Privacy Policy

This Privacy Policy describes how Aesthetic World Group Pvt. Ltd. ("we", "us") processes personal data ("Data") in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules. For the purposes of the DPDP Act, you are the "Data Principal" and we are the "Data Fiduciary".

The data we collect depends on your member category:

• All members: name, mobile number, email, OTP-verified phone, IP address, device fingerprint, language preference.
• Practitioners: NMC/SMC registration numbers and state, qualification certificates, professional photo, years of experience, specialty.
• Clinics & centres: business PAN, GSTIN, drug licence number, clinic photographs, address, treatment offerings.
• Brands: cosmetic licence number, drug licence number, GSTIN, brand documents.
• Vendors: GSTIN, OEM authorisation letters, service area information.
• Institutes: recognition authority and number, accreditation body, course catalogue.
• Patients (members): date of birth, skin/scalp concerns, allergies (only with explicit health journal consent).
• Aadhaar: stored only as an irreversible hash. We do not store the raw Aadhaar number.
• Activity data: brief responses, enquiries, in-platform messages, AI conversation logs, payment metadata.

We process Data only for the specific, lawful purposes consented to by you: verification of your credentials, matchmaking inside the network, processing payments, facilitating brief responses, AI personalization (only with consent), regulatory compliance, fraud and abuse prevention, and audit.

Retention periods reflect Indian regulatory expectations and our internal audit policy:

• Aadhaar hash: 7 years after account deactivation.
• Transaction and tax records: 8 years (Section 36 CGST Act, 2017 / Income Tax Act).
• AI conversation logs: 2 years.
• KYC documents: 5 years after deactivation.
• Marketing preferences: deleted within 30 days of explicit withdrawal request.

We share Data only with named third-party processors strictly necessary to operate the platform:

• IDfy — KYC, document and PAN verification (data centres in India).
• HyperVerge — facial liveness and selfie matching (data centres in India).
• Razorpay — payment processing (data centres in India).
• Amazon Web Services (Mumbai region) — primary hosting and storage.
• Anthropic, OpenAI — AI inference (United States). Cross-border transfer occurs only with your explicit consent under Section 16 of the DPDP Act, 2023.

We transfer data to AI providers in the United States solely for the purpose of running approved AI features. Your explicit, granular consent is obtained on first use. You may withdraw this consent at any time, after which AI features will be disabled for your account.

Under Sections 11 to 14 of the DPDP Act, 2023 you have the right to:

• Access and obtain a summary of your Data and processing activities.
• Correct, complete or update any inaccurate or incomplete Data.
• Erase your Data, subject to retention obligations.
• Port your Data in a structured, machine-readable format.
• Withdraw any consent previously given.
• Nominate another individual to exercise your rights upon death or incapacity.
• File a grievance with our Grievance Officer at grievance@aestheticworld.in.

All rights are exercisable self-serve from your member dashboard, or by emailing our Data Protection Officer at dpo@aestheticworld.in.

Cookie categories, controls and AI disclosure are documented in our Cookie Policy. Every AI-generated suggestion or text is labelled "AI assisted". The AI Skin Advisor is an informational tool and is not a medical diagnosis.

Members must be 18 or above. Where a patient is under 18 and registered through a guardian, verifiable parental KYC is required under Section 9 of the DPDP Act, 2023. We do not knowingly process behavioural advertising data of minors.

We may update this Policy. Material changes will be notified at least 15 days in advance via in-app banner and email. The current version is dated 18 May 2026.