Privacy notice — updated 16 October 2026
This notice explains how Kairali – The Ayurvedic Healing Village handles website enquiries, consultation requests, patient information, recruitment and optional communications. It also applies to visitors outside India.
Who to contact
The website operator is Kairali Ayurvedic Health Resort Pvt. Ltd. The hospital is at III/73 Palayamkadu, P.O. Olassery, Kodumbu, Palakkad District – 678551, Kerala, India. For privacy questions or requests, email [email protected] or call +91 9555 156 156. Recruitment requests go to [email protected].
Information and purposes
We use contact details, country, language preferences and enquiry information to respond, arrange consultations and coordinate proposed admission. Information you choose to share may include medical history, medicines, symptoms and reports. Payment and transaction references support invoicing, reconciliation and refunds. CVs and recruitment correspondence are used to assess applications. Website security and cookie-preference information support safe operation and your choices.
Please share only information relevant to your request. Medical reports may be provided through an available upload facility or by email to [email protected], according to your preference. Reports and pre-admission clearance are required only for severe conditions, case by case; the team will tell you what is needed. Do not send card numbers, security codes, PINs or one-time passwords in enquiry forms, email or chat.
Medical information and access
Medical information is used for enquiry assessment and care coordination. Access is restricted by role and need: doctors, designated patient-care staff and sales staff involved in your enquiry. Recruitment records are for authorized HR staff and people involved in hiring, not the medical-report sales team. Necessary technical administration may require authorized IT support.
An enquiry or medical report is not permission for newsletter enrolment or health-based advertising. Where consent is required, it must be requested separately and clearly. Clinical assessment, treatment consent and consent for optional marketing are different decisions.
Reasons for processing and your choices
Depending on the activity and applicable law, processing may be necessary to respond to your request or enter into a contract, deliver agreed services, meet legal obligations, protect vital interests, or pursue legitimate interests such as security and fraud prevention. Where we rely on consent, you may withdraw it. Health information requires an additional legal condition where special-category rules apply; ordinary website use or acceptance of cookies is not consent to every use of medical data.
Newsletter and promotional communications require a separate choice. You may unsubscribe or email [email protected]. Withdrawing optional marketing consent does not affect care enquiries.
Service providers and payments
Providers involved in hosting, communications, storage, technical support and payment processing may receive information necessary for their roles. The confirmed payment providers are Razorpay and PayPal. Their payment, identity, fraud-prevention and legal-retention practices are described in their own privacy notices: https://razorpay.com/buyer-privacy-notice/ and https://www.paypal.com/in/legalhub/paypal/privacy-full . A payment provider may retain transaction information; payment processing does not mean that no data is stored.
We may disclose necessary information where required by law or to handle legal claims. Medical reports and enquiry text must not be used as advertising audience data.
Enquiry-report retention
Our approved retention rule for enquiry-only medical reports is deletion within 90 days after the last meaningful patient contact, or sooner when no longer needed. Staff reminders alone do not restart that period. This rule does not cover records created by an actual clinical consultation, OPD care or admission; those follow the hospital’s separate clinical-record requirements. A documented legal obligation or dispute hold may also require restricted retention. Sunaj owns the operational process for enquiry-only report retention and deletion.
Request earlier deletion at [email protected]. Our operational target is 30 days, subject to applicable legal deadlines, proportionate identity checks and explained retention exceptions. Deletion must cover controlled copies and provider-held copies. Restricted backup copies expire through the applicable backup cycle; this is not a promise of immediate deletion from every backup.
Career applications
CVs and application details are used for recruitment. Unsuccessful or withdrawn applications are normally deleted within six months of closure, or sooner when no longer needed, unless a documented retention obligation applies. Keeping an application for future roles requires separate optional permission, unchecked by default, for up to 12 months from that permission. Refusal does not affect the current application. Necessary successful-applicant records follow the employee-record schedule.
For access, correction, deletion or withdrawal of future-role permission, email [email protected]. The operational deletion target is 30 days, subject to applicable legal deadlines and explained exceptions.
International visitors and processing in India
The hospital operates in India. Information sent for enquiries or care is received and used in India, and service providers may process information in other countries. Data protection rules may differ from those in your home country. Where a regulated international transfer occurs, the appropriate legal transfer mechanism and safeguards must be established; this notice is not a transfer agreement or a blanket waiver of your rights.
