Data protection policy

Effective 7 October 2026

Purpose

People trust us with their birth details, their questions and, in consultations, some of the most personal parts of their lives. This policy sets out how we honour that trust. It explains how we meet our duties as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, and the security obligations of the Information Technology Act, 2000 and its rules.

Our privacy policy tells you what we collect and why. This policy explains how we protect it.

Scope

• Data: all personal data we process, in any form: in our databases and servers, in email, in documents and on devices.
• People: every director, employee, contractor and volunteer of Parimarjit Healthcare Private Limited, and every licensed astrotherapist, for the client data they see on our platform.
• Systems: our websites, the Karmik Architect app, our servers and databases, and the processors we use.

Our principles

Roles and responsibilities

• The Board of Directors is ultimately accountable for data protection at Parimarjit Healthcare Private Limited, and approves this policy.
• The Grievance Officer, Dr Rushi Jariwala, handles requests and complaints from Data Principals, coordinates breach response, and keeps this policy current. Contact: privacy@karmikarchitect.com.
• Everyone with access to personal data must use it only for their role, keep it confidential, and report any suspected breach at once.
• Licensed astrotherapists see client data only for their own bookings and are bound by our code of conduct to keep it confidential and not copy it off the platform.

The data we hold

Consent

• Every consent is specific, given by a clear action, and requested in plain language with a link to our privacy policy.
• Recording, research and publication are three separate consents. None is pre-ticked, and none is a condition of receiving a consultation.
• We keep a record of each consent and its withdrawal, with the time it was given.
• Withdrawing consent is as easy as giving it. After withdrawal we stop the processing and delete the data concerned, unless the law requires us to keep it.

Security safeguards

Technical

• Encryption in transit: every website, API and app connection uses HTTPS (TLS) with HSTS. Traffic between our servers runs over an encrypted private network.
• No secrets in the clear: passwords are stored as salted scrypt hashes; session tokens and cloud-save restore codes as hashes.
• Access control: databases accept connections only from our own servers; server access is by SSH key only; administrator consoles require authentication.
• Pseudonymisation: clients appear under Sanskrit pseudonyms in transcripts, research notes and ratings; names are not copied onward.
• Minimal exposure: card, UPI and bank details are handled only by Google Play, Apple and Razorpay, and never reach our systems. Call audio is deleted once transcribed.
• Logging and monitoring: access and activity are logged so that misuse can be detected and investigated; logs are themselves kept for limited periods.
• Resilience: data is backed up and replicated to a standby server, so it can be restored after a failure.
• Maintenance: servers and software are kept updated, and security headers protect our websites against common attacks.

Organisational

• Access to personal data is granted on a need-to-know basis and removed when a role ends.
• Everyone with access receives data protection guidance before access is granted.
• New features, studies and processors are assessed for privacy risk before launch (see Privacy by design).

Data processors

We use processors only when they provide sufficient guarantees of data protection, and only under terms that bind them to process data on our instructions, keep it secure, and delete or return it when the service ends. Our current processors are listed in our privacy policy. We review them when we add one and at each annual review.

Transfers outside India

Personal data may be transferred outside India only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and only to processors bound to protect it.

Retention and deletion

Each category of data has a defined retention period, set out in our privacy policy. In addition:

• Data is erased when its purpose is served, when consent is withdrawn, or when an account is deleted, unless the law requires us to keep it, for example accounting records.
• Expired activity records and logs are removed automatically.
• Where data must be kept for legal reasons after a deletion request, we remove everything that identifies the person and keep only what the law requires.
• Backups age out on a rolling basis; deleted data is not restored from a backup into live systems.

Handling rights requests

1. Receive: requests arrive at privacy@karmikarchitect.com, or as an in-app account deletion.
2. Verify: we confirm the request comes from the person concerned, normally by replying to the email address on the account or booking.
3. Acknowledge within 72 hours, with a reference number.
4. Act: we provide, correct or erase the data, or record the withdrawal of consent, and tell the processors involved to do the same.
5. Respond within 30 days at most, explaining what was done, or why a part of the request could not be met.
6. Record the request and the outcome.

Nominations made under Section 14 of the DPDP Act are honoured in the same way once we have proof of death or incapacity.

Personal data breaches

A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

1. Report: anyone who suspects a breach reports it to the Grievance Officer at once.
2. Contain: we stop the breach, revoke compromised credentials and secure the affected systems.
3. Assess: we establish what data and whose data was affected, and the likely consequences.
4. Notify the Board: we inform the Data Protection Board of India without delay, and send a detailed report within 72 hours of becoming aware of the breach, as the DPDP Rules require. Where a cyber security incident must be reported to CERT-In, we do so within its time limits.
5. Notify people: we tell each affected person without delay, in plain language: what happened, what data was involved, the likely consequences, what we are doing, what they can do to protect themselves, and whom to contact.
6. Learn: we record the breach and fix the cause, so it does not happen again.

Privacy by design

Before we launch a feature, start a study or add a processor, we ask: what personal data does it need, can it work with less, who will see it, how long must it be kept, and what could go wrong. Features that touch consultation content or health-related information get a written assessment, and research involving new data from people also goes through the review in our research ethics policy.

Children

Our services are for adults aged 18 and over. We do not knowingly process children's personal data, do not track or target children, and delete any such data promptly when we learn of it.

Review

We review this policy, our processors and our safeguards at least once a year, and after any significant breach, change in law or change in our services. The effective date at the top shows the current version.

Contact

Questions about this policy, or requests about your data: Dr Rushi Jariwala, Grievance Officer, Parimarjit Healthcare Private Limited, 73, Kasturba Mahila Society, P P Patiya, Rander, Surat, Gujarat 395005, India. Email: privacy@karmikarchitect.com.