Privacy and Data Protection Policy ("Privacy Policy")

This Privacy Policy outlines how Herbaveda Wellness Pvt. Ltd. and its affiliated services (“Proman”, “we”, “us”, or “our”) may collect, use, disclose, or otherwise process your personal data when you use our website at https://proman-active.com/ (“Website”), in accordance with the applicable Indian data protection laws, including the Information Technology Act, 2000 and related rules. This Privacy Policy applies to personal data in our possession or under our control, including data handled by third-party service providers acting on our behalf.

If you do not agree to this Privacy Policy or our Terms and Conditions, please refrain from using our Website or services. Continued use of the Platform indicates your acceptance and acknowledgment of the terms stated herein.

PERSONAL DATA

1. As used in this Privacy Policy:

“Customer” refers to any individual who (a) has contacted us via any channel (including through our website or mobile platform) regarding the products or services offered by Proman, or (b) has entered into or may enter into a contract with us for the purchase of any such products or services.

“Personal data” refers to any information, whether accurate or not, that can be used to identify a customer — (a) directly from that data, or (b) from that data combined with other information to which we have, or are likely to have, lawful access.

2. Depending on how you interact with us, the personal data we may collect includes, but is not limited to:

Your name, identification numbers such as Aadhaar Number, Passport Number, PAN, residential address, email address, phone number, nationality, gender, and date of birth;

Personally identifiable medical and health-related information you provide to us (including health history, medical claims, current conditions, laboratory results, diagnostic images, and photographs);

Medical and health data about you prepared by licensed healthcare professionals or service providers who offer medical consultations or treatments through the Proman platform (including records, prescriptions, test results, or examination notes);

Billing and payment-related information you provide, such as credit/debit card details or UPI/online payment account data;

Information about the device you use to access our services, including your computer or mobile device data (such as browser type, device model, and operating system);

Geographical location or physical address; or

Any other information you may submit through the Platform or related services.

3. Other terms used in this Privacy Policy shall have the meanings assigned to them under applicable Indian data protection laws, where relevant and appropriate.

COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

4. We generally do not collect your personal data unless:

It is voluntarily provided to us by you—either directly, or through a third party who has been lawfully authorised by you to share such information (your “Authorised Representative”, which may include your employer, insurance provider, or healthcare facilitator for processing medical claims)—for the purposes outlined in this Privacy Policy; or

Collection and use of personal data without consent may be permitted or required under applicable Indian laws, including the Information Technology Act, 2000 and associated rules.

We will always seek your consent before collecting any additional personal data or before using your personal data for purposes not previously communicated to you (unless otherwise permitted or required by law).

5. We may collect and use your personal data for one or more of the following purposes:

To fulfil obligations in connection with the goods and/or services requested by you, including medical consultations, healthcare support, and the delivery of any products you have purchased through the Proman platform;

Verifying your identity;

Responding to and handling your queries, requests, applications, complaints, and feedback;

Managing your relationship with Proman;

Processing or facilitating the processing of your insurance or reimbursement claims, if applicable;

Processing payments or digital transactions (including UPI, credit/debit cards, and wallets);

Improving the quality of medical or healthcare services through internal audits, quality reviews, and user experience analysis;

Creating de-identified or anonymised data (e.g., aggregated statistics) that cannot be used to identify you personally, for service improvement and reporting;

Notifying you of updates to the platform, features, or service availability;

Marketing and promoting the Proman platform and its healthcare-related products and services to you, with your consent;

Sending you relevant health and wellness information based on your interests or usage patterns;

Complying with applicable Indian laws, regulations, standards, and assisting government or regulatory authorities with lawful investigations or reporting requirements;

Converting personal data to anonymised data for internal analytics and reporting purposes;

Any other purposes for which you have voluntarily provided the information;

Sharing your data with third-party service providers, agents, or authorised partners — including relevant government or regulatory authorities in India or abroad — strictly for the purposes outlined in this Privacy Policy;

Any other operational or business-related purposes directly connected to the above-mentioned uses.

If we need to contact you for any of the above purposes, you agree that we may do so via email, SMS, or phone call using the contact details (email address or mobile number) provided by you or your Authorised Representative.

