Privacy Notice

• Personal Data means information relating to an identified or identifiable natural person as defined under the DPDPA.
• Sensitive Personal Data includes health, biometric, financial, and other protected categories of data.
• Data Principal means the individual to whom Personal Data relates.
• Data Processor means a person who processes Personal Data on Dermasutra's behalf.
• Data Fiduciary means Dermasutra Technologies Private Limited, which determines the purpose and means of processing Personal Data.
• Services means Dermasutra's website, mobile application, consultations, assessments, and other offerings.

This notice applies to personal data collected from people who:

• Visit or use our website or mobile application.
• Create an account or profile.
• Submit information through assessments or consultations.
• Contact us through email, chat, or support tools.
• Subscribe to communications or participate in surveys, contests, or promotions.
• Apply for employment or partnership opportunities.

Dermasutra Technologies Private Limited acts as a Data Fiduciary for Personal Data collected through the Platform. When facilitating consultations between users and dermatologists, we may also act as a Data Processor for relevant data-handling activities.

As applicable, we process data based on consent, the need to provide requested services and perform our agreement, compliance with legal obligations, protection of the Platform and prevention of fraud, and protection of health or safety in emergencies.

You may withdraw consent through an unsubscribe option, available account settings, or by contacting us. Withdrawal does not affect processing that was lawful before consent was withdrawn.

We may share the minimum information necessary with:

• Licensed dermatologists and other medical professionals involved in your care with appropriate consent.
• Hosting, cloud, payment, analytics, customer-support, communications, email, and identity-verification providers.
• Government, law-enforcement, and regulatory bodies when legally required.
• Trusted business partners for specific services with explicit consent, product manufacturers for fulfillment, and applicable affiliated entities.

We require appropriate safeguards and confidentiality, and we do not sell Personal Data to third parties for their marketing purposes.

We retain Personal Data only while needed to provide services, maintain accounts, meet legal requirements, resolve disputes, or enforce agreements.

• Active account information: for the duration of the relationship; inactive account information: up to 24 months after last activity.
• Medical records: at least 3 years; consultation data: for the account duration plus 3 years.
• Transaction data: 8 years for tax and accounting purposes.
• Customer-service interactions: 2 years; marketing preferences: until you opt out.

After an applicable period, data will be securely deleted, anonymized or aggregated, or archived with restricted access when required for legitimate business or legal purposes.

We use technical, organizational, and physical measures designed to protect Personal Data, including secure transmission, encryption for sensitive information, access controls, firewalls, security monitoring, staff training, incident-response procedures, and continuity planning.

If a breach requires notification under applicable law, we will notify the appropriate authority and affected users and take remedial measures. No internet transmission or electronic storage is completely secure. Users should maintain strong passwords, sign out on shared devices, keep software updated, and use care when sharing sensitive information.

Subject to applicable law, Data Principals may have rights to information about processing; access; correction; erasure; withdrawal of consent; breach information; and complaint redressal. Where applicable, you may also request restriction or a portable copy of your data.

Send a verifiable request to getyoursutra@dermasutra.in. We may request additional information to verify identity and will respond within applicable legal timelines.

We do not knowingly collect Personal Data from anyone under 18 without verified parental or guardian consent. Our services are not directed to minors.

If a minor uses the services with appropriate authorization, we limit collection to what is necessary and apply enhanced protections. Contact us if you believe a minor submitted information without proper consent.

We may use essential, functional, analytical/performance, and—only with explicit consent—targeting or advertising cookies to operate the Platform, remember preferences, understand usage, personalize services, and measure communications.

You can manage preferences through our Cookie settings, browser controls, or available opt-out mechanisms. Dermasutra does not send quiz answers, photographs, health information, or contact details to its analytics service.

We aim to maintain primary storage and processing in India or compliant jurisdictions. Limited cross-border transfers may occur when needed to provide or operate the services and only with safeguards required by applicable law.

You may request information about relevant international transfers by contacting us.

We send marketing communications only with appropriate consent. These may include newsletters, skincare education, product recommendations, consultation offers, and event invitations.

You may opt out through an unsubscribe link, account preferences, or by contacting support. We may still send non-promotional messages about your account or active services.

We may update this notice to reflect changes in our practices or legal requirements. For material changes, we will post a notice or communicate directly and seek renewed consent where required. The current version will remain available on the Platform.

The Platform may link to third-party websites, plugins, or applications. We do not control their data practices and are not responsible for their privacy notices. Please review the policies of third-party services before using them.

Questions about privacy practices, rights, or complaints may be directed to Dermasutra Technologies Private Limited at getyoursutra@dermasutra.in or +91 63609 99740.

We aim to acknowledge complaints promptly, investigate them, and provide a response within applicable legal timelines. Unresolved matters may be escalated to the Data Protection Board of India or appropriate legal channels.

Contact: getyoursutra@dermasutra.in.

By using our services, you acknowledge that you have read and understood this notice. Where explicit consent is required, we will seek a clear affirmative action, such as a consent checkbox or authorization during account creation or service activation.

Dermasutra Technologies Private Limited
Nashik, Maharashtra, India
getyoursutra@dermasutra.in
+91 63609 99740
www.dermasutra.in