Privacy Policy

1. Data Fiduciary Information

Dermowish (operated by Dermowish Healthcare) is the Data Fiduciary responsible for the processing of your personal data under the DPDP Act, 2023.

2. Personal Data We Collect

We collect the following categories of digital personal data:

• Identity Data: Name, email address, phone number
• Order Data: Shipping address, purchase history, payment transaction IDs
• Account Data: Login credentials (password stored in hashed form only)
• Communication Data: Messages via contact form, newsletter subscription email
• Technical Data: IP address, browser type, device information (via cookies)

Note: We do NOT collect sensitive personal data such as biometric data, health records, financial credentials (card numbers are processed by Razorpay and never stored on our servers), caste, religion, or political opinion.

3. Purpose of Data Processing

As required under Section 4 of the DPDP Act, we process your data only for the following lawful purposes:

• Processing and fulfilling your orders
• Communicating order status, shipping updates, and delivery confirmations
• Managing your account and providing customer support
• Sending newsletters and promotional offers (only with your explicit consent)
• Improving our website experience and product recommendations
• Compliance with legal and regulatory obligations

4. Consent

In accordance with Section 6 of the DPDP Act, 2023, we obtain your free, specific, informed, unconditional, and unambiguous consent before collecting or processing your personal data.

• Consent is obtained via clear affirmative action (cookie banner, checkout form submission, newsletter opt-in).
• You may withdraw your consent at any time by contacting us or using the options described in Section 7 below.
• Withdrawal of consent does not affect the lawfulness of processing done prior to withdrawal.

5. Data Retention

We retain your personal data only as long as necessary for the purposes described above:

• Order data: Retained for 5 years for tax/legal compliance
• Account data: Retained until you delete your account
• Newsletter subscriptions: Until you unsubscribe
• Contact messages: Retained for 1 year from resolution
• Cookies & technical data: Maximum 12 months

Upon expiry of the retention period, data is permanently erased or anonymized.

6. Data Sharing & Third Parties

We do NOT sell your personal data. We share data only with:

• Payment processor: Razorpay (for secure payment processing — PCI DSS compliant)
• Shipping partners: For order delivery (only name, address, and phone)
• Email service: For transactional and marketing emails (only email address)
• Hosting: Vercel (website hosting) and Supabase (database — data stored in India/Singapore)

All third-party processors are bound by data processing agreements and process data only on our instructions.

7. Your Rights (Data Principal Rights)

Under the DPDP Act, 2023, you have the following rights as a Data Principal:

To exercise any of these rights, email us at privacy@dermowish.com or use our Contact Page. We will respond within 30 days.

8. Cookies & Tracking

We use the following types of cookies:

• Essential cookies: Required for site functionality (cart, authentication)
• Analytics cookies: To understand how visitors use our site (only with consent)
• Marketing cookies: For relevant advertisements (only with consent)

You can manage cookie preferences via the consent banner shown on your first visit or by clearing your browser data.

9. Data Security

• All data transmission is encrypted via TLS/SSL (HTTPS)
• Passwords are stored using industry-standard hashing (bcrypt via Supabase Auth)
• Payment data is handled exclusively by Razorpay (PCI DSS Level 1 certified)
• Access to personal data is restricted to authorized personnel only
• We implement reasonable security safeguards as required under Section 8 of the DPDP Act

10. Children's Data

Our services are not intended for individuals below 18 years of age. We do not knowingly collect personal data from children. As per Section 9 of the DPDP Act, processing of children's data requires verifiable parental consent. If we become aware that we have collected data from a child without proper consent, we will delete it promptly.

11. Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without unreasonable delay, as mandated under Section 8(6) of the DPDP Act.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. For significant changes, we will notify you via email or a prominent notice on our website.