PRIVACY POLICY & DATA PROTECTION NOTICE AYUROOMS AND WELLNESS PVT LTD

‍

‍

(Operating the website and platform “Ayurooms”, www.ayurooms.com) Designed with regard to the DPDP Act, 2023 / DPDP Rules, 2025 and applicable international data protection standards

‍

READ THIS CAREFULLY BEFORE PROCEEDING: Ayurooms is a wellness-travelcuration, concierge and booking platform. We help you discover, compare andbook stays at independently owned and operated Ayurvedic resorts, wellnesscentres and healthcare facilities across India (each, a “Partner Resort”).

‍

AYUROOMS DOES NOT PROVIDE, RENDER, SUPERVISE OR CONTROL ANY MEDICAL, AYURVEDIC OR OTHER HEALTHCARE TREATMENT. All medical consultations, diagnoses,

‍

Panchakarma protocols,therapies and treatment plans are independently designed and administered by the doctors, therapists and staff employed by the Partner Resort you choose tostay at. Ayurooms is an intermediary and travel-planning service, not a hospital,clinic or medical practitioner.

Any health, wellness orlifestyle information you share with us through our enquiry forms, website, orwellness consultants is used solely to help us understand your goals andrecommend, match and arrange a suitable Partner Resort and travel package for you.It is not used by Ayurooms to diagnose, treat, or provide clinical advice onany medical condition. If you are experiencing a medical emergency, please contact your nearest emergency medical service or hospital immediately, do notrely on this Platform or wait for a response from our team.

‍

1. OUR COMMITMENT TO YOUR PRIVACY

‍

Ayurooms was founded to help travellers safely and confidently access authentic, well-matched Ayurvedic wellness experiences inIndia. We understand that the information you share with us in order to be matched with the right Partner Resort, including your health goals, travelplans and personal circumstances, is sensitive and personal. We are committedto collecting, processing, storing and protecting your personal data in atransparent, secure and responsible manner. Where you are located in India, yourpersonal data is processed in accordance with the Digital Personal DataProtection (DPDP) Act, 2023, the Digital Personal Data Protection Rules, 2025,and the Information Technology Act, 2000. Because a significant number of our clients are located outside India, we also have regard to applicable international data protection standards and the requirements described inClause 7 (Cross-Border Transfer of Personal Data) below.

2. INFORMATION WE COLLECT & PURPOSES OF PROCESSING

‍

3. THE NATURE OF VALID CONSENT

‍

Your privacy and autonomy are fundamental to how we process your personal data. We process your personal data only after obtaining your valid consent, except where processing is other wise permitted or required by applicable law. By submitting an enquiry, requesting apersonalised package, creating an account, subscribing to our newsletter, oraffirmatively selecting “I AGREE” or an equivalent consent mechanism on our Platform, you acknowledge that your consent is free, informed, specific,unconditional and unambiguous, and that you have read and understood this Privacy Policy.

We do not bundle consent for unrelated processing activities. Wherever reasonably practicable, you may choose whether to share optional information (for example, detailed medical history) or participate inoptional features (such as testimonials or the Ambassador Program). You mayreview, update or correct your personal data at any time by contacting us using the details in Clause 10, subject to reasonable verification.

You may withdraw your consent, in whole or in part, at any time by contacting our Data Protection Officer. On withdrawal, we and ourauthorised data processors will cease processing the relevant personal datawithin a reasonable period, unless further processing is required or permittedby law. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. Where certain personal data (for example,your travel dates or payment details) is essential to complete a bookingalready in progress, withdrawing consent for that data may result in thatbooking or service being suspended or discontinued.

‍

4. USE BY MINORS

‍

Our Platform and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data directly from minors. Where a booking or package is intended for a family member, including a minor, the adult making the booking is responsible for providing any necessary information on that family member’s behalf and for obtaining any consents required under applicable law. If we become aware that we have in advertently collected personal data directly from a minor without appropriate consent, we will take reasonable steps to delete such data.

5. OUR ROLE AS AN INTERMEDIARY; HOW WE WORK WITH PARTNER RESORTS

‍

Ayurooms operates as a curated marketplace and booking intermediary. We do not own or operate any resort,wellness centre or medical facility. When you engage with us, we use the information you provide (your health goals, travel preferences and budget) to recommend one or more Partner Resorts suited to your needs.

