This Privacy Policy explains what personal data Your Hair Company (“YHC”, “we”, “us”) collects when you use our website, scalp scan, assessment, consultations and shop; why we collect it; who we share it with; how long we keep it; and the rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. In the language of that Act, you are the Data Principal and we are the Data Fiduciary.
Who we are
Your Hair Company is a brand operated from India. Our full company name, corporate identity number and registered office address are printed on every invoice and are available on request from care@yourhaircompany.com.
We provide online hair and scalp consultations with a registered medical practitioner, a guided 3D scalp scan and assessment, and the products a doctor prescribes or recommends. For the purposes of this policy, the business that operates the Your Hair Company brand is the Data Fiduciary responsible for your personal data.
What we collect
Information you give us
- Identity and contact details: your name, mobile number, email address (if you share one), age and gender.
- Delivery details: your address, PIN code and any delivery instructions.
- Health information: your answers to the hair and health questionnaire, medical history, current medicines, allergies, scalp and hair photos, and anything you tell the doctor.
- Scalp scan data: the images captured during the guided 3D scalp scan and the assessment produced from them (whether you appear suitable for treatment, need a doctor’s review, or are unlikely to benefit, with the reasons).
- Messages: what you send us on WhatsApp, email, the contact form or in replies to check-ins.
Information created while you use YHC
- Consultation records: the doctor’s notes, assessments, prescriptions and follow-up plans.
- Booking, order and payment records: what you booked or bought, amounts, invoices and payment status. Card, UPI and bank details are entered directly with our payment partner, Razorpay; we never see or store them.
- Care records: check-in replies, progress photos, reminders sent and whether your plan is active or paused.
- Consent records: which notices you agreed to, the version and when.
Information collected automatically
- Device and usage data: browser and device type, pages visited, referring links and approximate location derived from your IP address, collected through cookies and similar tools (see “Cookies”).
Why we use it
We use personal data only for the purposes we tell you about when we collect it, and only as much as each purpose needs:
- To run the scalp scan and give you a personalised assessment.
- To book your consultation, confirm it, and remind you on WhatsApp, SMS or email.
- To let your doctor understand your history, review your photos and scan, and prescribe appropriately.
- To process payments, pack and deliver orders, issue GST invoices and handle refunds.
- To send care messages you have agreed to: check-ins, refill reminders and follow-up invitations.
- To send offers and marketing messages, only if you have separately agreed to them.
- To run the money-back guarantee, where offered, including checking whether its conditions are met.
- To answer your questions and resolve complaints.
- To keep the service working and safe, prevent fraud and misuse, and meet our legal obligations.
The 3D scalp scan and assessment
- The scan guides your phone camera to capture images of your scalp. These images, and the assessment created from them, are health information and are protected in the same way as your consultation records.
- The assessment is a screening aid that helps decide the next step. It is not a diagnosis. No treatment decision is made by software alone: a doctor reviews your scan, photos and history and makes the final decision.
- Scan images are used for your own care. They are not used in marketing, and are not used to train or improve any software unless you give separate, specific consent, which you can refuse or withdraw without affecting your care.
Consent, and changing your mind
We ask for your consent in clear, separate steps for each purpose — for example this Privacy Policy, the telemedicine consultation, care messages on WhatsApp, marketing, and any use of your photos beyond your own care. Each request explains what the data will be used for. We keep a record of what you agreed to and when.
You can withdraw any consent at any time, as easily as you gave it: from your account, by replying STOP to a marketing message, or by writing to grievance@yourhaircompany.com. Once you withdraw, we stop that processing within a reasonable time. Withdrawal does not affect processing that already took place, and some records must still be kept by law (see “How long we keep data”). If you withdraw consent needed to provide a service — for example consent to hold your health information — we may no longer be able to provide that service.
In a few limited cases the law allows us to process data without asking for consent, for example to respond to a medical emergency or to comply with a legal obligation or court order.
How health information is protected
- Your questionnaire, scan, photos, consultation notes and prescriptions are available only to your treating doctor and the clinical staff who support your care.
- Our sales and customer support team helps with bookings, orders and delivery. They cannot see your clinical information.
