Privacy & Data Protection Policy

Welcome to Aarogya CBD, an online botanical health and Ayurvedic medical cannabis marketplace operated under Madly Styles ("Company", "We", "Us", or "Our"). This Privacy and Data Protection Policy outlines how we collect, store, process, transfer, and protect your Personal Information when you visit, browse, register an account, consult with our panel of certified Ayurvedic practitioners, or purchase lab-verified botanical products on www.aarogyacbd.com ("Platform").

By accessing our Platform, uploading a medical prescription, participating in telemedicine consultations, or placing an order, you expressly acknowledge that you have read, understood, and consented to the collection and processing of your information in accordance with this Policy, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

To provide high-efficacy Ayurvedic wellness products, fulfill orders across 28,000+ Indian pin codes, and satisfy statutory AYUSH verification requirements, we collect the following classes of data:

• Identity & Contact Data: Full legal name, date of birth (for mandatory 18+ age verification), delivery address, billing address, phone number, and email address.
• Sensitive Personal Data (Medical & Health Records): Uploaded doctor prescriptions, medical history disclosed during Ayurvedic doctor consultations, symptom descriptions for dosage guidance, and consultation notes generated by licensed Ayush physicians.
• Transaction & Billing Data: Payment transaction reference numbers, order IDs, invoice amounts, and chosen payment methods (UPI, Netbanking, Credit/Debit Card). Note: Aarogya CBD never stores your raw credit card numbers, CVVs, or UPI PINs; all payments are processed securely via RBI-licensed payment aggregators.
• Technical & Log Data: Internet Protocol (IP) address, browser type, operating system, geolocation data, referral source, and session activity collected through strictly necessary and analytical cookies.

Because medical cannabis formulations containing full-spectrum Vijaya leaf extracts are categorized under Schedule E-1 of the Drugs and Cosmetics Rules, 1945, dispensing requires a valid medical prescription from a registered Ayurvedic or medical practitioner.

We process your data strictly under recognized legal bases under Indian law:

1. Contractual Performance: Processing your cart, generating GST invoices, packaging orders, and dispatching parcel shipments via logistics partners.
2. Statutory Compliance: Maintaining audit trails required by state AYUSH licensing authorities, GST compliance, and Drug Inspector inspection mandates.
3. Informed Consent: Sending wellness newsletters, dosage titration tips, and loyalty benefits, which you may opt out of at any given time.
4. Legitimate Healthcare Interest: Enabling certified practitioners to evaluate medical cannabis suitability, monitor dosage titrations, and prevent contraindications.

We limit data disclosure strictly to verified entities necessary for dispensary operations:

• Pan-India Logistics Couriers: Name, shipping address, and phone number are shared with verified couriers (Blue Dart, Delhivery, DTDC, Shiprocket) solely for delivery execution. Package labels maintain discreet packaging without public references to cannabis or CBD.
• Licensed Ayurvedic Physicians: Prescriptions and health intake summaries are shared solely with the certified Ayurvedic doctor handling your teleconsultation.
• Payment Aggregators: Transaction details are routed via PCI-DSS compliant gateways (Razorpay, Cashfree, PayU) over 256-bit encrypted channels.
• Law Enforcement & Regulatory Authorities: We disclose records only when served with a formal subpoena, court order, or statutory directive under the NDPS Act or Drugs and Cosmetics Act.

Our Platform utilizes essential session cookies, functional preference cookies, and anonymized analytics cookies to maintain shopping cart items, remember age verification status, and measure website speed performance. You can control or block cookie permissions through your web browser preferences; however, disabling essential cookies may impact checkout functionality.

As a valued patient and user, you possess enforceable statutory rights under the DPDP Act, 2023:

• Right to Summary: You may request a complete summary of personal data held by Aarogya CBD.
• Right to Rectification & Correction: You may update inaccurate contact details or shipping addresses.
• Right to Erasure: You may request complete deletion of your customer profile, subject to statutory retention obligations under Indian pharmaceutical and tax laws.
• Right to Grievance Redressal: You may escalate privacy concerns directly to our designated Grievance Officer.

Aarogya CBD maintains strict technical, organizational, and physical safeguards. Prescription records are archived in secure, restricted-access cloud servers backed by AES-256 encryption. Non-prescription transaction data is retained for a statutory period of 7 years in compliance with the Companies Act and Indian GST regulations, after which it is securely anonymized or permanently purged.

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011 and the DPDP Act, 2023, our designated Grievance Officer details are published below: