(Operating the website and platform “AyurvedaDocs”, www.ayurvedadocs.com) Designed with regard to the DPDP Act, 2023 / DPDP Rules, 2025 and applicable international data protection standards

READ THIS CAREFULLY BEFORE PROCEEDING: AyurvedaDocs is a wellness-travel curation, concierge and booking platform. We help you discover, compare and book stays at independently owned and operated Ayurvedic resorts, wellness centres and healthcare facilities across India (each, a “Partner Resort”).

AYURVEDADOCS DOES NOT PROVIDE, RENDER, SUPERVISE OR CONTROL ANY MEDICAL, AYURVEDIC OR OTHER HEALTHCARE TREATMENT. All medical consultations, diagnoses, Panchakarma protocols, therapies and treatment plans are independently designed and administered by the doctors, therapists and staff employed by the Partner Resort you choose to stay at. AyurvedaDocs is an intermediary and travel-planning service, not a hospital, clinic or medical practitioner.

Any health, wellness or lifestyle information you share with us through our enquiry forms, website, or wellness consultants is used solely to help us understand your goals and recommend, match and arrange a suitable Partner Resort and travel package for you. It is not used by AyurvedaDocs to diagnose, treat, or provide clinical advice on any medical condition. If you are experiencing a medical emergency, please contact your nearest emergency medical service or hospital immediately, do not rely on this Platform or wait for a response from our team.

AyurvedaDocs was founded to help travellers safely and confidently access authentic, well-matched Ayurvedic wellness experiences in India. We understand that the information you share with us in order to be matched with the right Partner Resort, including your health goals, travel plans and personal circumstances, is sensitive and personal. We are committed to collecting, processing, storing and protecting your personal data in a transparent, secure and responsible manner. Where you are located in India, your personal data is processed in accordance with the Digital Personal Data Protection (DPDP) Act, 2023, the Digital Personal Data Protection Rules, 2025,and the Information Technology Act, 2000. Because a significant number of our clients are located outside India, we also have regard to applicable international data protection standards and the requirements described in Clause 7 (Cross-Border Transfer of Personal Data) below.

Your privacy and autonomy are fundamental to how we process your personal data. We process your personal data only after obtaining your valid consent, except where processing is otherwise permitted or required by applicable law. By submitting an enquiry, requesting apersonalised package, creating an account, subscribing to our newsletter, or affirmatively selecting “I AGREE” or an equivalent consent mechanism on our Platform, you acknowledge that your consent is free, informed, specific, unconditional and unambiguous, and that you have read and understood this Privacy Policy.

We do not bundle consent for unrelated processing activities. Wherever reasonably practicable, you may choose whether to share optional information (for example, detailed medical history) or participate in optional features (such as testimonials or the Ambassador Program). You may review, update or correct your personal data at any time by contacting us using the details in Clause 10, subject to reasonable verification.

You may withdraw your consent, in whole or in part, at any time by contacting our Data Protection Officer. On withdrawal, we and ourauthorised data processors will cease processing the relevant personal data within a reasonable period, unless further processing is required or permitted by law. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. Where certain personal data (for example, your travel dates or payment details) is essential to complete a booking already in progress, withdrawing consent for that data may result in that booking or service being suspended or discontinued.

Our Platform and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data directly from minors. Where a booking or package is intended for a family member, including a minor, the adult making the booking is responsible for providing any necessary information on that family member’s behalf and for obtaining any consents required under applicable law. If we become aware that we have inadvertently collected personal data directly from a minor without appropriate consent, we will take reasonable steps to delete such data.

AyurvedaDocs operates as a curated marketplace and booking intermediary. We do not own or operate any resort, wellness centre or medical facility. When you engage with us, we use the information you provide (your health goals, travel preferences and budget) to recommend one or more Partner Resorts suited to your needs.

Once you decide to proceed with a particular Partner Resort, we share the relevant portions of your Registration, Health & Wellness Goals, and Travel & Booking Data with that Partner Resort so that its medical and hospitality teams can prepare for your arrival, plan an appropriate treatment program, and provide services directly to you during your stay. Each Partner Resort processes the personal data shared with it as an independent data controller in accordance with its own privacy practices, which may differ from this Privacy Policy. We encourage you to review the Partner Resort’s own privacy policy, where available, before your stay. AyurvedaDocs is not responsible for a Partner Resort’s subsequent use, storage or disclosure of your personal data once lawfully shared, other than as required under our contractual arrangements with that Partner Resort.

Where our Platform offers any automated enquiry assistant, chatbot, or recommendation tool, such tools are provided to help you explore Partner Resorts and packages based on the information you input. They do not provide medical advice, and any suggested resort match or treatment focus generated by such tools is not a diagnosis or clinical recommendation.

