Privacy Policy.

Loetus Ayurvedic Hospital & Wellness Retreat (“Loetus”, “we”, “us”, or “our”) is a multidisciplinary Ayurvedic medical facility based in Indore, Madhya Pradesh, India. We operate the website www.loetushospital.com (the “Website”) and provide Ayurvedic consultation, Panchakarma therapy, Yoga therapy, Naturopathy, Acupressure, and Psychology services.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Loetus is a Data Fiduciary — meaning we determine the purpose and means of processing your personal data. This policy describes how we act on that responsibility.

We collect only the information necessary to provide medical consultation and therapy services. We do not collect data we do not need.

Information you actively provide

Book Consultation Form

When you book a consultation at /book, we collect your name, phone number, email address, and the health condition or treatment category you have selected. This is classified as Sensitive Personal Data under the DPDP Act because it includes health-related information.

Contact Form

When you reach us through the form at /contact, we collect your name, phone number, email address, and the content of your message. Any health information you voluntarily disclose in your message is treated as Sensitive Personal Data.

Callback Request

When you request a callback from our homepage, we collect your name and phone number only, so that a member of our team can return your call.

Information collected automatically

When you visit our Website, our hosting provider (Vercel) and analytics tools automatically log basic technical information — your approximate location (city-level), device type, browser type, referring URL, pages visited, and timestamp. This data is aggregated and used to improve Website performance and understand usage patterns.

Information we do NOT collect

• Aadhaar, PAN, or other government identity documents (unless you voluntarily share them during in-person consultation)
• Bank account details, credit card, or UPI information via the Website
• Biometric data (fingerprint, face scan, iris)
• Location data more precise than city-level
• Any data from users under 18 years without verifiable parental consent

We use your personal information strictly for the following purposes:

1. To respond to your consultation booking, contact enquiry, or callback request within 24 hours.
2. To provide personalised Ayurvedic consultation, prepare your treatment protocol, and schedule therapy sessions.
3. To send appointment reminders, follow-up care instructions, and health updates directly related to your treatment.
4. To maintain internal medical records as required under Indian medical practice guidelines.
5. To improve our Website functionality, diagnose technical issues, and understand which pages are most useful.
6. To comply with legal obligations, respond to lawful requests from authorities, and defend legal claims.

Under the DPDP Act 2023, we process your personal data on the following legal grounds:

Consent (Section 6)

When you submit a form, you provide free, specific, informed, and unambiguous consent to process the data you provide, for the purposes stated on that form.

Legitimate Use (Section 7)

We may process your data without explicit consent where required for medical emergencies, compliance with legal obligations, or the performance of a service you have requested.

Your personal and health information stays within Loetus by default. We share it externally only in these narrow situations:

With our treating Vaidyas and clinical staff

Your treatment team accesses your information solely to provide care. All staff are bound by medical confidentiality.

With essential service providers

Our Website hosting (Vercel) and communication tools (WhatsApp Business) process limited technical data on our behalf, under contractual data protection obligations.

When legally required

If required by a court order, statutory authority, or law enforcement agency acting within legal bounds, we may disclose the minimum necessary information.

In case of medical emergency

To protect your vital interests or the safety of others, we may share relevant medical information with emergency services or referring physicians.

Our Website integrates the following third-party services. Each has its own privacy policy, and we encourage you to review them:

Vercel (Hosting)

Processes basic server logs (IP address, browser type, timestamps) to serve the Website to your device.

Vercel Privacy Policy →

Google Analytics (Website Analytics)

Provides anonymised, aggregated data about how visitors use our Website — most-visited pages, average time on page, device categories. IP addresses are anonymised. We do not use this data to identify individual users.

Google Privacy Policy →

WhatsApp Business (Communication)

When you initiate a WhatsApp conversation with us via a link on our Website, our conversation is subject to WhatsApp's end-to-end encryption. Meta Platforms (the parent of WhatsApp) may process metadata such as your phone number according to its own privacy terms.

WhatsApp Business Policy →

We retain your personal data only as long as necessary for the purposes it was collected, or as required by law:

Consultation records

Retained for a minimum of 3 years from your last consultation, in line with Indian medical practice guidelines.

Contact enquiries

Deleted 12 months after resolution, unless you become a patient (in which case consultation retention applies).

Callback requests

Deleted 30 days after the callback is completed.

Website analytics

Aggregated data is retained for 14 months, per Google Analytics defaults.

You may request early deletion of your data at any time by contacting our Grievance Officer (see Section 13).

We take reasonable and appropriate security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• HTTPS encryptionAll data transmitted between your device and our Website is encrypted using TLS.
• Strict Content Security PolicyOur Website enforces a strict CSP that blocks unauthorised script execution and data exfiltration.
• Access controlOnly authorised clinical staff and administrators can access patient records, with individual accountability.
• Physical securityPaper records at our hospital are stored in locked cabinets accessible only to authorised staff.
• Regular auditsWe periodically review our security practices and update them in line with the evolving threat landscape.

No system is 100% secure. If a data breach occurs that is likely to affect your rights, we will notify you and the Data Protection Board of India in accordance with Section 8(6) of the DPDP Act.

As a Data Principal under Indian law, you have the following rights regarding your personal data:

Right to Access (Section 11)

You may request a summary of the personal data we hold about you and the identities of any third parties with whom it has been shared.

Right to Correction and Erasure (Section 12)

You may request that we correct inaccurate or misleading data, complete incomplete data, update outdated data, or erase data no longer needed for the purposes it was collected.

Right to Grievance Redressal (Section 13)

You may approach our Grievance Officer (see Section 13) for any concerns. We will respond within 30 days.

Right to Nominate (Section 14)

You may nominate an individual to exercise your rights in the event of your death or incapacity.

Right to Withdraw Consent

You may withdraw your consent to data processing at any time, with the same ease with which it was given. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact our Grievance Officer. We may need to verify your identity before acting on your request to protect your data.

Our Website and services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors without verifiable parental or guardian consent.

If a minor requires Ayurvedic treatment, consultation must be booked and attended by their parent or legal guardian. All data processing in such cases will be based on the guardian's consent, in line with Section 9 of the DPDP Act.

If you believe a minor has provided us data without appropriate consent, please contact our Grievance Officer immediately so we can delete it.

Our Website uses a minimal set of cookies and similar technologies:

Strictly necessary cookies

Required for the Website to function — remembering your form entries during a session, load balancing. These cannot be disabled without breaking the Website.

Analytics cookies (Google Analytics)

Anonymously track how visitors use our Website so we can improve it. IP addresses are anonymised.

You can control cookies through your browser settings. Blocking all cookies may impair some Website features.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the 'Last Updated' date at the top of this page.
• For material changes, provide a prominent notice on our Website homepage for at least 30 days.
• Where legally required, obtain your fresh consent before applying the changes to previously collected data.

Your continued use of the Website after changes take effect constitutes your acceptance of the revised Privacy Policy.

In accordance with Section 8(9) of the DPDP Act 2023, we have designated a Grievance Officer to address any complaints, questions, or requests regarding your personal data.

We will acknowledge your grievance within 48 hours and provide a substantive response within 30 days, as required under Indian law. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

For any question about this Privacy Policy or our data practices, please reach out to us: