Privacy Policy

Operated by Pharmonis Healthcare Private Limited

Website: www.skdgayurvedic.com

Effective date: 17 October 2026 | Last updated: 17 October 2026

Contents

1. Introduction and Who We Are
2. Scope and Your Consent
3. Key Definitions
4. Personal Data We Collect
5. Health-Related Information
6. How and Why We Use Your Personal Data
7. How We Collect Personal Data
8. Consent, Notice and Withdrawal of Consent
9. Cookies, Pixels and Similar Technologies
10. Who We Share Your Personal Data With
11. Payments and Card Security
12. Storage and Transfer of Data Outside India
13. How Long We Keep Your Data
14. How We Protect Your Data
15. Your Rights
16. Children's Privacy
17. Third-Party Websites and Platforms
18. Marketing Communications
19. Reviews and User Content
20. Automated Decision-Making
21. Grievance Officer
22. Complaints to the Data Protection Board of India
23. Changes to This Policy
24. Governing Law and Jurisdiction
25. Language
26. Contact Us

1. Introduction and Who We Are

This Privacy Policy explains how Pharmonis Healthcare Private Limited ("Company", "we", "us" or "our"), a private limited company incorporated under the Companies Act, 2013, which owns and operates the brand SKDG Ayurvedic and the website www.skdgayurvedic.com (the "Website"), collects, uses, stores, shares and protects your personal data when you visit the Website, place an order, contact us, or otherwise interact with us online (together, the "Services").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described in this Policy, which means we decide why and how your personal data is processed.

This Policy is published in accordance with, and should be read together with:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as and when their provisions come into force;

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");

• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent applicable;

• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020; and

• our Terms and Conditions, Shipping Policy, Refund and Return Policy, and Disclaimer published on the Website.

2. Scope and Your Consent

This Policy applies to all visitors, registered customers, guest customers and anyone who contacts us through the Website, email, phone, WhatsApp, or our social media pages. It does not apply to third-party websites, apps or services that may be linked from our Website (see Section 17).

By using the Website, creating an account, placing an order, or ticking a consent box, you confirm that you have read and understood this Policy. Where we rely on your consent, that consent will be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose. You can withdraw your consent at any time as described in Section 8. If you do not agree with this Policy, please do not use the Services.

3. Key Definitions

4. Personal Data We Collect

We collect only what is reasonably necessary for the purposes listed in Section 6. The categories are:

We do not intentionally collect your Aadhaar number, PAN, biometric data, caste, religion, political opinions, or similar information, and we ask you not to send it to us.

5. Health-Related Information

Because we sell Ayurvedic products, you may sometimes choose to tell us about your health while asking for product guidance. We treat any such information as sensitive personal data and handle it with extra care:

• Sharing health information is entirely optional. You can buy our products without giving us any health details.

• We use it only to answer your query or suggest a suitable product, and for no other purpose without your fresh consent.

• We do not use health information to target advertisements at you, and we do not share it with advertising or analytics partners.

• Access is limited to staff and qualified consultants who need it to respond to you, and who are bound by confidentiality obligations.

• Product guidance from us is general information about our products. It is not a medical diagnosis or prescription, and does not replace consultation with a registered medical practitioner. Please consult a doctor before use if you are pregnant, nursing, taking other medicines, or have a medical condition.

The fact that you have bought a particular product may by itself suggest something about your health. We therefore treat order details as confidential and share them only as described in Section 10.

6. How and Why We Use Your Personal Data

We process your personal data only for lawful purposes. Under the DPDP Act, we rely either on your consent or on certain legitimate uses permitted by Section 7 of the DPDP Act (for example, where you voluntarily provide data for a specified purpose such as placing an order, or where we must comply with a law or court order).

We will not use your personal data for any purpose that is materially different from those above without informing you and, where required, obtaining your fresh consent.

7. How We Collect Personal Data

• Directly from you: when you place an order, create an account, subscribe to our newsletter, fill in a contact form, chat with us, call us, message us on WhatsApp or social media, write a review, or take part in a promotion.

• Automatically: when you browse the Website, through cookies, pixels, tags, local storage and server logs (see Section 9).

• From third parties: from payment gateways (payment status and reference), courier partners (delivery status), Shopify (account and order records), advertising and social media platforms (campaign performance and, where you interact with our ads or pages, limited profile data in line with your settings on those platforms), and marketplaces if you buy our products there.

8. Consent, Notice and Withdrawal of Consent

Where we rely on consent, we will ask for it through a clear notice and an affirmative action, such as ticking an unticked box, clicking "Accept" on the cookie banner, or opting in to WhatsApp or email updates. Pre-ticked boxes are not used to obtain marketing consent.