5A. We may rely on the “legitimate interests” exception under applicable Indian data protection laws to collect, use, and disclose your personal data without explicit consent in limited situations—such as for the detection and prevention of fraud or misuse of our services. Where relevant, such disclosures may be made to your insurer, employer, or authorised representative.

6. As you use the Proman platform, access services, or purchase and arrange delivery of products, certain information may be passively collected:

Site Activity Information: We may record certain actions you perform on the platform, such as your search queries, navigation behaviour, or feature interactions, in order to improve user experience and platform performance.

Access Device and Browser Information: When you access the Proman Website from a computer or mobile device, we may collect non-personal technical data such as your IP address, browser type, connection speed, operating system, and access times to help us optimise platform performance and security.

Cookies (i.e. small pieces of data stored by your browser when visiting a website): We may use both session cookies (which expire after you close your browser) and persistent cookies to enhance your experience, personalise content, improve our services, and ensure your security while using the Proman platform. You can configure your browser settings to refuse all cookies or to notify you when a cookie is being sent. However, if you choose to disable cookies, certain features (such as remaining logged in) may not function properly. Currently, we do not respond to “Do Not Track” signals across all sections of our platform.

Real-Time Location: Certain features on the Proman platform may use GPS technology to collect real-time location data from your device. This allows us to connect you with nearby healthcare professionals or treatment providers for faster and more relevant support.

Device Information: We may also collect non-personal information from your mobile device or computer. This may include how you interact with the application, the type and model of your device, operating system version, and basic usage patterns. If our application crashes, we may receive technical reports containing details such as your device model, OS version, and network provider. This data helps us identify bugs, improve app stability, and enhance the overall performance of the Proman app.

Web Analytics: We may use Google Analytics to understand how users interact with the Proman website. Google Analytics uses cookies to collect information such as how frequently users visit the site, which pages are viewed, and what websites referred them to our platform. The data collected is used solely to help us improve the website experience and our services.

Google Analytics collects only the IP address assigned to you on the date of your visit, and does not gather your name or any other personally identifiable information. While Google Analytics sets a persistent cookie on your browser to recognize you as a returning visitor, this cookie can only be accessed by Google.

Google’s use and sharing of data collected via Google Analytics is governed by the Google Analytics Terms of Service and Google’s Privacy Policy. You can learn how to opt out of Google Analytics tracking through your browser settings or by using the Google Analytics Opt-out Browser Add-on.

7. We may disclose your personal data where such disclosure is necessary to fulfil our obligations in the course of providing the goods or services you have requested:

To our subsidiaries, affiliated companies, or trusted partners involved in delivering services through Proman;

To relevant parties processing your medical care claims—this may include your employer or insurer, if your request involves reimbursement under a workplace or insurance benefit plan. In such cases, medical details (such as diagnosis or treatment information) may be shared strictly for verification and claims processing purposes;

To authorised contractors, service providers, or third-party vendors who support our business operations and are contractually bound to maintain data confidentiality and use your personal information solely for the purpose we specify (e.g., logistics companies, data storage partners, or payment processors);

As required under applicable Indian law, such as in response to a court order or legal obligation;

When we believe in good faith that disclosure is necessary to ensure your safety or the safety of others, to protect our legal rights, to prevent fraud, or to respond to a legitimate government request or investigation;

To a buyer or legal successor in the case of a merger, restructuring, divestiture, asset sale, or other form of business transfer involving Proman, where user data may be included among the transferred assets;

To any other person or organisation as specifically disclosed to you at the time you share your information with us.

8. The purposes outlined in the sections above may remain applicable even after your relationship with Proman has ended or changed (for example, following the conclusion of a service agreement or employment contract). This may include a reasonable retention period, where necessary, to fulfil legal obligations or to enforce our contractual rights, if applicable.

9. This Privacy Policy applies exclusively to information collected through the Proman platform and via related communication channels, such as email, SMS, or other electronic messages linked to our services. It does not apply to any data collected by third parties. If you click on third-party links within our platform, you may be directed away from our site. We are not responsible for the privacy practices of external websites and encourage you to review their respective privacy policies before engaging with them.

WITHDRAWING YOUR CONSENT

10. The consent you provide for the collection, use, and disclosure of your personal data will remain valid until you notify us otherwise in writing. You may withdraw your consent at any time by submitting a formal request via email or in writing to our Data Protection Officer at the contact details provided below. This includes withdrawal of consent for any or all of the purposes outlined in this Privacy Policy.

