Privacy Policy

Draft for review. This policy is written to the right structure and to current Indian law as we understand it, but it is a mockup. It must be reviewed and adopted by the company's legal adviser, and the bracketed placeholders completed, before it goes live.

The short version

We collect what we need to sell you a product and answer your questions, and nothing else. We do not sell your data. We do not share it with data brokers. We do not put people who ask us a health question into an advertising audience. You can ask us to delete what we hold at any time.

This policy is written with the Digital Personal Data Protection Act, 2023 in mind.

1 · What we collect

When you order: name, delivery address, email, mobile number, and order history. Payment is processed by our payment gateway — we never see or store your full card details.
When you contact us or request a callback: name, contact details, the subject you select, and what you write to us.
When you subscribe to emails: your email address.
Automatically: device type, browser, approximate location by IP, and which pages you visited. This is used in aggregate to understand what is useful on the site.

2 · Why we use it

Purpose	What we use
Fulfilling and delivering your order	Name, address, contact details
Answering your enquiry or calling you back	Name, contact details, your message
Managing a subscription	Order and payment history
Legal and tax records	Invoice and transaction data
Improving the website	Aggregated usage data
Marketing emails	Email address — only if you opted in

We ask for consent separately for each purpose. Nothing is pre-ticked. Agreeing to be contacted about an enquiry does not sign you up to marketing.

You can withdraw consent at any time — unsubscribe from any email, or write to privacy@3basics.com. Withdrawing consent does not affect processing already carried out, and we may still need to keep records required by law.

Only those who need it to do a job for us, and only for that job:

Delivery partners — name, address, phone, so they can deliver.
Payment gateway — to process payment. They handle card data; we do not.
Email and communication providers — to send order updates and, if you opted in, newsletters.
Professional advisers and authorities — where we are legally required to.

We do not sell personal data, and we do not share it for anyone else's marketing.

5 · How long we keep it

Order and invoice records: as long as tax and company law require, currently eight years.
Enquiry and callback records: 24 months, then deleted.
Marketing consent: until you withdraw it.
Website analytics: 14 months, in aggregate.

6 · Your rights

You may ask us to: tell you what we hold about you; correct anything inaccurate; delete what we no longer need; or stop using it for a purpose you have withdrawn consent for. You may also nominate someone to exercise these rights on your behalf.

Write to privacy@3basics.com. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

7 · Health-related information

This matters more than the rest of this policy, so we are stating it separately.

If you write to us about your health, or select a topic that implies something about it, that information is used only to answer you. Specifically:

It is never used to target advertising, and never uploaded to any advertising platform.
It is never used to build a profile or segment you.
Access is restricted to the people who need it to reply.
It is deleted on request, immediately.

We would also ask you not to send us medical details you would not want on file. We are not doctors and we cannot advise on a condition — so the detail does not help us, and holding it does not help you.

8 · Cookies

We use cookies that are strictly necessary for the site to work — your cart, your session, your preferences. We use analytics cookies only with your consent, and you can decline them without losing any functionality. You can also block cookies in your browser.

9 · Security

Data is transmitted over encrypted connections and access is restricted to staff who need it. No system is perfectly secure, but if a breach affects your data we will notify you and the Data Protection Board as required.

10 · Children

Our products are for adults and this website is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.

Contact

Questions about this policy: hello@3basics.com.
Helios Biocred Private Limited, Ground Floor, Plot No. 18–19, HSIIDC Udyog Kunj, Ghamroj, Gurugram, Haryana 122102, India.
Grievance Officer: [name to be appointed], grievance@3basics.com.