GDPR Compliance Policy

1. Introduction and Scope

This General Data Protection Regulation (GDPR) Compliance Policy applies to KSHITI Ayurveda, located in Coimbatore, Tamil Nadu, India, and governs the processing of personal data of users, including those located in the European Union (EU) and European Economic Area (EEA), who access or use:

• The website: www.kshitiayurveda.com and all its subdomains
• Our healthcare services, including:
• Doctor Consultation (Online, Offline, Chat, Audio, and Video Consultation)
• Treatments and Procedures
• Ayurveda Medicines and related services

This policy explains how we collect, use, store, share, and protect personal data, and describes the rights of data subjects under the GDPR.

2. Data Controller and Contact Information

Data Controller:

KSHITI Ayurveda

Coimbatore, Tamil Nadu, India

Contact Details:

• Phone: +91 95978 51971
• Email: hi@kshitiayurveda.com
• Website: www.kshitiayurveda.com

For any questions, requests, or concerns related to personal data or this GDPR policy, users may contact us at hi@kshitiayurveda.com.

If KSHITI Ayurveda appoints a Data Protection Officer (DPO) in the future, the DPO’s contact details will be added to this policy and made available on our website.

3. Lawful Basis for Processing Personal Data

KSHITI Ayurveda processes personal data only where there is a valid legal basis under the GDPR, which may include:

1. Consent

• When users voluntarily provide data (for example, through forms, account registration, newsletter signup, or explicit consent checkboxes).
• For certain health-related data, explicit consent will be collected where required.

1. Contractual Necessity

• To provide healthcare services, process bookings/appointments, dispense Ayurveda medicines, and manage patient records as part of a treatment or consultation agreement.

1. Legal Obligations

• To comply with applicable laws and regulations (for example, medical record-keeping requirements, tax obligations, or regulatory reporting).

1. Legitimate Interests

• To improve services, respond to queries, enhance user experience on the website, ensure network and information security, and prevent fraud or misuse—provided these interests are not overridden by users’ rights and freedoms.

Users may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.

4. Types of Personal Data Collected

Depending on how users interact with KSHITI Ayurveda (website, consultations, purchases, or communications), we may collect the following categories of data:

1. Identity and Contact Data

• Name, age, gender
• Phone number, email address
• Postal address or location information (where required for service delivery or prescriptions)

1. Health and Medical Data (Special Category Data)

• Medical history, symptoms, diagnosis, prescriptions
• Treatment plans and progress notes
• Lifestyle information relevant to Ayurveda treatment (diet, habits, routine)
• Consultation notes from online/offline, chat, audio, and video consultations

1. Technical and Usage Data

• IP address, device identifiers, browser type, operating system
• Access times, pages viewed, referring URL
• Interaction data with website features and subdomains

1. Transaction and Financial Data

• Billing information (such as transaction IDs, partial payment details processed through third‑party payment gateways)
• Purchase history for Ayurveda medicines, treatments, or consultations

1. Communication Data

• Emails, chat messages, call logs, and other communications with KSHITI Ayurveda
• Feedback or reviews provided voluntarily by users

We will process health-related data with heightened care, in alignment with GDPR requirements for special category data and only for legitimate healthcare purposes.

5. Purposes of Data Processing

KSHITI Ayurveda processes personal data for the following purposes:

• Provision of Healthcare Services
• Scheduling and managing consultations (online/offline/chat/audio/video)
• Creating and maintaining patient records
• Providing diagnosis, treatment, and follow-up care
• Dispensing or recommending Ayurveda medicines and therapies
• Customer Support and Communication
• Responding to inquiries via phone, email, or website forms
• Sending important service-related notifications (appointment confirmations, reminders, prescription updates)
• Website Operation and Improvement
• Operating and maintaining www.kshitiayurveda.com and its subdomains
• Analyzing usage to improve content, user experience, and security
• Legal, Regulatory, and Security Purposes
• Complying with applicable healthcare, tax, and regulatory obligations
• Detecting and preventing fraud, misuse, or security incidents
• Marketing and Information (where permitted)
• Sending updates about services, wellness tips, or Ayurveda-related content, based on consent or legitimate interest and with clear opt-out mechanisms.

6. User Rights Under GDPR

Data subjects in the EU/EEA have the following rights under the GDPR, subject to applicable limitations and local law:

1. Right of Access

• To obtain confirmation whether we process their personal data and to access that data.

