Privacy Policy

Please read this Privacy Policy carefully as it governs your use of our services.

Introduction

This Privacy Policy (“Policy”) describes how Revita Ayurveda Private Limited (“Company”), a company registered in India, collects, uses, stores, and protects your personal data when you interact with our wellness platform, ORCCA, including our website, mobile application, and all associated services (“Platform”).

By accessing or using the Platform, you agree to the terms described in this Policy. If you do not agree, please discontinue use of our services.

Revita Ayurveda Private Limited is committed to safeguarding your personal information. This Policy applies to both users (“Clients” or “Users”) and wellness practitioners (“Healers”), including Ayurvedic doctors, nutritionists, psychologists, yoga therapists, and other practitioners associated with the ORCCA platform.

Information We Collect

We collect the following categories of data:

How We Use Your Information

Your information is processed to:

• Deliver personalised wellness programs, consultations, and services
• Facilitate secure communication between clients and healers
• Ensure timely delivery of prescriptions, plans, and physical wellness kits where applicable
• Conduct practitioner onboarding and credential verification
• Improve platform usability through feedback, surveys, and analytics
• Comply with legal obligations and ensure system security
• Authenticate users and manage account access

Practitioner Verification

All Healers are verified through a structured onboarding process that includes document review, credential validation, and training. Healers are responsible for the accuracy of their submitted details.

Revita Ayurveda Private Limited reserves the right to suspend or terminate any practitioner who submits false information or fails compliance checks.

Consent

By signing up or using ORCCA, users and healers consent to the collection and use of their data as outlined in this Policy.

Explicit consent is taken via checkboxes before account creation or consultation booking.

Data Sharing & Disclosure

We do not sell or rent your data. Data may be shared only:

• With authorised practitioners involved in your care
• With third-party service providers we work with, including payment processing, cloud hosting and data storage, authentication and identity management, transactional email notifications, and logistics partners where applicable. Each operates under contractual data processing agreements.
• As required by Indian law, court orders, or regulatory authorities

Data Security

Data is encrypted in transit using TLS 1.2+ and at rest using industry-standard encryption on AWS infrastructure hosted in India. Access is controlled through role-based permissions and regular security audits.

We store data using HIPAA and GDPR-compliant cloud infrastructure on AWS India.

While we take all reasonable measures, we cannot guarantee 100% data security due to the nature of the internet.

On-Device Storage

The app stores certain data locally on your device, including cached chat messages and daily tracker entries, to enable offline functionality.

This data is synced with our servers when connectivity is restored.

User Rights

As a user, you have the right to:

• Access your data stored with us
• Request correction of inaccurate details
• Request deletion, subject to legal retention requirements
• Withdraw consent at any time
• File complaints with data protection authorities

Requests can be sent to the designated ORCCA privacy contact.

Account Deletion

You may request account deletion through the “Delete Account” option in the app (Settings → Data & Privacy → Delete Account) or by contacting us through the designated ORCCA privacy contact.

Upon receiving a verified deletion request, your account will be immediately deactivated and all personal data will be permanently deleted within 30 days.

Exceptions

(a) Anonymised clinical summaries retained for medico-legal purposes for up to 7 years as required by applicable Indian medical record-keeping requirements.

(b) Financial transaction records retained per Indian tax and accounting requirements for up to 8 years.

Data Retention

Active account data is retained for the duration of your account plus 30 days after deletion request.

Financial transaction records are retained for up to 8 years per applicable Indian tax requirements.

Anonymised clinical summaries may be retained for up to 7 years for medico-legal purposes.

Anonymised analytics data that cannot be linked to you may be retained indefinitely.

Payments & Financial Data

ORCCA integrates with PCI-DSS compliant third-party gateways for secure payments.

We do not store credit card numbers or sensitive banking information.

Invoices and payment summaries are stored for taxation and refund processing.

Children’s Privacy

The Platform is not intended for users below 18 years of age. Accounts for minors can be managed only by a parent or legal guardian.

We do not knowingly collect personal data from minors without guardian oversight.

International Data Transfers

Currently, all data is stored on servers within India.

Should international expansion require offshore data processing, it will be done in accordance with GDPR and other applicable laws.

Changes to This Policy

We may update this Policy from time to time. Users will be notified of major changes via email or platform notification.

Continued use of ORCCA after updates implies acceptance of the revised terms.

Contact Us

For privacy-related queries, data requests, or complaints, contact the ORCCA privacy team using the official contact details published on the ORCCA.health website.

Registered Address

Corporate Office