Privacy Policy
Last updated: July 2026
Sitaram Ayurveda ("we", "our", or "us") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal and medical information when you use our consultation platform.
1. Information We Collect
We collect information you provide when you register, book consultations, or use our platform: • Personal identification: name, email address, phone number, date of birth, gender • Health information: medical history, prescriptions, consultation notes, uploaded medical records • Payment information: processed securely via Razorpay — we never store card details • Usage data: pages visited, features used, device and browser information • Communications: messages sent through our WhatsApp integration (with number masking)
2. How We Use Your Information
Your information is used solely to: • Facilitate doctor consultations and appointment bookings • Generate and deliver digital prescriptions • Send appointment reminders and health notifications • Process payments and refunds • Improve platform functionality and user experience • Comply with applicable legal and regulatory requirements
3. Medical Data & Confidentiality
Your health data is treated with the highest level of confidentiality: • All medical records, prescriptions, and clinical notes are encrypted at rest and in transit • Only you and your treating doctor can access your medical information • Consultation recordings (when consented) are stored securely on AWS S3 with restricted access • We never sell, share, or disclose your health data to third parties without your explicit consent
4. WhatsApp Number Masking
When you communicate with doctors via WhatsApp through our platform: • Your real phone number is never shared with doctors, and vice versa • We use a proxy number masking system — all messages route through a masked number • Real phone numbers are stored with field-level encryption and are never accessible from chat messages • Masking mappings expire automatically after your consultation period ends
5. Data Storage & Security
We implement industry-standard security measures: • Data encrypted in transit using SSL/TLS • Medical records stored on AWS S3 in private buckets with time-limited signed URLs • Database encrypted at rest via MongoDB Atlas • Access controls enforced by role-based authentication (RBAC) • Regular security audits and vulnerability assessments
6. Data Retention
We retain your data for the following periods: • Account data: retained while your account is active + 2 years after closure • Medical records and prescriptions: retained for 7 years per medical record-keeping requirements • Consultation recordings: accessible for 30 days, archived for 90 days, then requires admin approval for deletion • Audit logs: retained for 5 years for compliance purposes • Payment records: retained as required by financial regulations
7. Your Rights
Under applicable data protection laws, you have the right to: • Access your personal data held by us • Request correction of inaccurate information • Request deletion of non-essential data (subject to legal retention requirements) • Withdraw consent for data processing where consent is the basis • Lodge a complaint with relevant data protection authorities To exercise these rights, contact us at privacy@sitaramayurveda.com
8. Cookies
We use essential cookies only: • Authentication cookies to keep you logged in securely (httpOnly, SameSite) • Session cookies for booking flow state • We do not use third-party advertising or tracking cookies You can control cookies through your browser settings, though disabling essential cookies may affect platform functionality.
9. Third-Party Services
We use trusted third-party services: • Razorpay — payment processing (see Razorpay's privacy policy) • AWS — file storage and email delivery • WhatsApp Business API via BSP — for appointment notifications • Video platform — for conducting consultations Each service is bound by their own privacy policies and data processing agreements with us.
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes via email or a prominent notice on the platform at least 30 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.