Privacy Policy

1. Introduction

This Privacy Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023, and Rule 3(1) of the Information Technology (Intermediary Guidelines) Rules, which require the publication of the privacy policy and terms of use of a website.

This document is an electronic record generated by a computer system and does not require any physical or digital signature.

2. Who We Are

Ayurvedic Chikitsalaya is an Ayurvedic clinic and wellness centre based in Purnia, Bihar, India. We provide Ayurvedic consultations, classical and personalised Ayurvedic treatments, diagnostic and body-test services, and related wellness products and preparations.

In this policy, “we”, “us” and “our” refer to Ayurvedic Chikitsalaya. “You” and “your” refer to any person who visits our website, books an appointment, contacts us, or uses our services.

3. Information We Collect

We collect only the information we genuinely need in order to treat you, respond to you, and run our clinic lawfully. This falls into the following categories.

3.1 Information you give us directly

• Identity and contact details — full name, age, gender, mobile number and email address, provided when you book an appointment or submit an enquiry.
• Appointment details — the treatment or service you are interested in, your preferred date and time slot.
• Health information — symptoms, complaints, medical and treatment history, current medication, allergies, lifestyle details and any reports you share with us, so that a qualified practitioner can advise you correctly.
• Correspondence — the subject and content of messages you send through our contact form, by email, by phone or over WhatsApp.
• Order and delivery details — where you purchase a product or service, the items ordered and the delivery address or collection preference.

3.2 Information collected automatically

• Technical data — IP address, browser type and version, device type, operating system, and screen resolution.
• Usage data — pages viewed, time spent on pages, the link or search that brought you to our site, and the date and time of your visit.
• Server logs — standard web-server records kept for security, diagnostics and fraud prevention.

3.3 Information we do not collect

We do not collect or store your card number, CVV, card expiry date, UPI PIN, net-banking credentials or any other payment authentication data. All such details are captured directly by our payment gateway on its own secure, PCI-DSS compliant systems. See Section 7.

4. How We Use Your Information

We do not sell, rent, trade or licence your personal information to anyone for marketing or any other purpose.

5. Consent & Legal Basis

We process your personal data on the basis of the consent you give when you voluntarily submit a form, book an appointment, place an order or contact us, and where processing is necessary to provide the service you have asked for or to comply with a legal obligation.

You may withdraw your consent at any time by writing to [email protected]. Withdrawal will not affect processing already carried out, and we may be unable to continue providing certain services if the information is essential to them. Some records — such as clinical and financial records — must be retained for the periods required by law even after consent is withdrawn.

6. Health Information

Health and medical information is treated as sensitive personal data or information under Indian law, and we handle it accordingly:

• It is collected only with your knowledge and consent, and only for the purpose of diagnosis, consultation, treatment and follow-up care.
• Access is restricted to the treating practitioner and to authorised clinic staff who need it to serve you.
• Our practitioners and staff are bound by professional duties of medical confidentiality.
• It is never used for advertising, never shared for commercial purposes, and never disclosed to any third party without your explicit consent, except where disclosure is compelled by law or is necessary to protect life.
• Where we use case details for education, research or testimonials, they are fully anonymised unless you have given separate written permission.

7. Payments & Razorpay

Online payments on this website are processed through Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India, and other RBI-authorised payment partners as applicable.

• When you choose to pay online, you are taken to Razorpay's secure, encrypted payment interface. Your card, UPI, wallet or net-banking credentials are entered on Razorpay's systems, not ours.
• We never see, receive or store your full card number, CVV, PIN or banking passwords.
• We receive only the information needed to identify and reconcile your payment — your name, contact details, order reference, amount, payment status, transaction/payment ID and, at most, the last four digits and the type of the instrument used.
• Razorpay processes your payment data under its own privacy policy and its PCI-DSS Level 1 certified infrastructure. We encourage you to review Razorpay's privacy policy at razorpay.com/privacy.
• Transaction records are retained by us as required under applicable tax, accounting and anti-money-laundering law.

