English
Your data, handled plainly.
What we collect, why, how long we keep it, and how to use your rights under the Digital Personal Data Protection Act, 2023.
Last updated: 30 September 2026 · Version 2026-09-24
We never sell your data
Your personal data is never sold, rented or used for advertising profiles.
Only what we need
We collect the minimum needed to run your account and orders — nothing else.
You're in control
Download, correct or delete your data, or withdraw consent, from your account.
Who we are
Sehat Sutra (sehatsutrahealth.online) is a brand of M/s Zara Global, a Registered Partnership Firm. M/s Zara Global is the Data Fiduciary for your personal data: we decide why and how it's used. This notice applies to our website, store and emails.
What we collect and why
We only use each item for the purpose listed next to it.
| When | Personal data | Purpose | Basis | How long we keep it |
|---|---|---|---|---|
| Creating an account | Name, email, password (stored only as a one-way hash), phone if you add it | Sign you in, show your orders and library, let you manage your data | Your consent (tick-box at sign-up) | Until you delete your account |
| Placing an order | Name, email, phone (optional), items bought, amount, payment method and status | Process the order, deliver e-books and courses, send receipts and support replies | Your consent at checkout, and to fulfil the purchase you asked for | 8 years, as required by Indian tax and accounting law (GST and the Companies/Income-tax Acts) |
| Downloading a purchase | Time of each download and the IP address it came from | Apply the download limits on your links and stop purchase links being shared | To fulfil the purchase you asked for | 12 months, then deleted |
| Newsletter and offers | Send occasional emails about new titles and offers | Your separate, optional consent | Until you unsubscribe; the address is then removed within 12 months | |
| Contact form | Name, email, topic and your message | Reply to you and handle support, refund or privacy requests | Your consent when you send the message | 2 years, then deleted |
| Using the website | Session cookie (if signed in), currency preference cookie, cart saved in your browser | Keep you signed in, show prices in your currency, remember your bag | Strictly necessary for the service | Sign-in: 30 days. Currency: until cleared. Cart: in your browser only |
We don't collect health records, card numbers or UPI PINs. Card and UPI payments are handled entirely by our payment gateway.
Your consent, and withdrawing it
- We ask with a clear tick-box or button, never a pre-ticked box.
- Marketing emails are a separate, optional choice. Saying no never affects an order.
- Withdraw anytime, as easily as you gave it: use Unsubscribe, the Privacy section of your account, or email us.
- We keep a record of when you gave or withdrew consent, so we can prove it.
Withdrawing consent stops future use. It doesn't undo processing already done, and we may still keep order records the law requires.
Your rights
- Access: get a summary of your data and how it's used. Use “Download my data” in your account.
- Correction and updating: fix your name or phone in your account, or ask us to correct anything else.
- Erasure: delete your account from your account page, or ask us by email.
- Nominate: name someone to exercise your rights if you die or become unable to.
- Complaints: tell us if something isn't right (see below).
If you don't have an account, email us or use the contact form with the topic “Privacy / data request”. We may ask you to confirm your identity first.
Children
Our store and accounts are for adults aged 18 and over. We don't knowingly collect personal data from children or track, profile or target advertising at them. If you believe a child has given us their data, contact us and we'll delete it.
Cookies and browser storage
We use only what's strictly needed to run the site: a sign-in cookie, a currency cookie, and your cart saved in your own browser. We also use Google Analytics, which sets its own cookies (_ga) to count visits and see which pages are read, from anonymised device and browser details. We don't use advertising or cross-site tracking cookies, and we don't send your name, email or orders to Google. You can block these cookies in your browser or with Google's opt-out add-on.
Who we share it with
Only Data Processors working on our instructions, under contract, and only as needed: our hosting and database provider, our payment gateway, our email delivery provider, and Google (Analytics). They may not use your data for their own purposes. We'll also share data if the law requires it, for example with tax or law-enforcement authorities.
How we protect it
- Encrypted connections (HTTPS) everywhere on the site.
- Passwords stored only as strong one-way hashes; sign-in tokens stored hashed.
- Staff access limited by role, with sign-in protection against guessing attacks.
- If a personal data breach happens, we'll inform the Data Protection Board of India and the affected people without delay, with what happened and what you can do.
Questions and complaints
For any question, request or complaint about your personal data, email:
We'll acknowledge your request promptly and resolve it within 90 days at the latest. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
Changes to this notice
- 24 September 2026: Rewritten for the Digital Personal Data Protection Act: itemised data and purposes, retention periods, your rights, and who to contact.
If we change how we use your data, we'll update this page and its version number, and ask for fresh consent where the law requires it. You can request this notice in English or any language in the Eighth Schedule to the Constitution by writing to us.