- Health details are never written into WhatsApp marketing messages, email subject lines, calendar invitations or system logs.
- Every time a clinical record is opened, the access is recorded.
- Your photos are never used in advertising or published stories unless you give separate written consent, which you can withdraw at any time.
Who we share data with
We do not sell or rent personal data. We share it only with service providers (Data Processors) that help us run YHC, under written contracts that allow them to use it only on our instructions and require them to protect it:
- Payments: Razorpay.
- Messaging: our WhatsApp Business service provider, MSG91 for SMS and one-time codes, and Resend for email.
- Video consultations and scheduling: LiveKit (or Google Meet as a fallback) for the call, and Google Calendar for the doctor’s schedule — appointment times only, never health details.
- Delivery: Shiprocket and its courier partners — your name, phone number and address only.
- Hosting and operations: Vercel (website hosting, India region) and Supabase (database and file storage, India region).
- Analytics and advertising measurement: Google Analytics and Meta, only with your cookie consent and never with health information.
We may also disclose personal data when the law requires it — for example to a court, regulator or government authority acting lawfully — or to protect someone’s life or safety. If our business is reorganised or transferred, your data may pass to the new operator, who must honour this policy.
Where your data is stored
Our database and file storage, including your health information, scan images and photos, are hosted in India (Mumbai region). Some service providers listed above may process limited data, such as message delivery or error reports, outside India. Where that happens, we do so only as permitted under the DPDP Act and any restrictions notified by the Government of India.
How long we keep data
- Medical records — questionnaire answers, scan images and assessments that formed part of your care, consultation notes, prescriptions and related photos — are kept for at least three years from your last consultation, as required by the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, or longer if another law or an ongoing claim requires it.
- If you complete a scan or assessment but never book a consultation, we delete those images and results once they are no longer needed, and in any case within 12 months of your last activity, unless you ask us to keep them.
- Invoices, payment and order records are kept for the period required under GST, income tax and company law (currently up to eight years).
- Marketing preferences are kept until you withdraw consent; after that we keep only a record that you opted out, so we do not contact you again.
- Other account data is deleted or anonymised once it is no longer needed for the purpose it was collected for, or when you ask us to erase it.
If you ask us to erase your data and some of it must be kept by law, we restrict access to those records, keep them only for the legally required period, and then delete them.
Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you, how it is used, and who it has been shared with.
- Correction, completion and updating: ask us to fix data that is inaccurate, incomplete or out of date.
- Erasure: ask us to delete data we no longer need, subject to the retention rules above.
- Withdraw consent for any purpose, at any time.
- Grievance redressal: complain to our Grievance Officer and receive a response within the time the law sets.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
To use any of these rights, write to grievance@yourhaircompany.com from the email address or mobile number linked to your account. We will confirm your identity before acting, and respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
As a Data Principal, you also have duties under the Act: to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.
How we protect your data
We use reasonable technical and organisational safeguards: encryption in transit and at rest, private file storage shared only through short-lived links, role-based access limited to people who need it, multi-factor sign-in for doctors and administrators, access logging for clinical records, and regular reviews of who has access. No system is entirely free of risk.
If a personal data breach affects you, we will tell you without delay — what happened, the likely impact, what we are doing about it and what you can do — and we will report it to the Data Protection Board of India as the law requires.
Children
YHC is only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, write to us and we will delete it.
Cookies and analytics
- Essential cookies keep you signed in, remember your cart and keep the site working. They cannot be switched off.
- Analytics cookies help us understand which pages are useful, and advertising measurement cookies tell us whether our ads work. We use these only with your consent.
- You can change your choice at any time, and you can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site from working.
Changes to this policy
We may update this policy as our service or the law changes. If a change affects how your data is used, we will tell you on WhatsApp or email before it takes effect and, where needed, ask for your consent again. The “Last updated” date at the top shows the current version.
Contact and grievances
Grievance Officer, Your Hair Company — grievance@yourhaircompany.com. We acknowledge every grievance within 48 hours. For general questions about your account, bookings or orders, write to care@yourhaircompany.com.
Last reviewed . If anything here is unclear, write to care@yourhaircompany.com.