Privacy Policy

Effective date: 15 October 2026  |  Version: 5.0

This Privacy Policy explains how THC - The Herb Culture Private Limited, a company incorporated under the Companies Act, 2013, with its registered office in Mumbai, Maharashtra, which operates THC Store India (www.thcstore.in) ("THC Store", "we", "us", "our"), collects, uses, shares, stores and protects your personal data when you use the THC Store website and related services (the "Platform") as a customer or guest. It applies together with our Customer Terms & Conditions.

We act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and as a body corporate under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

---

1. Key terms

• Personal data — any data about an individual who can be identified from it.
• Sensitive personal data — including passwords, financial information, and health information such as prescriptions, symptoms, medical history and consultation records ("Health Data").
• Processor — a service provider that handles personal data on our behalf.
• Brand Partner — an independent seller on the Platform. Doctor — an independent registered practitioner who provides consultations through the Platform.

2. What we collect

2.1 Information you give us

Category	What
Account	First and last name, email address, mobile number, optional second phone number, date of birth (used to check you are 18 or over), gender, profile photo, password (stored only as a bcrypt hash).
Guest checkout	First name (last name optional), email, phone, date of birth and shipping address. A customer account is created automatically from these details.
Google sign-in	Your Google account identifier, email address, name and profile picture.
Addresses	Name, phone and billing and shipping addresses. If you use a business account, your GSTIN and PAN (PAN is stored encrypted).
Identity / age documents	If you upload one, the document type and the full image or scan of the document (for example a PAN card, Aadhaar card, voter ID, driving licence or passport).
Health Data	Prescriptions you upload or a Doctor issues (including diagnosis, medicines and notes); consultation intake (symptoms, medical history, current medications, allergies, reason for visit); your Doctor's consultation notes; follow-ups; and consultation recordings, if you consent to one.
Dosage calculator	If you use it: your goal, body weight, product type, prakriti and the results shown.
Orders and payments	Orders, invoices, refunds, payment status, the payment method type, and bank details you give us for a COD refund. We do not receive or store your full card number, CVV, UPI PIN or bank login — these are handled by Razorpay.
Rewards	Loyalty points, tier, check-ins, referrals, coupons, membership and subscriptions.
Support and messages	Chat assistant conversations, support tickets, emails to support@thcstore.in, WhatsApp messages, contact-form messages, and messages with Brand Partners and Doctors.
Reviews	Reviews, ratings, questions and photos you post.
Consent records	Each time you accept one of our legal documents: the document, its version, how you accepted (registration, guest checkout, consultation booking or re-acceptance), the time, your IP address and browser details.

2.2 Information collected automatically

• Device and log data: IP address, browser and device details (user agent) and your user ID with each request, plus the IP and browser details of your last login.
• Search and browsing: searches you make (linked to your account when you are logged in), products you view, compare lists and stock or price alerts. Recently viewed products and search history are also kept in your browser.
• Location: on your first visit, the site asks your browser for your location to fill in your pincode. If you allow it, the coordinates are sent to Google Maps to find your address area and are kept in your browser; we do not store them on our servers or with your saved addresses. You can refuse or withdraw this permission in your browser.
• Email tracking: our emails contain a small tracking image and tracked links, served from our own servers, so that we can see whether an email was opened and which links were clicked.
• Analytics: see section 9 (cookies and Google Analytics).

