Privacy Policy

1. Introduction

This Privacy Policy explains how SankalpaSiddhi Ayupharma Private Limited ("3Tattava", "Company", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you visit www.3tattava.com, create an account, place an order, contact us, subscribe to communications, complete a wellness or performance assessment, use VaidyaConnect or otherwise interact with our website and related digital services (collectively, the "Services").

For applicable data-protection law, the Company is the entity that determines why and how your personal data is processed.

By providing personal data to us, you confirm that the information is yours or that you are authorised to provide it. Where consent is required, we will seek it through a clear affirmative action. You may withdraw consent as described below.

2. Personal data we may collect

We collect only the personal data reasonably required for the purposes stated in this Policy.

We do not intentionally request Aadhaar numbers, government identity documents, full payment credentials or unrelated medical records unless a specific lawful requirement is first explained to you.

3. How we use personal data

We may process personal data to:

• provide the Services and operate the website;
• create and administer customer accounts;
• verify, accept, process, fulfil, deliver and track orders;
• process payments, refunds, returns, replacements and invoices;
• send essential order, payment, delivery, safety, recall and service communications;
• answer enquiries and provide customer support;
• provide a requested wellness assessment, product-use guidance or VaidyaConnect interaction, without using optional health data for unrelated advertising unless you separately consent;
• investigate product-quality complaints, suspected adverse reactions, counterfeit/tampering concerns and recalls, including coordination with the licensed manufacturer, laboratory, logistics provider or regulator where necessary;
• prevent fraud, misuse, unauthorised transactions, cyber incidents and violations of our Terms;
• secure, maintain, troubleshoot, analyse and improve the website, products and customer experience;
• measure website performance and campaigns using non-essential cookies where you have made the required choice;
• send newsletters, educational content, offers and promotional communications where you have opted in or where otherwise permitted by law;
• comply with accounting, tax, product traceability, pharmacovigilance, consumer protection, legal, regulatory and law-enforcement obligations; and
• establish, exercise or defend legal claims.

We process personal data only for lawful, specified purposes, based on your consent, your request or transaction with us, voluntarily provided information needed to fulfil a stated purpose, or an applicable legal obligation or permitted use.

4. Transactional and marketing communications

Order confirmations, payment alerts, shipment updates, recall or safety notices and responses to your requests are service communications and may be sent by email, SMS, WhatsApp, telephone or another channel you provide.

Marketing communications are optional. You may unsubscribe by using the link in the message, replying with the stated opt-out instruction, changing your preferences where available or writing to care@3tattava.com. Opting out of marketing does not stop necessary service communications.

5. Cookies and similar technologies

We use cookies and similar technologies as explained in our Cookie Policy. Strictly necessary cookies may operate because they are required for security, checkout, consent choices and core website functions. Analytics, personalisation and advertising cookies operate only after the required affirmative choice. You can review or change non-essential cookie choices through the website’s Cookie Settings control.

6. How we share personal data

We do not sell or rent personal data. We may disclose only the data reasonably necessary to the following recipients:

• payment gateways, banks and payment-system participants;
• courier, warehousing, address-verification and logistics providers;
• website hosting, cloud storage, cybersecurity, analytics, customer-support, email, SMS, WhatsApp and other technology providers;
• advertising or measurement providers, but only in accordance with applicable consent choices;
• the licensed manufacturer, quality-control laboratory, testing partner, insurer or professional adviser when required to investigate a product-quality, safety, adverse-event or recall matter;
• accountants, auditors, lawyers and other advisers bound by confidentiality obligations;
• government departments, courts, regulators, licensing authorities or law-enforcement agencies where disclosure is required or permitted by law; and
• a successor or transaction counterparty in a genuine merger, restructuring, financing or transfer of business, subject to appropriate confidentiality and legal safeguards.

Our service providers are authorised to process personal data only for the contracted services or other lawful instructions and are expected to apply appropriate safeguards.

