected only when you choose to give it:
- Symptoms, medical history, current medication and allergies you enter when booking a consultation.
- Reports, prescriptions or photographs you upload for a consultation.
- Consultation notes and any prescription written by the treating physician.
- Answers you give in a self-assessment on this site.
You are never required to give health data to buy a product. It is needed only for a teleconsultation, and for a prescription-only medicine where the law requires a valid prescription.
Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Taking, packing, dispatching and invoicing your order | Performance of the contract you entered into |
| Providing a teleconsultation and issuing a prescription | Your consent, given when you book |
| Answering your questions and handling complaints | Your consent / legitimate use |
| Tax invoicing, GST returns and drug-licensing records | Legal obligation |
| Fraud prevention and site security | Legitimate use under the DPDP Act |
| Newsletter and offers | Your separate, optional consent |
We do not sell your personal data, we do not share it for anyone else's marketing, and we do not run third-party advertising trackers on this site.
Consent, and taking it back
Marketing consent is optional and is recorded with a timestamp. You can withdraw it at any time from the unsubscribe link in any email, or by writing to prachyamayurveda@gmail.com. Withdrawing marketing consent does not affect your orders or your access to consultation records.
Withdrawing consent for health data processing means we can no longer provide a teleconsultation. Records already created must still be retained for the period the law requires (see below).
Health data: who can see it
Consultation notes and prescriptions are visible to you, to the registered practitioner treating you, and to the pharmacy staff who dispense a prescribed order. Uploaded files are stored outside the public web root and are served only after an ownership check. Nobody else in the organisation has routine access, and health data is never used for marketing or profiling.
Children's data
Under section 9 of the DPDP Act we may not process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, and we may not track a child or serve them behavioural advertising. Accounts and consultations on this site are therefore for adults. Where a consultation concerns a child, the parent or guardian books it in their own name and gives the consent. If you believe a child has given us data directly, write to us and we will delete it.
Who else processes your data
These providers act on our instructions and only for the purpose named:
- Payment gateway — to take and verify payment. We never see or store your full card number; card data is handled by the gateway under RBI rules.
- Courier and logistics partners — name, address and phone number, so the parcel can be delivered.
- SMS, WhatsApp and email providers — to send order updates and consultation reminders.
- Hosting provider — servers on which the site and database run.
Where your data is stored
Our servers and database are in India. Some of the providers above may process limited data on infrastructure outside India; where that happens, it is only for the purpose named above and only to countries not restricted by the Central Government under section 16 of the DPDP Act.
How long we keep it
- Order, invoice and GST records — eight years from the end of the relevant financial year, as required by tax law.
- Prescription and dispensing records — as required by the Drugs and Cosmetics Rules 1945 for the class of medicine concerned.
- Consultation records — three years from the consultation, per the Telemedicine Practice Guidelines 2020.
- Account and marketing data — until you close your account or withdraw consent, after which it is deleted within 30 days except where a record above must be kept.
- Self-assessment answers — kept against your account so you can see your history; deleted with the account.
How it is protected
Passwords are stored only as salted hashes and never in readable form. Administrative access requires a second factor. The site is served over HTTPS, database access uses prepared statements throughout, uploaded files are re-encoded before storage, and every administrative action is written to an audit log. Access to health data is limited to the people named above.
Your rights
Under the DPDP Act you may:
- Access a summary of the personal data we hold about you and who we shared it with.
- Correct data that is inaccurate, and complete data that is incomplete.
- Erase data we no longer need for the purpose it was collected for, subject to the retention periods above.
- Nominate another person to exercise these rights if you die or become incapable of exercising them yourself.
- Complain to our Grievance Officer, and afterwards to the Data Protection Board of India.
Write to prachyamayurveda@gmail.com to exercise any of these. We may ask you to confirm your identity first. We respond within 30 days.
Cookies
We set a session cookie so your cart and login survive between pages, and a small preference key so a notice you have dismissed stays dismissed. Both are strictly necessary for the site to work. We do not set advertising or cross-site tracking cookies. Blocking cookies in your browser will stop the cart and login from working.
Grievance Officer
In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules 2011 and section 13 of the DPDP Act 2023:
For any grievances contact prachyamayurveda@gmail.com.
- Email: prachyamayurveda@gmail.com
- Phone: +91 9838109090
- Address: 106/1 , Vaidya Laxmi Shankar Trivedi Marg , P.Road , Kanpur , Uttar Pradesh - 208012 .
We acknowledge every complaint within 48 hours and resolve it within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.
Changes to this policy
If we change how we use your data we will update this page and change the date below. Where the change is significant we will also tell you by email.