3. Why we use your data, and on what basis

Purpose	Basis
Creating and securing your account; processing orders, payments, deliveries, returns and refunds; issuing invoices; running memberships, subscriptions, loyalty and referrals; customer support	Your consent given when you accept our Terms and this Policy, and our legitimate uses under section 7 of the DPDP Act for the service you asked for
Prescription review for prescription-required products; booking and conducting consultations; issuing prescriptions	Your consent, given when you upload a prescription or book a consultation and accept this Policy
Checking your age; tax and GST records; responding to lawful requests	Legal obligation
Fraud and abuse prevention, security, rate limiting, account lockouts	Legitimate uses and legal obligation
Service messages (orders, payments, refunds, prescriptions, consultations, security, policy updates)	Needed to provide the service
Newsletters, offers and product suggestions; analytics	Your consent (see sections 8 and 9)

When we change this Policy materially, you are asked to accept the new version, and that acceptance is recorded. We do not currently keep a separate consent record for each optional purpose (such as sharing health information with a Doctor or receiving marketing); your consent for these is recorded through your acceptance of this Policy and your newsletter and marketing settings.

4. Who we share your data with

4.1 Brand Partners (sellers)

When you order from a Brand Partner, it receives your name, email address, phone number, billing and shipping addresses (including any GSTIN) and the order details, so that it can fulfil and invoice the order. For prescription-required items, the Brand Partner reviews your prescription for its own items and sees the prescription image, diagnosis, medicines and instructions. A Brand Partner's panel can also currently show some other profile details of customers who have ordered from it (for example date of birth, gender, alternate phone and technical details of the last login). Brand Partners may message you about your orders and ask you for a review, and are not permitted to use your data for any other purpose.

4.2 Doctors

A Doctor you book with sees your name, email address, phone number, date of birth, gender and profile photo, the intake details you give (symptoms, history, medications, allergies), the prescriptions and notes they write, and the products you bought with or before the consultation. A Doctor keeps access to the records of patients they have had an appointment or message thread with. Doctors are bound by professional confidentiality.

4.3 Service providers

Provider	Data	Purpose	Location
Hostinger (servers)	All Platform data, including the database	Hosting	India (Mumbai)
Amazon Web Services — S3	Uploaded files (prescriptions, ID documents, photos), invoices, consultation recordings, database backups	File storage and backups	India (Mumbai)
Amazon CloudFront	Public images only (product and site media)	Content delivery	Global
Razorpay	Name, email, phone, amount, order and customer reference	Payments, refunds and payment links	India
Couriers chosen by the Brand Partner; Shiprocket and Delhivery where used	Name, phone, delivery address, parcel contents and COD amount (Shiprocket also receives email)	Delivery	India
Google Workspace (Gmail)	Every email we send you (including order, refund, appointment and one-time-code emails), and emails you send to support, which are read automatically into support tickets	Email	Outside India (including the US)
Gupshup and Meta (WhatsApp Business)	Phone number, message contents (for example your first name, order number and total, courier and tracking number, refund amount, Doctor name and appointment time, one-time codes) and messages you send us on WhatsApp	Service messages, one-time codes and WhatsApp support	India and outside India
AI providers — see section 5	Chat and search content	Chat assistant, search, support triage	Outside India (US; DeepSeek is a China-based provider)
Jitsi Meet (meet.jit.si, run by 8x8)	Audio and video of video consultations (no account data is sent)	Video consultations	Outside India
Google Calendar	Names and email addresses of you and your Doctor, where calendar invitations are sent	Appointment invitations	Outside India
Google Analytics	See section 9	Analytics	Outside India (US)
Google Sign-In; Google Maps	Sign-in details (section 2.1); browser location (section 2.2)	Login; pincode auto-fill	Outside India
Browser push services (for example Google, Mozilla, Apple)	Push subscription and notification text, only if you switch on browser notifications	Web push	Outside India
Wix, YouTube, Vimeo	Your IP address and browser details when pages load images or videos hosted by them	Embedded media	Outside India
Telegram	Operational alerts and answers produced by our internal tools (section 5.3)	Internal operations	Outside India
GitHub	Aggregated analytics and masked error logs (section 5.3)	Internal product analysis	Outside India

4.4 Apps you connect

If you connect an AI app (for example Claude or ChatGPT) to your account under "Connected AI", that app receives the data you allow it to access — such as orders, addresses, prescriptions and appointments — and its own privacy policy applies. To revoke an app's access, use the Connected AI page in your account or write to support@thcstore.in.

