Privacy Policy

1. Information We Collect

We collect various types of information to provide and improve our services:

Personal Information You Provide

• Account Information: Name, email address, phone number, date of birth, username, and password
• Order Information: Billing address, shipping address, payment information
• Communication Data: Information you provide when contacting customer support or leaving reviews
• Health Information: Prescription details (if applicable) and medical history relevant to your orders

Information Automatically Collected

• Device Information: IP address, browser type, operating system, device type
• Usage Data: Pages visited, time spent on pages, links clicked, referral source
• Cookies and Tracking: Session cookies, preference cookies, and analytics cookies
• Location Data: Approximate location based on IP address

2. How We Use Your Information

We use your personal data for the following purposes:

• Order Processing: To process and fulfill your orders, manage payments, and arrange delivery
• Account Management: To create and manage your account, verify your identity
• Customer Service: To respond to your inquiries, provide support, and resolve issues
• Communication: To send order confirmations, shipping updates, and important account notifications
• Marketing: To send promotional emails and offers (only with your consent)
• Legal Compliance: To comply with pharmaceutical regulations, tax requirements, and legal obligations
• Security: To prevent fraud, unauthorized access, and ensure platform security
• Analytics: To understand user behavior and improve our website and services

Legal Basis (GDPR Article 6): Contract performance, legal compliance, legitimate interests, and your consent.

3. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience:

• Essential Cookies: Required for website functionality and checkout process
• Performance Cookies: Help us understand how visitors use our website
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to display relevant advertisements (requires consent)

You can manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect website functionality.

4. Sharing Your Information

We do not sell your personal data. We may share your information with trusted third parties:

• Payment Processors: To process credit card and payment transactions securely
• Shipping Partners: To deliver your orders (courier services)
• Cloud Service Providers: For data storage and hosting (Shopify infrastructure)
• Analytics Providers: Google Analytics, Facebook Pixel (with consent)
• Email Service Providers: For sending transactional and marketing emails
• Legal Authorities: When required by law or to protect our legal rights

All third-party service providers are contractually obligated to protect your data and use it only for specified purposes.

5. Data Security

We implement industry-standard security measures to protect your personal information:

• SSL/TLS encryption for all data transmission
• Secure payment processing through PCI-DSS compliant payment gateways
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Data encryption at rest and in transit
• Regular backups and disaster recovery procedures

While we take reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Until you request account deletion
• Order History: 7 years for tax and legal compliance purposes
• Marketing Data: Until you unsubscribe or withdraw consent
• Health Data: As required by pharmaceutical regulations

After the retention period, we will securely delete or anonymize your data.

7. Your Rights Under Indian DPDPA 2023

Under India's Digital Personal Data Protection Act, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for marketing communications or data processing
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity

To exercise these rights, contact us at support@alphajoshh.com with your request.

8. Your Rights Under GDPR (EU Customers)

If you are located in the European Union, you have additional rights under GDPR:

• Right to Object: Object to certain data processing activities
• Right to Restrict Processing: Request limitation of data processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority

9. Children's Privacy

Our website is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and stored on servers located outside India. We ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant authorities
• Data processing agreements with service providers
• Compliance with applicable data protection laws

11. Marketing Communications

With your consent, we may send you promotional emails about new products, special offers, and other updates:

• You can opt-out anytime by clicking the "unsubscribe" link in our emails
• You can update your email preferences in your account settings
• Opting out of marketing emails will not affect transactional emails (order confirmations, shipping updates)

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

13. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities within 72 hours as required by law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification for material changes
• Requesting renewed consent where required by law

Your continued use of our website after changes indicates acceptance of the updated policy.

15. Contact Us & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

16. Grievance Redressal

If you have any complaints regarding data processing or privacy concerns, you may file a complaint with:

• Internal: Contact our grievance officer at support@alphajoshh.com
• External: Data Protection Board of India (once operational under DPDPA 2023)

Last updated: January 23, 2026

Version: 1.0