You may withdraw your consent at any time, as easily as you gave it, by:

• clicking "Unsubscribe" in any marketing email;

• replying "STOP" to our SMS or WhatsApp messages, or blocking our business number;

• changing your choices in the cookie preference settings available on the Website; or

• writing to info@skdgayurvedic.com or to our Grievance Officer (Section 21).

Withdrawal does not affect the lawfulness of processing done before it. After withdrawal we will stop processing the relevant data, and will ask our Data Processors to do the same, within a reasonable time, unless we are required or permitted by law to keep it. If you withdraw consent needed to provide a service (for example, to deliver an order), we may be unable to provide that service.

Where the DPDP Rules allow, you may also manage your consent through a Consent Manager registered with the Data Protection Board of India.

9. Cookies, Pixels and Similar Technologies

Cookies are small text files placed on your device when you visit a website. We and our partners use cookies and similar technologies (such as pixels, tags, SDKs and local storage) for the purposes below.

When you first visit the Website, a cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time through the cookie settings link in the Website footer, or by clearing or blocking cookies in your browser settings. Blocking some cookies may affect how the Website works.

9.1 Analytics

We use Shopify's built-in analytics and may use Google Analytics to see aggregated information such as the number of visitors, pages viewed, traffic sources and conversion rates. Google Analytics may process your IP address and device identifiers. You can opt out of Google Analytics using the browser add-on available at tools.google.com/dlpage/gaoptout.

9.2 Advertising and Social Media

If you consent, we use the Meta Pixel, Meta Conversions API and Google advertising tags to measure how our ads perform and to show relevant ads to people who visited our Website. These tools may send information such as the pages you view, items added to cart and purchases, and, in some cases, a one-way hashed (scrambled) version of your email or phone number, to Meta Platforms or Google. These companies process this information under their own privacy policies. You can control ad personalisation in your Facebook, Instagram and Google account settings. We never share health-related information with advertising platforms.

10. Who We Share Your Personal Data With

We do not sell, rent or trade your personal data. We share it only with the following recipients, only to the extent necessary, and under written contracts or terms that require them to protect it:

Our Data Processors may process your data only on our instructions and for the purposes stated above. We remain responsible for processing carried out on our behalf.

11. Payments and Card Security

• All online payments on the Website are processed by third-party payment gateways that are authorised by the Reserve Bank of India and are compliant with the Payment Card Industry Data Security Standard (PCI-DSS).

• We do not collect or store your full card number, CVV, UPI PIN, net banking password or OTP. These are entered directly on the payment gateway's secure page.

• Any card saved for future use is stored only as a token by the card network or issuing bank in line with RBI's card-on-file tokenisation rules, never by us.

• For refunds, we share only the transaction reference with the gateway. If a refund must be made by bank transfer (for example, for a cash-on-delivery order), we will ask for your bank account details, use them only for that refund, and delete them once the refund is complete and the related records period ends.

• Never share your OTP, PIN or password with anyone, including anyone claiming to be from SKDG Ayurvedic. We will never ask for them.

12. Storage and Transfer of Data Outside India

Our online store is built on Shopify, whose servers and those of some of our other service providers are located outside India, including in Canada, the United States, Europe and other countries. By using the Services, your personal data may therefore be transferred to, stored and processed in those countries.

We transfer personal data outside India only to countries that are not restricted by the Central Government under Section 16 of the DPDP Act, and only to providers that maintain security standards at least comparable to those required under Indian law. Any data that Indian law requires to be stored in India (for example, certain payment system data under RBI directions) is stored in India by the relevant payment provider.

13. How Long We Keep Your Data

We keep personal data only for as long as needed for the purpose it was collected, or as required by law. After that, we delete it or anonymise it so that it can no longer identify you.

14. How We Protect Your Data

We implement reasonable security practices and procedures, as required by Section 43A of the IT Act, 2000, Rule 8 of the SPDI Rules and Section 8(5) of the DPDP Act, which include:

• HTTPS / TLS encryption for all pages and the checkout;

• hosting on Shopify, which is certified PCI-DSS Level 1 compliant;

• payment processing only through PCI-DSS compliant gateways;

• role-based access, strong passwords and two-factor authentication on staff accounts, and access limited to those who need it;

• confidentiality obligations for employees, consultants and service providers;

• regular review of installed apps and removal of those no longer used; and

• maintaining logs to detect, investigate and remedy unauthorised access.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. Please keep your account password confidential and log out on shared devices.

14.1 Personal Data Breach

If a personal data breach occurs, we will take immediate steps to contain it and will, as required by the DPDP Act and the DPDP Rules, 2025, inform the Data Protection Board of India and each affected Data Principal without delay, describing the nature of the breach, its likely consequences, the steps we have taken, and the steps you can take to protect yourself. Where required, we will also report cyber security incidents to CERT-In within six hours of noticing them.

15. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

How to exercise your rights: You can view and update most account information by logging in to your account on the Website. For any other request, email info@skdgayurvedic.com or the Grievance Officer with the subject line "Data Request", stating your name, the email or phone number linked to your orders, and the right you wish to exercise. We may ask you to verify your identity before acting on your request, and will not charge you a fee. We will respond within the time required by law, and in any case within 30 days of receiving a verified request.

15.1 Your Duties

Under Section 15 of the DPDP Act, while exercising your rights you must comply with applicable law, not impersonate another person, not suppress material information when providing personal data, not register a false or frivolous grievance or complaint, and provide only verifiably authentic information when asking for correction or erasure.

16. Children's Privacy

The Website and our products are intended for adults. We do not knowingly collect personal data from anyone under 18 years of age (a "child" under the DPDP Act), and we do not track, monitor behaviour of, or direct targeted advertising at children. A person under 18 may use the Website only with the involvement and verifiable consent of a parent or lawful guardian. If you believe a child has given us personal data without such consent, please contact us and we will delete it.

Some Ayurvedic products may be suitable for children. Any such product must be purchased by a parent or guardian, who is responsible for the information provided and for following the dosage and safety directions on the pack.

17. Third-Party Websites and Platforms

The Website may contain links to third-party websites, social media pages, marketplaces or payment pages. We are not responsible for the privacy practices of those websites, and this Policy does not apply to them. Please read their privacy policies before sharing your data. When you interact with our pages on Instagram, Facebook, YouTube or WhatsApp, those platforms also process your data under their own policies.

18. Marketing Communications

• We send promotional emails, SMS and WhatsApp messages only if you have opted in.

• Transactional messages (such as order confirmation, OTP, shipping and delivery updates, and service notices) are part of the service and will be sent even if you have opted out of marketing.

• SMS communications follow the Telecom Commercial Communications Customer Preference Regulations, 2018 (TRAI). If your number is registered on the National Do Not Call registry, we will send you only transactional messages or messages you have specifically consented to.

• You can opt out at any time as described in Section 8.

19. Reviews and User Content

If you post a review, rating, photo or comment on the Website or our social pages, it may be publicly visible along with your name or display name. Please do not include personal health details or contact information in public reviews. We may moderate reviews in line with the Consumer Protection rules and the Bureau of Indian Standards framework on online consumer reviews (IS 19000:2022), but we do not alter genuine reviews to change their meaning. You may ask us to remove your review at any time.

20. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our payment gateways and Shopify may use automated fraud-screening tools to flag high-risk transactions; flagged orders are reviewed by a person before any order is cancelled. Cash-on-delivery availability may depend on your PIN code and past order history (for example, repeated refused deliveries).

21. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, Rule 4 of the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, we have appointed a Grievance Officer. You may contact the Grievance Officer with any complaint, question or request regarding this Policy, the processing of your personal data, or your orders:

Timelines. We will acknowledge your complaint within 48 hours of receiving it and give you a complaint reference number. We will resolve it within one month of receipt, as required by the Consumer Protection (E-Commerce) Rules, 2020 and the SPDI Rules, or within such shorter time as may be prescribed under the DPDP Rules, 2025. Please include your name, contact details, order number (if any) and a clear description of your concern so we can help you quickly.

22. Complaints to the Data Protection Board of India

You must first contact our Grievance Officer and give us a chance to resolve your complaint. If you are not satisfied with our response, or do not receive one within the stipulated time, you may file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act and Rules. For consumer disputes, you may also approach the National Consumer Helpline (dial 1915 or visit consumerhelpline.gov.in) or the appropriate Consumer Disputes Redressal Commission.

23. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, our practices, or the services and tools we use. The updated Policy will be posted on this page with a new "Last updated" date. If the changes are significant, we will notify you by email, by a notice on the Website, or by other appropriate means, and where required by law, ask for your fresh consent. We encourage you to review this Policy periodically.

24. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to your rights under the Consumer Protection Act, 2019 to file a complaint where you reside or work, any disputes arising out of this Policy shall be subject to the exclusive jurisdiction of the courts at SAS Nagar (Mohali), Punjab.

25. Language

This Policy is published in English. If we provide a translation in Hindi, Punjabi or any other language, the English version will prevail in case of any inconsistency, to the extent permitted by law. You may request a copy of the consent notice in any language listed in the Eighth Schedule to the Constitution of India by writing to us.

26. Contact Us

For any questions about this Privacy Policy or our data practices, please contact: