This policy explains what personal data Prachyam Ayurveda collects, why, how long it is kept, and what you can require us to do with it. It is written to the Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Who is responsible for your data
Prachyam Ayurveda, 106/1, Vaidya Laxmi Shankar Trivedi Marg, P. Road, Kanpur, Uttar Pradesh 208012., is the Data Fiduciary for the data described here. GSTIN 09ABCFP3225D1ZK. You can reach us at prachyamayurveda@gmail.com or +91 9838109090.
What we collect
We separate ordinary personal data from health data, because they are handled differently and kept for different lengths of time.
Ordinary personal data
- Name, mobile number and email address.
- Delivery and billing addresses, including PIN code.
- Order history, payment status and invoice records.
- If you sign in with Google: your name, email address and Google account identifier.
- Technical data your browser sends — IP address, device and browser type, pages visited — used for security, fraud prevention and site statistics.
- Any message you send us, and our reply.
Health data
Health data is "sensitive personal data or information" under the 2011 Rules and is collected only when you choose to give it:
- Symptoms, medical history, current medication and allergies you enter when booking a consultation.
- Reports, prescriptions or photographs you upload for a consultation or a prescription-only order.
- Consultation notes and any prescription written by the treating practitioner.
- Answers you give in a self-assessment on this site.
You are never required to give health data to buy an over-the-counter product. It is needed only for a teleconsultation, and for a prescription-only medicine where the law requires a valid prescription.
Why we use it, and on what basis
| Purpose | Basis under the DPDP Act |
|---|---|
| Taking, packing, dispatching and invoicing your order | Legitimate use: data you give us voluntarily for this purpose (s.7(a)) |
| Providing a teleconsultation and issuing a prescription | Your consent, given when you book (s.6) |
| Saving your self-assessment history | Your consent, given by ticking "Save this result to my account" (s.6). Results are not saved otherwise. |
| Answering your questions and handling complaints | Legitimate use (s.7(a)) |
| Tax invoicing, GST returns and drug-licensing records | Legitimate use: compliance with law (s.7) |
| Fraud prevention and site security | Legitimate use (s.7) |
| Site statistics | Your consent, which you can decline in the cookie notice (s.6) |
| Newsletter and offers | Your separate, optional consent (s.6) |
We do not sell your personal data, we do not share it for anyone else's marketing, and we do not run third-party advertising trackers on this site. Health data is never used for marketing, advertising or profiling.
Consent, and taking it back
Marketing consent is optional and is recorded with a timestamp. You can withdraw it at any time from the unsubscribe link in any email, from your account page, or by writing to us. Withdrawing marketing consent does not affect your orders or your access to consultation records.
Withdrawing consent for health data processing means we can no longer provide a teleconsultation. Records already created must still be retained for the period the law requires (see below). Withdrawal does not affect processing that took place before it.
Health data: who can see it
Consultation notes, prescriptions and uploaded reports are visible only to you, to the registered practitioner treating you, and to our designated administrator where this is needed to verify a prescription before an order is dispatched. They are encrypted before they are stored, uploaded files are kept outside the public web root and are served only after a check that you are entitled to them, and every view, download or change is recorded in an access log. Nobody else in the organisation has access.
Children's data
Under section 9 of the DPDP Act we may not process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, and we may not track a child or serve them behavioural advertising. Accounts and consultations on this site are therefore for adults. Where a consultation concerns a child, the parent or guardian books it in their own name and gives the consent. If you believe a child has given us data directly, write to us and we will delete it.
Who else processes your data
These providers act on our instructions, only for the purpose named, under contract:
- Razorpay (payment gateway) — to take and verify payment. We never see or store your full card number; card data is handled by the gateway under RBI rules.
- Courier and logistics partners, booked through a shipping aggregator — name, address and phone number, so the parcel can be delivered.
- SMS, WhatsApp and email providers — to send sign-in codes, order updates and consultation reminders.
- Google — to verify your identity if you choose "Continue with Google", and, if you allow site statistics, Google Analytics with IP addresses shortened.
- 8x8 (Jitsi as a Service) — to carry the video of a teleconsultation. The call runs in a private room created for that consultation only, and is not recorded unless you and the practitioner agree.
- Hosting provider — servers on which the site and database run.
Where your data is stored
Our website and database run on servers operated by our hosting provider. Some of the providers above, including the video and Google services, may process data on infrastructure outside India. Where that happens, it is only for the purpose named above and only to countries not restricted by the Central Government under section 16 of the DPDP Act.
How long we keep it
- Order, invoice and GST records — eight years from the end of the relevant financial year, as required by tax law.
- Prescription and dispensing records — as required by the Drugs and Cosmetics Rules 1945 for the class of medicine concerned.
- Consultation records — three years from the consultation, per the Telemedicine Practice Guidelines 2020.
- Account and marketing data — until you close your account or withdraw consent, after which it is deleted within 30 days except where a record above must be kept.
- Self-assessment answers — kept against your account so you can see your history; deleted with the account.
- Emails and messages we send you — the content is deleted once delivered; we keep only the date, recipient and subject.
- Security logs — kept for the period required by the directions of CERT-In, then deleted.
How it is protected
Passwords are stored only as salted hashes and never in readable form; sign-in codes are stored only as hashes and expire within minutes. Administrative access requires a second factor. The site is served over HTTPS, database access uses prepared statements throughout, health records are encrypted at rest, uploaded files are checked and re-encoded before storage, and every administrative action is written to an audit log. No security measure is perfect; if a personal data breach occurs we will inform the Data Protection Board of India and each person affected, as section 8(6) of the DPDP Act requires, and tell you what we are doing about it.
Your rights
Under the DPDP Act you may:
- Access a summary of the personal data we hold about you and who we shared it with. You can download it yourself from your account page.
- Correct data that is inaccurate, and complete data that is incomplete.
- Erase data we no longer need for the purpose it was collected for, subject to the retention periods above. You can start this from your account page.
- Nominate another person to exercise these rights if you die or become incapable of exercising them yourself.
- Complain to our Grievance Officer, and afterwards to the Data Protection Board of India.
Write to us at the address in the Grievance Officer section to exercise any of these. We may ask you to confirm your identity first. We respond within 30 days.
Cookies and similar storage
- Session cookie — keeps your cart and sign-in working between pages. Strictly necessary.
- Preference keys — remember that you dismissed a notice, and whether you allowed site statistics. Strictly necessary.
- Site statistics — page views counted by this site, and Google Analytics where it is switched on. You can decline these in the cookie notice; the site works the same either way.
We do not set advertising or cross-site tracking cookies. Blocking all cookies in your browser will stop the cart and sign-in from working.
Grievance Officer
In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules 2011 and section 13 of the DPDP Act 2023:
For any grievances contact prachyamayurveda@gmail.com.
- Email: prachyamayurveda@gmail.com
- Phone: +91 9838109090
- Address: 106/1, Vaidya Laxmi Shankar Trivedi Marg, P. Road, Kanpur, Uttar Pradesh 208012.
We acknowledge every complaint within 48 hours and resolve it within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.
Changes to this policy
If we change how we use your data we will update this page and change the date below. Where the change is significant we will also tell you by email.