7. International processing

Some technology, cloud, analytics, communication or payment providers may process or store data outside India. Where this occurs, we will take reasonable steps to ensure that the transfer and processing comply with applicable Indian law, contractual safeguards and any restriction or direction issued by the Central Government.

8. Data retention

We retain personal data only for as long as needed for the stated purpose or as required by applicable law. The period depends on the type of record and may include:

• account data while the account remains active and for a reasonable period after closure;
• order, payment, invoice, delivery and refund records for applicable tax, accounting, consumer and legal-retention periods;
• transaction, security and processing logs for at least the minimum period required by applicable law and longer where necessary for security, fraud prevention or a legal claim;
• batch-distribution, quality complaint, adverse-event and recall records for periods required under applicable drug, quality and pharmacovigilance requirements;
• support communications until the matter is resolved and for a reasonable recordkeeping period; and
• marketing contact data until you opt out, after which limited suppression data may be retained so that we can honour the opt-out.

We may retain anonymised or aggregated information that no longer identifies you.

9. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the data, which may include encryption in transit, access controls, credential controls, logging, monitoring, backups, service-provider commitments and incident-response procedures. Payment credentials are processed through authorised third-party payment systems rather than stored by us in full.

No internet transmission or storage system is completely secure. You are responsible for keeping account credentials and one-time passwords confidential and for notifying us promptly of suspected unauthorised use.

10. Personal-data breaches

If we become aware of a personal-data breach, we will investigate, mitigate and make notifications to affected individuals and competent authorities when and in the manner required by applicable law.

11. Your choices and rights

Subject to applicable law and verification, you may request to:

• obtain information about personal data we process about you and the persons or categories with whom it has been shared;
• access a summary or copy where applicable;
• correct, complete or update inaccurate or incomplete personal data;
• erase personal data that is no longer required, subject to lawful retention and other exceptions;
• withdraw consent with ease comparable to the method used to provide it;
• opt out of marketing communications and control non-essential cookies;
• raise a grievance about our processing; and
• nominate another individual to exercise applicable data rights in the event of death or incapacity, where this right is in force and applicable.

Send a request to care@3tattava.com with the subject Privacy Request and provide the email address or mobile number associated with your interaction. We may request limited information to verify identity and prevent unauthorised disclosure. Rights are not absolute; for example, we may retain invoices, transaction, fraud, safety, complaint or legal records where required.

Withdrawal of consent does not affect processing already lawfully completed. If data is necessary to provide a requested service, withdrawing or withholding it may prevent us from providing that part of the Service.

12. Children

The website and direct purchasing facility are intended for adults aged 18 years or above. We do not knowingly create customer accounts for, target behavioural advertising to, or solicit personal data from children. A parent or lawful guardian should place any permitted order for a person below 18 only after checking the product label and obtaining appropriate professional advice.

If you believe a child has provided personal data without valid parental consent, contact us at care@3tattava.com. We will take appropriate steps consistent with applicable law.

13. Third-party sites and services

The Services may contain links to third-party websites, social networks, payment pages or communication tools. Their privacy practices are governed by their own notices. We are not responsible for a third party’s independent processing.

14. Changes to this Policy

We may update this Policy to reflect changes in law, technology or our Services. The revised version will be posted with a new "Last updated" date. Where a change materially affects an existing consent or your rights, we will provide additional notice or seek fresh consent where required.

15. Privacy contact and grievance redressal

Privacy and Grievance Officer: Dr. Kashish Gupta
Designation: Grievance Officer & Data Protection Contact
Email: care@3tattava.com
Mobile: +91 95601 49956
Postal address: SankalpaSiddhi Ayupharma Private Limited, C-17, Ground Floor, Central Market, New Seemapuri, East Delhi, Delhi – 110095, India

We will acknowledge a grievance within 48 hours and aim to resolve it as soon as reasonably possible and, in any event, within the period required by applicable law. Where a complaint falls within an applicable data-protection regime, you may pursue the remedy available under that regime after first using our grievance process.