1. Right to Rectification

• To request correction of inaccurate or incomplete personal data.

1. Right to Erasure (“Right to be Forgotten”)

• To request deletion of personal data where there is no longer a legal basis to retain it, subject to mandatory retention obligations (e.g., medical records).

1. Right to Restriction of Processing

• To request that we limit the processing of personal data under certain circumstances.

1. Right to Data Portability

• To receive personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible and legally permitted.

1. Right to Object

• To object to processing based on legitimate interests or for direct marketing purposes.

1. Right to Withdraw Consent

• Where processing is based on consent, users may withdraw consent at any time without affecting prior lawful processing.

To exercise these rights, users may contact us at hi@kshitiayurveda.com. We may need to verify identity before fulfilling requests.

7. Data Retention Policy

KSHITI Ayurveda will retain personal data only for as long as necessary to:

• Fulfill the purposes for which it was collected (e.g., providing healthcare services, maintaining treatment records)
• Comply with legal, regulatory, and professional obligations (including mandatory medical record retention periods)
• Resolve disputes and enforce agreements

After the applicable retention period has expired, personal data will be securely deleted, anonymized, or otherwise rendered unusable in accordance with our internal policies and applicable law.

8. Data Security Measures

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Such measures may include:

• Encryption of data in transit and/or at rest where appropriate
• Access controls and authentication mechanisms restricting access to authorized personnel only
• Secure data storage and backup practices
• Regular monitoring, logging, and review of access
• Staff training and confidentiality obligations for personnel handling personal data

While we strive to protect user data, no system can be fully secure. Users are encouraged to use strong, unique credentials and exercise caution when sharing sensitive information online.

9. International Data Transfers

As KSHITI Ayurveda is based in India, personal data (including that of EU/EEA users) may be processed or stored outside the EU/EEA. Where such transfers occur, we will:

• Use appropriate safeguards in line with GDPR requirements (for example, Standard Contractual Clauses (SCCs) or equivalent mechanisms), where applicable; and
• Ensure that recipients of personal data provide an adequate level of data protection consistent with this policy and applicable law.

10. Third‑Party Service Providers

KSHITI Ayurveda may engage carefully selected third‑party service providers to support its operations, which may include:

• Hosting and infrastructure providers
• Communication platforms (email, SMS, telemedicine tools)
• Payment service providers
• Analytics, security, or IT support services

These third parties will only process personal data on our documented instructions, are bound by confidentiality and data protection obligations, and must implement appropriate security measures. They are not permitted to use personal data for their own purposes.

11. Cookies and Tracking Technologies

Our website www.kshitiayurveda.com and its subdomains may use cookies and similar technologies to:

• Enable essential site functionality
• Remember user preferences
• Analyze site traffic and usage patterns

Where required by law, we will seek consent for non-essential cookies and provide options to manage cookie preferences. Detailed information about the types of cookies used and how to control them will be provided in a separate Cookie Policy or on the website interface.

12. Children’s Data

Our services may be used for the treatment of minors under the care and consent of parents or legal guardians. In such cases:

• We will collect and process the child’s data only as necessary for healthcare purposes and in compliance with applicable laws.
• Consent will be obtained from the parent or legal guardian as required.

We do not knowingly allow children to independently create accounts or provide personal data without verifiable parental or guardian consent, where such requirements apply.

13. Complaints and Dispute Resolution

Users who have concerns about how KSHITI Ayurveda handles their personal data are encouraged to contact us first at:

• Email: hi@kshitiayurveda.com
• Phone: +91 95978 51971

EU/EEA data subjects also have the right to lodge a complaint with their local Data Protection Authority (DPA) if they believe their rights under GDPR have been violated. Contact details of national DPAs are generally available on official EU websites.

14. Changes to This Policy and Governing Law

KSHITI Ayurveda may update this GDPR Compliance Policy from time to time to reflect changes in legal requirements, our practices, or services. When changes are made:

• The updated version will be posted on www.kshitiayurveda.com
• The “last updated” date will be revised accordingly
• Where required, we will notify users of material changes via appropriate channels (website notice, email, etc.)

For EU/EEA data subjects, this policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 (GDPR). For users outside the EU/EEA, local laws may also apply in addition to this policy.