11. Once we receive your written request, we may require a reasonable period of time (depending on the complexity of your request and its potential impact on our relationship with you) to process it. We will also inform you of any implications your withdrawal may have, including possible legal or contractual consequences. As a general guideline, we aim to respond to and process such requests within ten (10) business days of receipt.

12. While we respect your decision to withdraw consent, please note that depending on the nature and scope of your request, we may no longer be able to continue providing you with certain goods or services. If this is the case, we will inform you of the potential consequences before completing the processing of your request. If you choose to cancel your withdrawal at any time, please notify us in writing using the method described in clause 10 above.

13. Please be aware that your withdrawal of consent does not affect our right to continue collecting, using, or disclosing your personal data where such actions are permitted or required under applicable Indian laws. For clarity, withdrawal of consent does not require us to delete any personal data already collected and stored, unless mandated by law. The retention and handling of such data shall be governed by clauses 20 to 22 of this Privacy Policy.

ACCESS TO AND CORRECTION OF PERSONAL DATA

14. If you wish to make (a) an access request for access to a copy of the

If you wish to (a) request access to the personal data we hold about you, or information on how we use or disclose it, or (b) request a correction or update of any of your personal data, you may submit your request in writing or via email to our Data Protection Officer at the contact details provided below. Your request should clearly include your full name, contact details, a description of the personal data in question, and the approximate date or time range during which the data may have been collected.

15. Please note that a reasonable administrative fee may be charged for processing access requests. If a fee applies, we will notify you of the amount before proceeding with your request.

16. We will aim to respond to your request as soon as reasonably possible. In most cases, we strive to provide a response within fourteen (14) business days. If we are unable to do so, we will notify you in writing within thirty (30) days of receiving your request, informing you of the expected timeframe for our response. If we are unable to fulfil your request—either to provide access to your personal data or to make a correction—we will generally inform you of the reasons, unless we are legally exempt from doing so under applicable Indian data protection laws.

PROTECTION OF PERSONAL DATA

17. To protect your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks, we have implemented appropriate administrative, physical, and technical safeguards. These include updated antivirus software, data encryption, and limiting access to personal data internally and to authorised third-party service providers or agents strictly on a need-to-know basis.

18. Please note, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While we cannot guarantee absolute security, we are committed to maintaining high standards of data protection and continuously review and improve our information security practices to safeguard your information to the best of our ability.

ACCURACY OF PERSONAL DATA

19. We generally rely on the personal data provided by you (or your authorised representative). To help us keep your information accurate, complete, and up to date, please notify Proman in writing or via email if there are any changes to your personal details. Contact information is provided below.

RETENTION OF PERSONAL DATA

20. You may be given the option to delete certain records stored within the Proman mobile application by navigating to “History” > “Delete”. Please note that this action will remove the records from the visible interface of the application only. A backup copy of your data may still be retained securely in accordance with clauses 21 and 22 below.

21. We may retain your personal data for as long as it is reasonably necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable Indian laws and regulations.

22. We will cease to retain your personal data, or will remove the means by which the data can be linked to you, as soon as it is reasonable to conclude that such data retention no longer serves the purpose for which it was collected and is no longer required for any legal, regulatory, or legitimate business purpose.

TRANSFERS OF PERSONAL DATA OUTSIDE OF INDIA

23. We generally do not transfer your personal data outside of India. However, in the event such a transfer becomes necessary (for example, to international service providers or data storage partners), we will ensure that your personal data is protected with safeguards that are at least comparable to those required under applicable Indian data protection laws.

DATA PROTECTION

If you have any enquiries or feedback regarding our personal data protection practices, or if you would like to make a request related to your personal data, you may contact us through the following channel:

Data Protection Contact

Email Address: [email protected]

EFFECT OF PRIVACY POLICY AND CHANGES TO PRIVACY POLICY

This Privacy Policy operates in conjunction with any other applicable notices, contractual provisions, or consent clauses related to the collection, use, or disclosure of your personal data by Proman.

We may update this Privacy Policy from time to time without prior notice. The most current version will be indicated by the “Effective date” below. Your continued use of our website, applications, or services following any updates constitutes your acceptance of the revised policy.

Effective date: 8 August 2022

Last updated: 16 May 2025