Privacy Policy

Effective date: 20 July 2026 · Thoughtbins Technologies

1. Data Controller

Thoughtbins Technologies(“we”, “us”, or “the Company”) is the data controller for all personal information collected through Vedraaj (“the Platform”).

Contact: info@vedraaj.com

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, and authentication credentials.
• Health data:consultation profile information (including health concerns, symptoms, lifestyle data, dosha assessment, medical history, prescriptions, and medical reports uploaded by you), and chat messages containing health-related information (“Special Category Data” under GDPR Art. 9 / “Sensitive Personal Data” under India’s DPDP Act).
• Usage data: session logs, chat history, and interaction patterns.
• Geolocation data: city, country, and climate zone for personalising recommendations.

3. Purpose and Legal Basis for Processing

We process your data for the following purposes:

• Providing the service: delivering personalised Ayurvedic wellness guidance based on your profile and inputs. This is necessary for the performance of our contract with you.
• Personalisation and AI generation: generating daily routines, recommendations, and responses. This is carried out on the basis of your explicit consent.
• Analytics: improving the Platform. This is carried out on the basis of your consent for analytics cookies.

4. Legal Basis (GDPR)

• Consent (Art. 6(1)(a) and Art. 9(2)(a)): health data processing requires your explicit, freely given, specific, and informed consent.
• Performance of contract (Art. 6(1)(b)): providing the core service.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security, and platform improvement.

5. Special Category Data (GDPR Art. 9 / DPDP Act)

Health data is classified as “Special Category Data” under GDPR Art. 9 and “Sensitive Personal Data” under India’s Digital Personal Data Protection Act, 2023. It is processed only with yourexplicit consent, which you provide by accepting this Privacy Policy and the consent notice on first use. You may withdraw this consent at any time.

6. Data Sharing

We share your data with the following third parties:

• AI providers: MiniMax (China) and Google Gemini (USA) — used to generate responses and analyse uploaded images. These providers are data processors acting under our instructions.
• Hosting provider: cloud infrastructure for data storage.
• Payment processor: Cashfree — for subscription billing. Your payment data is not stored by us.
• Email service provider: for transactional and marketing emails.
• Analytics: Google Analytics (with your consent for analytics cookies).

We do not sell, rent, or trade your personal data with any third parties for marketing purposes.

7. Data Retention

• Account data: retained until you delete your account or withdraw consent.
• Health data (chat history, prescriptions, reports): retained until you request deletion or withdraw consent.
• Subscription and billing records: retained for the period required by applicable tax and financial regulations.

8. Your Rights

You have the following rights over your personal data:

• Right of access (GDPR Art. 15 / DPDP Act): request a copy of your personal data.
• Right to rectification (GDPR Art. 16): request correction of inaccurate data.
• Right to erasure — “right to be forgotten” (GDPR Art. 17 / DPDP Act):request deletion of your data, including health data. See “Right to Erasure” below.
• Right to data portability (GDPR Art. 20): receive your data in a structured, machine-readable format.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing based on prior consent.
• Right to lodge a complaint:with a supervisory authority — in India, the Data Protection Board; in the EU, your local Data Protection Authority.

To exercise any right, email info@vedraaj.com.

9. Right to Erasure

You may request permanent deletion of your account and all associated personal data (including chat history, prescriptions, reports, and health profile) by contacting info@vedraaj.com. Upon verification, we will delete or irreversibly anonymise your data within 30 days, except data we are legally required to retain (e.g., billing records).

10. Cookies

We use essential cookies (required for authentication and core functionality) and, with your consent, analytics cookies. See our Cookie Policy for full details.

11. International Data Transfers

Your data may be processed in countries outside India and the European Economic Area, including countries that may not provide the same level of data protection. We ensure adequate safeguards are in place, including Standard Contractual Clauses or equivalent legal mechanisms.

12. Data Security

We implement industry-standard security measures including AES-256 encryption at rest and TLS 1.3 encryption in transit. Access to personal data is restricted to authorised personnel only.

13. Children’s Data

Vedraaj is not intended for use by children under 18 years of age. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page with an updated effective date. Your continued use of the Platform after such changes constitutes acceptance of the revised policy.

15. Contact

For questions about this Privacy Policy, contact our Data Protection Officer at info@vedraaj.com.

← Terms of Service · Cookie Policy