Privacy notice — updated 25 September 2026
This notice explains how Kairali – The Ayurvedic Healing Village handles website enquiries, consultation requests, patient information, recruitment and optional communications. It also applies to visitors outside India.
Who to contact
The website operator is Kairali Ayurvedic Health Resort Pvt. Ltd. The hospital is at III/73 Palayamkadu, P.O. Olassery, Kodumbu, Palakkad District – 678551, Kerala, India. For privacy questions or requests, email [email protected] or call +91 9555 156 156. Recruitment requests go to [email protected].
Information and purposes
We use contact details, country, language preferences and enquiry information to respond, arrange consultations and coordinate proposed admission. Information you choose to share may include medical history, medicines, symptoms and reports. Payment and transaction references support invoicing, reconciliation and refunds. CVs and recruitment correspondence are used to assess applications. Website security and cookie-preference information support safe operation and your choices.
Please share only information relevant to your request. Medical reports may be provided through an available upload facility or by email to [email protected], according to your preference. Reports and pre-admission clearance are required only for severe conditions, case by case; the team will tell you what is needed. Do not send card numbers, security codes, PINs or one-time passwords in enquiry forms, email or chat.
Medical information and access
Medical information is used for enquiry assessment and care coordination. Access is restricted by role and need: doctors, designated patient-care staff and sales staff involved in your enquiry. Recruitment records are for authorized HR staff and people involved in hiring, not the medical-report sales team. Necessary technical administration may require authorized IT support.
An enquiry or medical report is not permission for newsletter enrolment or health-based advertising. Where consent is required, it must be requested separately and clearly. Clinical assessment, treatment consent and consent for optional marketing are different decisions.
Reasons for processing and your choices
Depending on the activity and applicable law, processing may be necessary to respond to your request or enter into a contract, deliver agreed services, meet legal obligations, protect vital interests, or pursue legitimate interests such as security and fraud prevention. Where we rely on consent, you may withdraw it. Health information requires an additional legal condition where special-category rules apply; ordinary website use or acceptance of cookies is not consent to every use of medical data.
Newsletter and promotional communications require a separate choice. You may unsubscribe or email [email protected]. Withdrawing optional marketing consent does not affect care enquiries.
Service providers and payments
Providers involved in hosting, communications, storage, technical support and payment processing may receive information necessary for their roles. The confirmed payment providers are Razorpay and PayPal. Their payment, identity, fraud-prevention and legal-retention practices are described in their own privacy notices: https://razorpay.com/buyer-privacy-notice/ and https://www.paypal.com/in/legalhub/paypal/privacy-full . A payment provider may retain transaction information; payment processing does not mean that no data is stored.
We may disclose necessary information where required by law or to handle legal claims. Medical reports and enquiry text must not be used as advertising audience data.
Enquiry-report retention
Our approved retention rule for enquiry-only medical reports is deletion within 90 days after the last meaningful patient contact, or sooner when no longer needed. Staff reminders alone do not restart that period. This rule does not cover records created by an actual clinical consultation, OPD care or admission; those follow the hospital’s separate clinical-record requirements. A documented legal obligation or dispute hold may also require restricted retention. Sunaj owns the operational process for enquiry-only report retention and deletion.
Request earlier deletion at [email protected]. Our operational target is 30 days, subject to applicable legal deadlines, proportionate identity checks and explained retention exceptions. Deletion must cover controlled copies and provider-held copies. Restricted backup copies expire through the applicable backup cycle; this is not a promise of immediate deletion from every backup.
Career applications
CVs and application details are used for recruitment. Unsuccessful or withdrawn applications are normally deleted within six months of closure, or sooner when no longer needed, unless a documented retention obligation applies. Keeping an application for future roles requires separate optional permission, unchecked by default, for up to 12 months from that permission. Refusal does not affect the current application. Necessary successful-applicant records follow the employee-record schedule.
For access, correction, deletion or withdrawal of future-role permission, email [email protected]. The operational deletion target is 30 days, subject to applicable legal deadlines and explained exceptions.
International visitors and processing in India
The hospital operates in India. Information sent for enquiries or care is received and used in India, and service providers may process information in other countries. Data protection rules may differ from those in your home country. Where a regulated international transfer occurs, the appropriate legal transfer mechanism and safeguards must be established; this notice is not a transfer agreement or a blanket waiver of your rights.
For visitors in the EEA or UK, GDPR or UK data-protection rules may apply depending on the activity. Japanese APPI and United States state or federal privacy rules may also apply where their conditions are met. Contact [email protected] for information about processing locations, recipients and safeguards relevant to your request.
Your rights and complaints
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection or portability, to withdraw consent, or to opt out of certain sale, sharing or targeted-advertising activities. Rights and exceptions depend on the processing and law; they are not all rights created by India’s DPDP Act. Contact [email protected], or [email protected] for applications.
We may ask for information reasonably needed to verify a request. We will explain any lawful limitation and applicable response period. You may also complain to the competent privacy regulator, including your local EEA supervisory authority, the UK ICO, Japan’s Personal Information Protection Commission, or an applicable US state authority.
Cookies, external services and Priya
See /cookie-policy/ for cookie choices. Priya provides automated assistance with general questions and coordination; it is not a substitute for a physician’s diagnosis or treatment advice. For detailed medical reports, use the hospital’s designated submission channels. External chat, WhatsApp, maps, videos and payment services have their own privacy practices.
Security and changes
Security requires appropriate technical and organizational safeguards and role-based access. No website or storage system can guarantee absolute security. Security incidents must be assessed and notified to affected people and authorities where required, within the applicable legal deadlines.
Updates will be posted with the revision date. A policy change does not retrospectively authorize a new, incompatible use of information or replace consent where it is required.