4.5 Authorities

We disclose personal data to courts, tax authorities, regulators or law enforcement when required by law or a lawful order.

4.6 What we do not do

• We do not sell your personal data.
• We do not use advertising or retargeting pixels and do not show third-party ads.
• We do not share your Health Data with employers, insurers or data brokers.

5. AI and automated processing

5.1 Chat assistant (site and WhatsApp)

• The chat assistant on the site, and WhatsApp messages from recognised customers, are answered by an AI model. It runs through OpenRouter (US) using Anthropic's Claude (US); if that is unavailable, it automatically switches to DeepSeek, a China-based model provider. Where Anthropic's own service is used directly, the data goes to Anthropic in the US.
• What is sent to the model: your recent messages in the conversation and, if you are logged in, the account information the assistant looks up to answer you — for example your orders (items, tax, tracking), addresses, refunds, invoices, loyalty, membership, referrals, wishlist, prescriptions (number, status and notes), appointments and messages with brands. Your messages and this information are not anonymised or redacted before they are sent.
• AI replies are sent automatically, without a person checking them first. Your message and the AI's answer are also assessed by an AI model to decide whether to pass the conversation to our team.
• Questions about refunds, payment failures, account deletion, fraud, chargebacks, legal matters and adverse reactions are always passed to our team without an AI answer. Medical, pregnancy, mental-health and emergency topics are also passed on. The assistant cannot cancel orders or issue refunds. If you would rather not use the AI assistant, contact us by email or phone.

5.2 Search

Search queries you type (which may relate to health) are sent to Google Gemini (US) to improve results. Your customer ID is not included. The most common searches that return no results are also analysed weekly in aggregated form.

5.3 Internal tools

• Our team uses an internal operations assistant that can look up customer records — including profile details (with email partly masked and only the last digits of the phone number), addresses and prescription details — to handle support and operations. What it looks up is processed by an AI model through OpenRouter and the answer is delivered to our team on Telegram.
• Automated analysis routines use aggregated Google Analytics data and error logs (with email addresses and numbers masked) to produce product reports, which are processed by Anthropic and stored in our GitHub repository, with summaries sent to our team on Telegram.

5.4 Automated decisions

Some decisions are made automatically by rules: COD is refused above the ₹500 limit or for prescription carts; some return requests for damaged or defective items with photos are approved automatically; unpaid online orders may be cancelled; accounts are locked after repeated failed logins; and refund requests may be flagged for manual review. No account is blocked solely by an automated fraud check. You can ask us to review any automated decision by writing to support@thcstore.in. Prescriptions and consultations are not assessed by AI.

6. Health Data

• We use Health Data only to review prescriptions for prescription-required products, to arrange and conduct consultations, to issue and store prescriptions, and for follow-ups. We do not use it for advertising.
• Health Data is shared with the Brand Partners whose items need your prescription (section 4.1) and with your Doctor (section 4.2). It may also reach our AI providers and internal tools as described in section 5, and our authorised staff.
• Uploaded prescription files are kept in our private AWS S3 storage with server-side encryption. Prescription details, consultation intake and notes are stored in our main database, protected by access controls; they are not separately encrypted at field level.
• Consultation recordings: a consultation is recorded only if you agree; the Doctor confirms your consent before recording, and the time and IP address are logged. Recordings are stored in our private S3 storage and can be played back only by our admin team. We do not currently delete recordings automatically.
• You can see your prescriptions in your account.

7. Identity and age documents

If you upload an identity document, we store the full image as you upload it, in our private S3 storage. We do not mask or redact numbers on it, so if you upload an Aadhaar card, we recommend using a masked Aadhaar (with most of the number hidden), which UIDAI lets you download. The document is kept until you replace it or ask us to delete it. It is used only to verify your age and identity.