We treat your personal data with a high degree of confidentiality and do not sell, rent or trade your personal data. Beyond the sharing with Partner Resorts described in Clause 5, we may share your personal data only to the extent necessary to provide, operate and improve the Platform, with trusted third parties who are contractually obligated to protect your information and use it only for authorised purposes, including:

• Cloud hosting, website and IT infrastructure providers;
• Payment gateway and financial service providers, to process your payments;
• Visa facilitation partners, and, where you request visa assistance, relevant consulates, embassies or immigration authorities;
• Airport transfer, concierge and logistics partners engaged to support your trip;
• Communication, analytics and marketing service providers who help us operate and improve our website and outreach; and
• Professional advisors (legal, accounting) where necessary for our business operations. We may also disclose your personal data where required by applicable law, pursuant to a lawful order of a court, government authority or regulatory body, or where necessary to establish, exercise or defend legal rights, prevent fraud, or protect the safety of our users. In all cases, we take reasonable steps to ensure recipients of your personal data maintain appropriate confidentiality and security standards.

Many of our clients are located outside India, while our Platform, our team, and our Partner Resorts are based in India. As a result, your personal data will typically be collected, stored and processed in India, and, where relevant, transferred to Partner Resorts and service providers located in India. Where you request visa assistance, your passport, identity and travel information may also be shared with Indian consulates, embassies, immigration authorities, or authorised visa facilitation partners in your country of residence or in India, solely for the purpose of processing your visa application. We take reasonable contractual, technical and organisational steps to ensure that any cross-border transfer or processing of your personal data is subject to safeguards consistent with applicable law.

Security Safeguards

We implement reasonable technical and organisational security measures, including encryption of data in transit, access controls, and restricted role-based access to personal data, designed to protect your personal data against unauthorised access, alteration, disclosure, loss or misuse, in line with Section 8(5) of the DPDP Act and Section 43A of the Information Technology Act, 2000.

Retention Period

We retain your personal data only for as long as necessary to provide our services to you, maintain your account, complete and support any bookings, and comply with our legal, tax and accounting obligations. Health & Wellness Goals Data shared for the purpose of arranging a specific stay is retained only for as long as needed for that booking and any related follow-up, unless you ask us to retain it for future personalised recommendations.

Data Erasure

You may request the erasure of your personal data once the purpose for which it was collected has been fulfilled, subject to our legal retention obligations (for example, financial records), as set out in Clause 9.

Personal Data Breach Notification

In the event of a personal data breach affecting your personal data, we will, in accordance with Section 8(6) of the DPDP Act and the DPDP Rules, 2025, notify the Data Protection Board of India and inform affected Data Principals without undue delay. Any such notification will be provided in plain language and will describe the nature of the breach, its likely consequences, the measures taken or proposed to mitigate the risk, and contact details for further assistance.

Under the provisions of the DPDP Act, subject to applicable law, you have the following rights in respect of your personal data:

• Right to Access to obtain a summary of the personal data we hold about you, the processing activities undertaken, and the identities of any third parties (including Partner Resorts) with whom it has been shared.
• Right to Correction and Erasure: to correct inaccurate or misleading data, complete incomplete information, update changed details, or request erasure of your personal data once the purpose for which it was collected has been fulfilled, subject to our legal retention obligations.
• Right to Grievance Redressal: to have your grievance addressed by us before escalating it to the Data Protection Board of India.
• Right to Nominate: to nominate another individual to exercise your rights under this Policy in the event of your death or incapacity.

In accordance with the DPDP Rules, 2025, we will respond to a verified request under this Clause within ninety (90) days of receipt. You may exercise these rights by contacting us using the details in Clause 10.

Where you are located outside India, and to the extent applicable law in your jurisdiction (for example, the EU/UK General Data Protection Regulation) grants you additional or equivalent rights such as the right to rectification, restriction of processing, objection to processing, or data portability, we will, as a matter of good practice, extend comparable treatment to your request where reasonably practicable.

In accordance with Section 8(9) of the DPDP Act, we publish below the business contact information of our designated Grievance Officer / Data Protection Officer, who is able to answer questions regarding the processing of your personal data and to whom you may address any queries, concerns, or grievances, or through whom you may exercise any of the rights described in Clause 9:

Name of Grievance Officer / DPO: Husaina Karmalawala

Designation: Data Protection Officer & Compliance Head

Address: 124 Viraj, 1st Floor, S.V. Road, Khar (West), Above HDFC Bank, Mumbai, Maharashtra, India – 400052

Email Contact: support@ayurooms.com (or via www.ayurvedadocs.com/contact)

In accordance with the DPDP Rules, 2025, we will acknowledge and endeavour to resolve your grievance within ninety (90) days of receipt. If you are unsatisfied with our response, or believe your data protection rights have been violated, you have the right to file a complaint with the Data Protection Board of India (DPBI) through its online portal, or, where applicable, with your local data protection authority.

This Privacy Policy is currently available in English.

We may revise, modify or update this Privacy Policy from time to time to reflect changes in applicable law, our business operations, our Partner Resort network, or the services offered through the Platform. Any revised version will be posted on the Platform and will become effective from the date specified. Where changes materially affect how we collect, use, process or disclose your personal data, we will provide appropriate notice through the Platform or other communication channels. Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes acknowledgement of those changes, except where fresh consent is required by applicable law, in which case we will obtain such consent before further processing your personal data.