Once you decide to proceed witha particular Partner Resort, we share the relevant portions of your Registration, Health & Wellness Goals, and Travel & Booking Data with that Partner Resort so that its medical and hospitality teams can prepare for your arrival, plan an appropriate treatment program, and provide services directly to you during your stay. Each Partner Resort processes the personal data shared with it as an independent data controller in accordance with its own privacy practices, which may differ from this Privacy Policy. We encourage you to review the Partner Resort’s own privacy policy, where available, before your stay. Ayurooms is not responsible for a Partner Resort’s subsequent use,storage or disclosure of your personal data once lawfully shared, other than asrequired under our contractual arrangements with that Partner Resort.

Where our Platform offers any automated enquiry assistant, chatbot, or recommendation tool, such tools areprovided to help you explore Partner Resorts and packages based on the information you input. They do not provide medical advice, and any suggested resort match or treatment focus generated by such tools is not a diagnosis or clinical recommendation.

6. SHARING AND DISCLOSURE OF PERSONAL DATA

‍

We treat your personal data with a high degree of confidentiality and do not sell, rent or trade your personaldata. Beyond the sharing with Partner Resorts described in Clause 5, we may share your personal data only to the extent necessary to provide, operate and improve the Platform, with trusted third parties who are contractually obligated to protect your information and use it only for authorised purposes,including:

➢ Cloud hosting, website and IT infrastructure providers;

➢ Payment gateway and financial service providers,to process your payments;

➢ Visa facilitation partners, and, where you request visa assistance, relevant consulates, embassies or immigration authorities;

➢ Airport transfer, concierge and logistics partners engaged to support your trip;

➢ Communication, analytics and marketing serviceproviders who help us operate and improve our website and outreach; and

➢ Professional advisors (legal, accounting) where necessary for our business operations. We may also disclose your personal data where required by applicable law, pursuant to a lawful order of a court,government authority or regulatory body, or where necessary to establish,exercise or defend legal rights, prevent fraud, or protect the safety of our users. In all cases, we take reasonable steps to ensure recipients of your personal data maintain appropriate confidentiality and security standards.

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

‍

Many of our clients are located outside India, while our Platform, our team, and our Partner Resorts are based in India. As a result,your personal data will typically be collected, stored and processed in India,and, where relevant, transferred to Partner Resorts and service providers located in India. Where you request visa assistance, your passport, identity and travel information may also be shared with Indian consulates, embassies,immigration authorities, or authorised visa facilitation partners in your country of residence or in India, solely for the purpose of processing your visa application. We take reasonable contractual, technical and organisational steps to ensure that any cross-border transfer or processing of your personal data is subject to safeguards consistent with applicable law.

8. DATA SECURITY, RETENTION, ERASURE AND BREACH NOTIFICATION

Security Safeguards

‍

We implement reasonable technical and organisational security measures, including encryption of data intransit, access controls, and restricted role-based access to personal data,designed to protect your personal data against unauthorised access, alteration,disclosure, loss or misuse, in line with Section 8(5) of the DPDP Act and Section 43A of the Information Technology Act, 2000.

Retention Period

‍

We retain your personal data only for as long as necessary to provide our services to you, maintain your account, complete and support any bookings, and comply with our legal, tax and accounting obligations. Health & Wellness Goals Data shared for the purpose of arranging a specific stay is retained only for as long as needed for that booking and any related follow-up, unless you ask us to retain it for future personalised recommendations.

Data Erasure

‍

[To be finalised: e.g.,  “If you request deletion of your account, or your account remains inactive for  a continuous period of [X years], your personal data will be erased from our  servers and those of our data processors, subject to any retention period  required by applicable law (for example,

financial  records).”]

Personal Data Breach Notification

‍

In the event of a personal data breach affecting your personal data, we will, in accordance with Section 8(6)of the DPDP Act and the DPDP Rules, 2025, notify the Data Protection Board of India and inform affected Data Principals without undue delay. Any such notification will be provided in plain language and will describe the nature ofthe breach, its likely consequences, the measures taken or proposed to mitigate the risk, and contact details for further assistance.

9. RIGHTS OF THE DATA PRINCIPAL

‍

Under the provisions of the DPDP Act, subject to applicable law, you have the following rights in respect of your personal data:

‍

➢ Right to Access to obtain a summary of the personal data we hold about you, the processing activities undertaken, and the identities of any third parties (including Partner Resorts) with whom it has been shared.