8. Cookies & Analytics

Our website uses a small number of cookies and similar technologies:

• Essential cookies keep your session working, remember form state and protect forms against cross-site request forgery. The site cannot function correctly without these.
• Analytics cookies, where enabled, help us understand in aggregate which pages are useful so that we can improve them. This data is statistical and does not identify you personally.

You can block or delete cookies through your browser settings at any time. Please note that blocking essential cookies may prevent appointment booking and other features from working.

We also load fonts and icon libraries from third-party content delivery networks (Google Fonts, Cloudflare/Font Awesome). These providers may receive your IP address as a technical necessity of serving those files.

9. Disclosure to Third Parties

We share your information only in the limited circumstances listed below, and only to the extent necessary:

• Payment partners — Razorpay and associated banks, to process payments, settlements, chargebacks and refunds.
• Service providers — our web hosting provider, email/SMS/WhatsApp notification services, and IT support, each of whom is permitted to use the data only to perform services for us and is bound by confidentiality obligations.
• Delivery partners — where a physical product is to be shipped, the courier receives only the name, address and phone number needed for delivery.
• Diagnostic laboratories — where you have asked us to arrange a test, only the details required to perform and report that test.
• Legal and regulatory disclosure — where required by law, court order, or a lawful request from a government or law-enforcement authority, or to establish, exercise or defend legal claims.
• Protection of life and safety — where disclosure is necessary to prevent serious harm to you or another person.

All our data is stored on servers located in India. We do not transfer your personal data outside India except where a service provider named above operates global infrastructure, in which case comparable protection is required of them.

10. Data Retention

When a retention period ends, records are securely deleted or irreversibly anonymised.

11. Data Security

We follow reasonable security practices and procedures as required under Rule 8 of the SPDI Rules, 2011, including:

• HTTPS/TLS encryption across the entire website, so information in transit is protected.
• Access control — patient and administrative records are accessible only to authorised personnel through password-protected accounts.
• Secure, access-restricted hosting infrastructure with regular software updates and patching.
• Delegation of all payment credential handling to a PCI-DSS Level 1 certified payment aggregator.
• Regular backups and periodic review of our security arrangements.

No method of transmission or storage is completely secure. While we take your data protection seriously, we cannot guarantee absolute security. If a data breach affecting your personal data occurs, we will notify you and the competent authority as required by law.

12. Your Rights & Choices

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it is processed.
• Correction — have inaccurate, incomplete or outdated data corrected or updated.
• Erasure — request deletion of your personal data where we are not required by law to retain it.
• Withdrawal of consent — withdraw consent previously given, as described in Section 5.
• Opt out of marketing — stop receiving promotional messages at any time, while continuing to receive essential service communications such as appointment confirmations.
• Grievance redressal — raise a complaint with our Grievance Officer, as described in Section 15.

To exercise any of these rights, write to [email protected] from the email address or phone number associated with your records. We may ask you to verify your identity before acting on a request, and we will respond within 30 days.

13. Children's Privacy

Our website and online booking facility are intended for adults. We do not knowingly collect personal data online from children under 18 years of age without the consent of a parent or legal guardian. Children are of course treated at our clinic, but in such cases the appointment must be booked and consent given by a parent or guardian, who is responsible for the information provided. If you believe a child has submitted information to us without such consent, contact us and we will delete it.

14. Third-Party Links

Our website may link to external websites, including our social media pages and our payment partner. This Privacy Policy applies only to ayurvedicchikitsalaya.in. We are not responsible for the content or privacy practices of any third-party site, and we encourage you to read their policies before sharing information with them.

15. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the contact details of the Grievance Officer are published below. Any complaint regarding the processing of your personal data, or regarding this website, may be addressed to:

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or the law. The revised policy takes effect from the date it is published on this page, and the “Last updated” date at the top will always show when it was last revised. Where the change is significant, we will make reasonable efforts to notify you. Please review this page periodically.

17. Contact Us

If you have any question, concern or request relating to this Privacy Policy or your personal data, please get in touch using the details below. We will be glad to help.