Privacy Policy

1. Personal data we collect

We collect only the data we need to serve you well. Depending on how you interact with us, this may include:

• Identity and contact details — your name, mobile number, and email address.
• Profile details — date of birth and gender, where you choose to share them, so we can offer birthday rewards and appropriate services.
• Booking and service history — the appointments you make, services availed, staff preferences, notes relevant to your treatments, and attendance.
• Billing details — invoices, amounts, payment method used (cash, UPI, or card), loyalty (gems) balance, and membership records. We do not store full card numbers; payments are taken at our counter.
• Technical and usage data — limited information such as device and browser type and pages viewed, collected through cookies only where you have consented.

2. Why we use your data

We use your personal data to:

• create and manage your account and bookings;
• confirm, remind, reschedule, or cancel appointments and send service-related notifications;
• generate GST-compliant invoices and process payments at the counter;
• operate our loyalty (gems) programme and SPA memberships;
• respond to your enquiries and provide customer support; and
• send you offers, birthday wishes, and marketing communications, but only where you have given consent.

3. Lawful basis and consent

Under the DPDP Act, we process your personal data on the basis of your consent, which is sought at the point of collection (for example, during onboarding or booking), and for certain legitimate uses such as fulfilling a service you have requested. Where processing relies on consent, that consent is free, specific, informed, and unambiguous, and you may withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and some processing necessary to provide a service or to meet a legal obligation may continue.

4. Cookies

Our website uses a two-tier cookie approach. Strictly necessary cookies are always active because the site cannot function without them (for example, to keep you signed in and to remember your cookie choice). Analytics and marketing cookies are optional and load only after you opt in through our cookie banner. You can change your choice at any time using the "Cookie Preferences" link in our website footer. If you reject non-essential cookies, no analytics or marketing trackers are loaded.

5. How long we keep your data

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, including to provide our services, maintain your booking and billing history, and comply with legal, accounting, and tax obligations (such as retaining invoices for the period required under Indian tax law). When data is no longer required, we erase it or anonymise it.

6. Your rights as a data principal

The DPDP Act gives you the following rights in respect of your personal data:

• Right to access — to obtain a summary of the personal data we hold about you and how we process it.
• Right to correction — to ask us to correct inaccurate or update incomplete data.
• Right to erasure — to ask us to delete personal data that is no longer needed for the purpose it was collected, subject to our legal retention duties.
• Right to withdraw consent — to withdraw consent at any time, as easily as it was given.
• Right to grievance redressal — to raise a complaint with us, and to nominate another person to exercise your rights in the event of death or incapacity.

To exercise any of these rights, contact us using the details in the "Grievances and contact" section below. We may need to verify your identity before acting on a request.

7. Sharing and third-party processors

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf and under contract, including:

• payment handling at our counter (cash, UPI, and card terminals) — we do not retain full card details;
• email and notification providers used to send confirmations and reminders;
• website hosting and analytics providers, where analytics cookies have been consented to.

We require all processors to protect your data and to use it only for the purposes we specify.

8. How we protect your data

We apply reasonable security safeguards to protect your personal data against unauthorised access, disclosure, alteration, or loss. These include access controls, encrypted connections, and limiting access to staff who need it to do their work. No method of transmission or storage is completely secure, but we take our responsibilities seriously and review our safeguards regularly.

9. Children's data

Our services are intended for adults. Where a booking is made for a minor, we expect a parent or lawful guardian to provide the booking details and consent. We do not knowingly process children's personal data without verifiable parental consent as required by the DPDP Act.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

11. Grievances and contact

If you have any questions about this policy, wish to exercise your rights, or want to raise a grievance about how we handle your personal data, please contact our Grievance Officer:

We aim to acknowledge and respond to grievances within a reasonable period. If you remain dissatisfied, you may escalate your complaint to the Data Protection Board of India.