Privacy Policy

Who we are

Tymon Healthcare Private Limited, a company incorporated in India and registered at B-XXX, 2185/C-2, Opp. Petrol Pump, Sua Road, Vill. Gobindgarh, Ludhiana, Punjab – 141017, India, operates this store and website under the brand name Darakhtveda (“we”, “us”, “our”). We are the Data Fiduciary for the personal data described in this policy, which means we decide why and how it is processed and we are the party you exercise your rights against.

This store is hosted on Shopify, which processes personal data on our behalf in order to provide the platform. Where Shopify determines its own purposes for processing, it does so as a separate controller and its own privacy policy applies.

This policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is written to the framework of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

The short version

We collect the minimum needed to take an order, deliver it, and answer you when you write. We do not sell your data, we do not trade it, and we do not email you marketing unless you asked us to. You can ask us at any time what we hold, ask us to correct it, or ask us to delete it.

Personal data we collect

When you place an order: your name, billing address, delivery address, email address, telephone number, the items you bought, and the order value. Payment card and bank details are collected and processed directly by our payment gateways and never reach us — we see only whether a payment succeeded, the payment method type, and a transaction reference.

When you create an account: your name, email address, a password we store only in hashed form, and your saved addresses.

When you contact us: whatever you put in the message, together with your name, email address, telephone number if you give one, and any order number you quote.

When you subscribe to the Journal: your email address, and nothing else.

When you browse: your IP address, approximate location derived from it, device and browser type, the pages you viewed and when, and the site or search that referred you. This is collected through cookies and similar technologies — see our Cookie Policy.

We do not knowingly collect sensitive personal data as defined under the SPDI Rules beyond what is described above, and we do not ask you for health information. Anything you volunteer about your own health in an email to us is used only to answer that email.

Where the data comes from

• Directly from you, when you order, register, subscribe or write to us.
• Automatically from your device when you use the site.
• From our service providers — our platform, payment gateways and couriers — when they process data on our behalf.

Why we process it, and on what basis

• To fulfil your order — taking payment, packing, dispatching, tracking, and handling replacements. Processed to perform our contract with you.
• To provide support — answering your questions and resolving complaints.
• To meet legal obligations — tax, accounting, company law record-keeping, and any obligation under drug or consumer law that applies to us.
• To keep the store secure — detecting fraudulent orders and abuse.
• To send you the Journal — only if you subscribed, and only until you unsubscribe. Processed on your consent, which you may withdraw at any time.
• To understand which pages are useful — aggregate analytics, not a profile of you.

We do not use your personal data to make any decision about you by wholly automated means that has a legal or similarly significant effect.

Who else sees it

Only the parties who have to, and each receives only what their job requires.

• Shopify, which hosts the store and processes orders.
• Payment gateways, which take the payment. They receive what they need to do so; we do not receive your card details from them.
• Couriers and logistics partners, which receive your name, delivery address and phone number. A courier gets an address, not your order history.
• Analytics and email providers, which process usage data and, if you subscribed, your email address. We use Google Analytics 4, provided by Google, to understand how the store is used in aggregate. Google processes that data on servers which may be outside India, under its own privacy policy.
• Professional advisers, auditors and authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.

We do not sell, rent, or trade personal data to anyone, for any price, and we do not disclose it for any third party's own marketing.

Transfers outside India

Some of our service providers, including our platform and email provider, store and process data on servers located outside India. Where that happens we rely on our contracts with those providers to require an equivalent standard of protection, and we transfer only what is necessary for the service they provide. Transfers are made in accordance with applicable Indian law, including any restrictions notified by the Central Government under the Digital Personal Data Protection Act, 2023.

How long we keep it

• Order and invoice records: for as long as Indian tax, GST and company law require us to keep them, currently a minimum of eight financial years for certain records.
• Support correspondence: while it is useful for resolving your matter and for a reasonable period afterwards, then deleted.
• Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not accidentally email you again.
• Account data: until you ask us to delete the account.
• Analytics data: in aggregate, and for no longer than Google Analytics 4's configured retention period.

When personal data is no longer needed for the purpose it was collected for, and no legal retention period applies, we erase it.

Security

The site runs over HTTPS. Payment pages are handled by PCI-DSS compliant gateways. Access to order and customer data is limited to the people who need it to do their job. Passwords are stored hashed, never in plain text.

No system is perfectly secure and we will not pretend otherwise. If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as required by law, and we will tell you what happened, what data was involved, and what to do about it.

Please do not send us card numbers, passwords, or copies of identity documents by email. We will never ask you for them.

Your rights

As a Data Principal you have the following rights in respect of your personal data.

• Access. A summary of the personal data we hold about you and how it is processed.
• Correction. Correction of inaccurate or misleading data, and completion or updating of incomplete data.
• Erasure. Deletion of personal data we no longer need and are not legally required to keep.
• Withdrawal of consent. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out, and it does not stop us keeping records we are legally obliged to keep.
• Nomination. You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal. You may raise a grievance with our Grievance Officer, whose details are below, before approaching the Data Protection Board of India.

To exercise any of these, write to darakhtveda@gmail.com from the email address on the account or order. We will respond within 30 days. We may need to verify your identity first, and we will tell you plainly if a legal retention period prevents us from deleting something.

You can unsubscribe from the Journal using the link at the bottom of any email we send you, without writing to anyone.

We will not treat you any differently for exercising a right.

Your duties

The Digital Personal Data Protection Act, 2023 also places duties on you: not to impersonate anyone else when providing personal data, not to suppress material information when providing it, and not to register a false or frivolous grievance or complaint. Please give us accurate details — a wrong phone number is the single most common reason a parcel fails to arrive.

Children

This store is not intended for use by anyone under 18, and we do not knowingly collect personal data of children. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us with personal data, write to darakhtveda@gmail.com and we will delete it.

Third-party links

This site links to pages we do not control — a courier's tracking page, for example. We are not responsible for their privacy practices, and we suggest you read their policies before giving them anything.

Complaints

If you are unhappy with how we have handled your personal data, write to our Grievance Officer below. If you are still unsatisfied, you may complain to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The revised version is posted on this page with a new “last updated” date. Material changes are announced by email to subscribers and account holders.

Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and with the Consumer Protection (E-Commerce) Rules, 2020, the name and contact details of the Grievance Officer are set out below.

• Name: Joey Dua
• Designation: Grievance Officer
• Company: Tymon Healthcare Private Limited (trading as Darakhtveda)
• Email: darakhtveda@gmail.com
• Telephone: +91 62844 57593
• Address: B-XXX, 2185/C-2, Opp. Petrol Pump, Sua Road, Vill. Gobindgarh, Ludhiana, Punjab – 141017, India
• Hours: Monday to Saturday, 9am – 6pm IST. Closed Sunday.

We acknowledge every complaint within 48 hours of receiving it and issue a complaint reference number with that acknowledgement. We resolve complaints within one month of receipt. If a complaint will take longer than that, we will tell you why and give you a date.