8. Marketing and messages

• Newsletter and blog updates: sent if you subscribe. You can manage categories and unsubscribe from the link in the email.
• Win-back, birthday and re-engagement emails are sent only if you have subscribed to our newsletter.
• Reminders and suggestions: we may email you reminders about items left in your cart (up to 2 per cart), suggestions after a delivery, and suggestions based on products you browsed. These are currently sent to customers whether or not they have subscribed to marketing. To stop them, write to support@thcstore.in.
• WhatsApp is used for service messages and support only, not for marketing broadcasts. You can opt out of WhatsApp messages by telling us.
• We do not send SMS. Browser push notifications are sent only if you switch them on.

9. Cookies, browser storage and Google Analytics

9.1 Cookies we set

Cookie	Lifetime	Purpose
accessToken	24 hours	Keeps you logged in (not readable by scripts)
refreshToken	7 days	Renews your login (not readable by scripts)
clientAccessToken	24 hours	Tells the site you are logged in
customerCsrfToken	24 hours	Security against forged requests
guestToken	30 days	Identifies a guest cart
thc_affiliate_ref	30 days	Records an affiliate referral
ageVerified	30 days	Remembers an age confirmation
language	1 year	Language preference

Third parties also set cookies: Google Analytics (_ga cookies), Google Sign-In, Razorpay at payment, and YouTube or Vimeo where videos are embedded.

9.2 Browser storage

Your browser also stores your cart and checkout progress (including prescription references), recently viewed products, search history, compare lists, stock and price alerts, your pincode and location, your cookie-banner choice and a session identifier. You can clear these through your browser settings.

9.3 Google Analytics

We use Google Analytics 4 to measure how the site is used. It records pages viewed and shopping events, and when you are logged in it also receives your internal customer ID. It also records events such as booking a consultation (with the Doctor's name) and uploading a prescription. The cookie banner currently records your choice but does not switch Google Analytics off; Google Analytics loads for every visitor. You can block it with your browser's privacy settings or a Google Analytics opt-out add-on. How long Google keeps this data depends on our Google Analytics settings.

10. How long we keep data

Data	What happens
Support chat, ticket and direct-message text	After 90 days, the text of chat messages, and of tickets once closed, and direct messages is replaced with a "content removed" marker. Raw WhatsApp message text and AI summaries are cleared on the same 90-day cycle. A record that the conversation took place stays.
Login and security events	Deleted after 90 days
Server and access logs (IP address, browser, user ID)	About 30 days
Activity logs	Hidden after 90 days but not erased from the database
Outgoing email queue; outgoing WhatsApp message text	30 days; 90 days
Expired one-time codes and reset links	Cleared every 15 minutes
Database backups	7 days on our server and 90 days in AWS S3
Account and profile, addresses, orders, invoices, prescriptions, consultation records and recordings, identity documents, dosage-calculator records, search history, notifications, consent records	No automatic deletion. We keep these while your account exists and afterwards for tax, legal and dispute purposes. You can ask us to erase data we are not legally required to keep (section 11).

When an account is closed, it is deactivated and hidden but its records are not erased automatically.

11. Your rights

Under the DPDP Act and the SPDI Rules you may:

• access a summary of the personal data we hold about you and how we use and share it;
• correct or update inaccurate or incomplete data (most profile details can be edited in your account);
• erase data that is no longer needed, except where we must keep it by law;
• withdraw consent at any time — this does not affect processing already done, and may mean we can no longer provide some services;
• nominate another person to exercise your rights if you die or become unable to;
• raise a grievance with us and then, if unsatisfied, with the Data Protection Board of India.

How: email support@thcstore.in with the subject "Privacy:" and your request. There is no self-service delete or nominee feature at present, so these are handled by email. Your profile page also has a "Request Data Export" option. We will check your identity before acting. We acknowledge requests within 48 hours and respond within one month. Requests are free of charge.

