Privacy Policy

Last updated: 08 July 2026 · Effective from launch

1. Who we are

This platform (ayurathma.com and its patient, doctor, and admin sub-domains) is owned and operated by 3Phala Ayurcentre Private Limited, a company incorporated under the Companies Act, 2013.

• Corporate Identity Number (CIN): U74999TN2018PTC125961
• PAN: AABCZ2925M
• Registered office: New No.19, Old No.61, 27th Street, L-Block, Anna Nagar East, Chennai - 600 102, Tamil Nadu, India
• Contact: +91 96292 97111 · ayurathma2026@gmail.com

In this policy, "we", "us", "our", and "Ayurathma" refer to 3Phala Ayurcentre Private Limited. "You" refers to the individual using the platform — whether a patient, a treating doctor, or an administrator.

2. Scope of this policy

This policy applies to personal data we process when you:

• Visit ayurathma.com or any Ayurathma sub-domain
• Register as a patient, doctor, or clinic administrator
• Book, attend, or record notes on a teleconsultation
• Pay for a consultation, medicine, or service
• Contact our support team
• Purchase Ayurvedic medicines through our sister platform Ayurkart when a prescription is issued on Ayurathma

3. Personal data we collect

3.1 Information you give us directly

• Identity: full name, gender, date of birth, government ID (for age or identity verification, only when needed)
• Contact: email address, mobile number, postal address for medicine delivery
• Health information (patients): presenting complaints, symptoms, medical history, current medications, allergies, lifestyle information, vitals you self-report, images or documents you upload (e.g. photograph of a rash, prior lab reports)
• Professional information (doctors): BAMS registration number, state medical council, qualifications, years of practice, biography, consultation fee, availability
• Payment information: we do not store your card, UPI, or bank account details. Payments are processed by Razorpay Software Private Limited. We store only the transaction reference, amount, currency, status, and (for refunds) a masked reference to the payment method

3.2 Information collected automatically

• Device type, browser, operating system, IP address (used to detect fraud and localise the site)
• Approximate location derived from IP (city-level)
• Pages you visit, links you click, features you use
• Log timestamps and error diagnostics

3.3 Information from third parties

• Verification data from professional registries when we validate a doctor's registration
• Payment status from Razorpay
• Delivery status from the courier/logistics partner when medicines are dispatched by Ayurkart

4. Why we process your data (purpose & legal basis)

Under Section 4 of the DPDP Act, 2023, we process your personal data only for a lawful purpose for which you have given consent or which is a legitimate use recognised by law. Specifically:

• To deliver the consultation you booked — contract necessity
• To let your doctor record clinical notes and issue an e-prescription — contract necessity + your consent under the Telemedicine Practice Guidelines, 2020
• To process payments and issue receipts — legal obligation (Income Tax Act, GST) and contract
• To send transactional messages (booking confirmations, magic-link sign-in, reminder before consultation, prescription delivery) — contract necessity
• To improve safety, prevent fraud, and secure the platform — legitimate use under DPDP
• To meet regulatory requirements — including the Telemedicine Practice Guidelines, the Drugs and Cosmetics Act & Rules, and the Information Technology Act
• To send marketing communication — only after your explicit opt-in, and you can withdraw at any time

5. Consent

Where our lawful basis for processing is your consent, we will ask for it clearly and in plain language before we begin processing. You can withdraw consent at any time by writing to the Grievance Officer (see Section 12). Withdrawal will not affect processing already carried out under earlier consent, and it may mean we can no longer provide the service — for example, if you withdraw consent for us to store your clinical notes, we cannot continue treating you on the platform.

6. How we share your data

We share your personal data only with the following categories of recipients, and only to the extent necessary:

• The doctor treating you — full access to the information needed for your consultation
• Ayurkart (sister brand of 3Phala Ayurcentre Pvt Ltd) — when you choose to purchase prescribed medicines, we share your prescription and delivery details with the Ayurkart fulfilment team
• Razorpay Software Private Limited — payment processing (PCI-DSS certified)
• Supabase Inc. — cloud database and authentication infrastructure, servers in India (ap-south-1, Mumbai)
• Vercel Inc. — web application hosting, edge network
• Resend Inc. — transactional email delivery
• Government authorities — where we are required to disclose data by a lawful order under the Information Technology Act, the Code of Criminal Procedure, the Income Tax Act, or a valid regulator instruction

We do not sell your personal data. We do not share your health data with advertisers, insurers, or data brokers.

7. Cross-border transfers

Most of our data is processed and stored on servers located in India (Mumbai region). Some vendors — Resend (transactional email, USA), Vercel (edge cache, global) — may process limited data outside India. Where we do transfer data outside India, we do so only to countries that are not restricted under Section 16(1) of the DPDP Act and under contractual safeguards.

8. How long we keep your data

• Consultation records & prescriptions: retained for at least 3 years after the consultation, as required by the Telemedicine Practice Guidelines, 2020. We may retain them longer where medically prudent or legally required
• Payment records & tax invoices: retained for 8 years to comply with the Income Tax Act and GST law
• Account information (name, email, phone): retained while your account is active and for 3 years after last consultation, then deleted or de-identified
• Support communications: 3 years
• Marketing consent records: 2 years after withdrawal
• System logs: 180 days

9. Your rights under the DPDP Act

You have the following rights over your personal data. To exercise any of them, write to the Grievance Officer at the address in Section 12.

• Right to information — a summary of the personal data we process about you and how
• Right to correction & erasure — correct inaccurate data, or ask us to erase data we no longer need (subject to legal retention obligations)
• Right of grievance redressal — see Section 12
• Right to nominate — nominate another person to exercise your rights in the event of your death or incapacity

We will respond to any request within 7 working days and will resolve grievances within 30 days as required by the DPDP Act.

10. Children's data

Ayurathma does not knowingly process personal data of children under 18 without verifiable parental or lawful guardian consent. A parent or guardian may book and attend consultations on behalf of a minor. In such cases, the parent or guardian is the data principal for the account, and health information belongs to the child.

11. How we protect your data

• All traffic is served over HTTPS with modern TLS
• Databases enforce row-level security so a doctor sees only their patients, a patient sees only their own records, and administrators access only what their role permits
• Authentication uses one-time magic links; we do not store passwords
• Payment card data is never touched by our servers — Razorpay handles it under PCI-DSS
• We keep audit logs of every clinical action and every administrative action
• Backups are encrypted and stored in the same jurisdiction as the primary database

No system is perfectly secure. If we ever suffer a personal data breach that affects you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

12. Grievance Officer

As required by the Information Technology Rules, 2011 and the DPDP Act, 2023, we have appointed a Grievance Officer. You can reach the Grievance Officer for any question about this policy, to exercise your DPDP rights, or to lodge a complaint:

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it has been constituted, or, in appropriate cases, approach the courts at Chennai.

13. Cookies

Ayurathma uses only essential cookies required to keep you signed in and to route requests to the correct server. We do not use third-party advertising cookies or trackers.

14. Changes to this policy

We may update this policy from time to time to reflect changes in the platform or in the law. When we do, we will update the "Last updated" date at the top of this page. Material changes will be highlighted through an in-product notice or email.

15. Governing law

This Privacy Policy is governed by the laws of India. The courts at Chennai, Tamil Nadu shall have exclusive jurisdiction over any dispute arising from it.