For visitors in the EEA or UK, GDPR or UK data-protection rules may apply depending on the activity. Japanese APPI and United States state or federal privacy rules may also apply where their conditions are met. Contact [email protected] for information about processing locations, recipients and safeguards relevant to your request.
Your rights and complaints
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection or portability, to withdraw consent, or to opt out of certain sale, sharing or targeted-advertising activities. Rights and exceptions depend on the processing and law; they are not all rights created by India’s DPDP Act. Contact [email protected], or [email protected] for applications.
We may ask for information reasonably needed to verify a request. We will explain any lawful limitation and applicable response period. You may also complain to the competent privacy regulator, including your local EEA supervisory authority, the UK ICO, Japan’s Personal Information Protection Commission, or an applicable US state authority.
Cookies, external services and Priya
See /cookie-policy/ for cookie choices. Priya provides automated assistance with general questions and coordination; it is not a substitute for a physician’s diagnosis or treatment advice. For detailed medical reports, use the hospital’s designated submission channels. External chat, WhatsApp, maps, videos and payment services have their own privacy practices. When you open the chat with Priya, it receives the page you are viewing and, if you have allowed analytics or advertising, the name of the campaign that brought you to our website (its source, medium and campaign name). This helps us understand which pages and campaigns lead to conversations. It does not receive advertising click identifiers.
Cookies, analytics and advertising
Necessary storage
We use necessary storage in your browser to make the website work and to remember your cookie choices. It does not identify you and cannot be switched off.
Optional analytics and advertising
With your permission, or where they are on by default in your region (see “Choices by region”), we use:
- Google Analytics and Microsoft Clarity (analytics), to understand how visitors use the website. Clarity includes session replay, which records page interactions such as clicks and scrolling. Clarity is instructed to mask form fields.
- Google Ads and the Meta Pixel (advertising), to measure the results of our advertising, for example whether an enquiry followed an advertisement.
These services may set cookies or similar identifiers and receive information such as the pages you visit, your device and browser type, approximate location derived from your IP address, and the advertisement that brought you to the website. Our measurement events do not include the contents of enquiry forms (such as your name, email address or phone number).
Choices by region
- The European Economic Area (including the EU’s outermost regions and the Åland Islands), the United Kingdom and Switzerland, and wherever we cannot determine your country: optional analytics and advertising are off until you choose. You can accept all, reject optional services, or choose individual categories.
- Other countries: optional analytics and advertising are on by default. A notice is shown on the website, and you can reject them or change your settings at any time. Choosing “Reject optional” switches them off, and we remember that refusal for 366 days.
To decide which choice applies, your browser makes a request to our own website through our content delivery provider, Cloudflare. The result decides only whether optional analytics and advertising start off until you choose or on by default. Neither the result nor your country or IP address is stored or logged for this purpose.
Google Consent Mode
We use Google Consent Mode. Where analytics or advertising is off (before you choose in the regions listed above, or after you reject it), Google Analytics may still receive limited signals without cookies and without identifiers. While advertising is off before you choose, Google Ads may receive the same limited signals; it does not receive them after you reject advertising or when your browser sends Global Privacy Control. These signals tell Google that a page was viewed and what your consent status is, together with technical information such as the time, browser type and approximate location derived from your IP address. Google uses these signals to produce aggregate, modelled statistics. They do not place cookies on your device and are not used to identify you or to personalise advertising.
For service providers and other third-party services, see “Service providers and payments” above and our Cookie Policy. Third-party services have their own privacy practices.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, advertising stays off, and analytics stays off until you choose, wherever you are. Only the cookieless Google Analytics signals described above are sent.
Changing your mind
You can change or withdraw your choices at any time using the “Cookie choices” control at the bottom of every page. Switching services off or withdrawing consent stops them from that point and removes their cookies from this website. Permissions you grant last up to 182 days (about six months). Refusals are remembered for 366 days (about 12 months) unless you change them. Clearing your browser storage removes the choices remembered on that device.
Your rights
The rights that may apply to you, and how to complain to a regulator, are described in “Your rights and complaints” above. To exercise your rights, or for privacy questions or grievances, contact Sunaj Sahoo at [email protected].
Security and changes
Security requires appropriate technical and organizational safeguards and role-based access. No website or storage system can guarantee absolute security. Security incidents must be assessed and notified to affected people and authorities where required, within the applicable legal deadlines.
Updates will be posted with the revision date. A policy change does not retrospectively authorize a new, incompatible use of information or replace consent where it is required.