12. Security

We take reasonable security measures, including:

• HTTPS (TLS) for all connections to the Platform;
• passwords stored only as bcrypt hashes (cost 12);
• encryption (AES-256-GCM) of PAN and bank details in our database, and server-side encryption (AES-256) of files and backups in AWS S3;
• private files served only to their owner or through links that expire after 5 minutes;
• optional two-factor login by emailed code, account lockout after 10 failed attempts for 30 minutes, and rate limits on logins and one-time codes;
• a content security policy and protection against forged requests;
• role-based staff access, and audit logs of staff changes, logins and financial actions.

Other data, including Health Data, is stored in our main database without separate field-level encryption, and staff viewing of records is not individually logged. Uploaded files are checked for type and size but are not scanned for malware. No system is completely secure; please use a strong, unique password, switch on two-factor login and tell us at once if you suspect misuse of your account.

13. Personal data breaches

If a personal data breach occurs, we will take steps to contain it and will notify the Data Protection Board of India, CERT-In and affected users as required by law.

14. Transfers outside India

Our servers and file storage are in India (Hostinger and AWS, Mumbai). Some processors handle data outside India: Google (Gmail, Gemini, Analytics, Sign-In, Maps, Calendar), OpenRouter and Anthropic (US), DeepSeek (a China-based provider, reached through OpenRouter, whose data centre location depends on OpenRouter's routing), Jitsi/8x8, Telegram, GitHub, Gupshup and Meta (WhatsApp), browser push services, and CloudFront, Wix, YouTube and Vimeo for public media. By using the Platform you agree to these transfers. We will not transfer personal data to any country the Government of India restricts under the DPDP Act.

15. Children

The Platform is only for people aged 18 and over, and we check date of birth at sign-up, guest checkout and consultation booking. If you believe someone under 18 has given us personal data, write to support@thcstore.in and we will delete it.

16. Links to other sites

The Platform may link to other websites and services. Their own privacy policies apply, and we are not responsible for them.

17. Anonymised data

We may create anonymised or aggregated statistics from personal data. Data that can no longer identify you is not personal data.

18. Changes to this Policy

When we change this Policy materially, we publish a new version with a summary of changes and ask you to accept it before you continue using the Platform. Minor corrections may be made without re-acceptance; the effective date and version are always updated.

19. Grievance Officer and data protection contact

Under the SPDI Rules (rule 5(9)), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, our Grievance Officer and contact for data protection questions is Mr. Krishnakant Tiwari, Founder — email support@thcstore.in (subject "Privacy:" or "Grievance:"), phone +91 81692 69688, at our registered office. We acknowledge complaints within 48 hours and resolve them within one month of receipt. If you are not satisfied, you may approach the Data Protection Board of India.

20. Governing law

This Policy is governed by the laws of India, and the courts at Mumbai, Maharashtra have jurisdiction, without affecting your statutory rights under data protection and consumer law.

21. Contact us

THC - The Herb Culture Private Limited, trading as THC Store India (www.thcstore.in), a company incorporated under the Companies Act, 2013.

• Registered office: A-504, Raghukul CHS, Valley Complex, Near Dindoshi Depot, Malad East, Mumbai, Maharashtra 400097, India
• CIN: U52100MH2020PTC335594
• GSTIN: 27AAHCT6948E1ZZ
• Email: support@thcstore.in
• Phone: 022 7961 7885 | +91 81692 69688 | +91 79054 42943
• WhatsApp: +91 81692 69688
• Support hours: Monday–Saturday, 10 AM – 7 PM IST
• Grievance Officer and data protection contact: Mr. Krishnakant Tiwari, Founder — support@thcstore.in (subject "Grievance:" or "Privacy:"), +91 81692 69688, at the registered office above
• Social: Instagram @thcstore.india and @thcindia.store, Facebook, X (Twitter), YouTube @THCSTOREINDIA

Last updated: 15 October 2026