➢ Right to Correction and Erasure:  to correct inaccurate or misleading data,complete incomplete information, update changed details, or request erasure ofyour personal data once the purpose for which it was collected has been fulfilled, subject to our legal retention obligations.

➢ Right to Grievance Redressal: to have your grievance addressed by us before escalating it to the Data Protection Board of India.

➢ Right to Nominate: to nominate another individual to exercise your rights under this Policy in the event of your deathor incapacity.

‍

In accordance with the DPDP Rules, 2025, we will respond to a verified request under this Clause within ninety (90) days of receipt. Youmay exercise these rights by contacting us using the details in Clause 10.

‍

Where you are located outside India, and to the extent applicable law in your jurisdiction (for example, the EU/UK General DataProtection Regulation) grants you additional or equivalent rights such as the right to rectification, restriction of processing, objection to processing, or data portability, we will, as a matter of good practice, extend comparable treatment to your request where reasonably practicable.

‍

10. GRIEVANCE REDRESSAL MECHANISM & STATUTORY COMPLAINTS

‍

In accordance with Section 8(9) of the DPDP Act, we publish below the business contact information of our designated Grievance Officer / Data Protection Officer, who is able to answer questions regarding the processing of your personal data and to whom you may address any queries,concerns, or grievances, or through whom you may exercise any of the rights described in Clause 9:

‍

Name of Grievance Officer / DPO: Husaina Karmalawala

Designation: Data Protection Officer & Compliance Hea

Address:124 Viraj, 1st Floor, S.V. Road, Khar (West), Above HDFC Bank, Mumbai, Maharashtra, India – 400052

Email Contact: support@ayurooms.com (or via www.ayurooms.com/contact-us)

‍

In accordance with the DPDP Rules, 2025, we will acknowledge and endeavour to resolve your grievance with in ninety (90) days of receipt. If you are unsatisfied with our response, or believe your data protection rights have been violated, you have the right to file a complaint with the Data Protection Board of India (DPBI) through its online portal, or, where applicable, with your local data protection authority.

11. LANGUAGE AVAILABILITY

‍

This Privacy Policy is currently available in English. [If/when made available in additional languages, they will be accessible via a language toggle on our Platform. Confirm applicability of

DPDP Act Section 5(3) multi-language requirements with legal counsel based on your user base.]

‍

12. CHANGES TO THIS PRIVACY POLICY

‍

We may revise, modify or update this Privacy Policy from time to time to reflect changes in applicable law, our business operations, our Partner Resort network, or the services offeredthrough the Platform. Any revised version will be posted on the Platform and will become effective from the date specified. Where changes materially affect how we collect, use, process or disclose your personal data, we will provide appropriate notice through the Platform or other communication channels. Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes acknowledgement of those changes, except where fresh consentis required by applicable law, in which case we will obtain such consent before further processing your personal data.

‍

© 2026 AYUROOMS & WELLNESS PRIVATE LIMITED | ALL RIGHTS RESERVED.

‍

Unless otherwise expressly stated, all content available on this website, including text, written materials, articles, photographs, images, graphics, illustrations, designs, logos, trademarks, trade names, videos, audio recordings, software, website layout, and other materials, is owned by or licensed to Ayurooms & Wellness Private Limited and is protected under applicable intellectual property laws, including the Copyright Act, 1957, and other applicable laws in India.

‍

No part of this website or its content may be copied, reproduced, republished, uploaded, posted, transmitted, distributed, modified, adapted, commercially exploited, or otherwise used, in whole or in part, without the prior written consent of Ayurooms & Wellness Private Limited except where such use is expressly permitted under applicable law.

‍

Any unauthorised use, reproduction, distribution, or exploitation of the content of this website may constitute an infringement of the intellectual property rights of Ayurooms & Wellness Private Limitedor the relevant rights holder and may attract appropriate civil or other legal proceedings in accordance with applicable law.

All trademarks, service marks, logos, brand names, and other proprietary identifiers appearing on this website are the property of their respective owners. Nothing contained on this website shall be construed as granting any licence or right to use any such intellectual property without the prior written permission of the relevant rights holder.

‍

Where this website contains third-party materials, references, or content, such materials remain the property of their respective owners and are subject to the applicable rights and permissions governing their use.

‍

For permissions, licensing enquiries, or reports concerning the use of any content appearing on this website, please contact us at support@ayurooms.com

All rights not expressly granted are reserved.

‍

‍