Privacy Policy

AHAM NIRVANA recognizes the importance of maintaining your privacy. This Privacy Policy describes how ABRYX TECH LLP collects, uses, stores, shares, and otherwise processes information collected through the AHAM NIRVANA website at https://AhamNirvana.com/ and the AHAM NIRVANA mobile application (together, the “Platform”). This Privacy Policy applies to current and former visitors to the Platform, registered users, practitioners, and persons who interact with AHAM NIRVANA in connection with the services offered through the Platform. This Privacy Policy is to be read along with the respective Terms of Use or other terms and conditions as provided on the Website. This Privacy Policy is published in accordance with Section 43A of the Information Technology Act, 2000 read with Rule 3(1) of the Information Technology (Intermediaries Guidelines) Rules, 2011, Regulation 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 as applicable, which requires publishing of the Privacy policy for collection, use, storage, management, and transfer of sensitive personal data or information. AHAM NIRVANA is dedicated towards safe processing of data and sensitive personal information and the Users / Practitioners have right to access, add and correct their information subject to the terms of this Privacy Policy. AHAM NIRVANA does not guarantee any outcome from the services provided by the Practitioners to Users and all services are provided in a transparent manner in line with applicable laws. This Privacy Policy shall be read as part and parcel of the Terms of Service of AHAM NIRVANA, and any term not defined herein shall have the meaning assigned to it in the Terms of Service. By visiting, accessing, registering on, or using the Platform, you agree to the terms of this Privacy Policy, subject to applicable law. The brand AHAM NIRVANA is owned and controlled by ABRYX TECH LLP, a limited liability partnership operating the Platform for holistic conscious / spiritual healing and wellness coordination services, including scheduling, tracking, communication, feedback collection, and facilitation of interactions between users and independent practitioners offering services such as meditation, reiki, tarot reading, astrology, yoga, breathwork, hypnotherapy, EFT / NLP coaching, chakra healing, manifestation coaching, and other wellness services. For the purpose of this Privacy Policy, “User”, “you”, and “your” shall mean any natural or legal person who (i) browses or visits the Platform, (ii) registers for an account on the Platform, (iii) accesses or books services through the Platform, (iv) acts as a practitioner registered on the Platform, or (v) otherwise communicates with AHAM NIRVANA through the Platform or related channels. The terms “AHAM NIRVANA”, “we”, “us”, and “our” shall mean ABRYX TECH LLP and the Platform operated by it. When this Privacy Policy uses the term “Personal Data” or “Personal Information”, it means any information that identifies you or relates to you and is capable of identifying you, directly or indirectly, in accordance with applicable law. By accessing the Platform and using it, you indicate that you understand the terms and expressly consent to the privacy policy of AHAM NIRVANA. If you do not agree with the terms of this privacy policy, please do not use this website. BY USING THE PLATFORM, YOU AGREE THAT WE MAY PROCESS YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY AND IN ACCORDANCE WITH APPLICABLE LAW. WHERE CONSENT IS REQUIRED FOR A SPECIFIC PROCESSING ACTIVITY, WE WILL OBTAIN YOUR CLEAR AND AFFIRMATIVE CONSENT SEPARATELY, AND YOU MAY WITHDRAW THAT CONSENT AT ANY TIME SUBJECT TO LEGAL AND CONTRACTUAL LIMITATIONS. Information We Collect We may collect the following categories of personal information from you, depending on the manner in which you interact with the Platform and the services you use, 1. Contact and account information

For Landing Page Visitors: We may collect name, email, phone (with country code) and type of visitor i.e. User or Practitioner. For Practitioners: We may collect your personal information like your name, email address, phone number, postal address, city, state, pin code, country, username, password, account credentials, profile photograph (discretionary subject to consent and submission of Users / Practitioners), free text information added by Users / Practitioners, professional certifications such as Yoga Alliance certificates, Reiki Master Certificates, etc. and other identifiers that you provide while creating an account, submitting forms, or contacting us. AHAM NIRVANA does NOT store images of government identity documents. We verify the identification details through third-party payment partner KYC processes solely through verification status and masked numbers. For Users: We may collect your personal information like your name, email address, phone number, postal address, username, password, account credentials, profile photograph (discretionary subject to consent and submission of Users / Practitioners), free text information added by Users / Practitioners, Booking history, transaction details, and other identifiers that you provide while creating an account, making a booking, or contacting us. All payment information are handled by third party and do not reach our servers in plain form. 2. Booking, session, and service information We may collect information relating to your bookings, practitioner preferences, scheduled sessions, session history, session modifications or cancellations, support requests, and feedback shared through the Platform. 3. Payment and billing information We may collect billing name, billing address, transaction details, payout-related details for Practitioners, and other payment-related information necessary for processing payments, settlements, refunds, chargebacks, or related compliance functions. Payment instrument details are processed through authorized third-party payment partners like RAZORPAY who is an independent controller and the terms and conditions and other policies of such third party shall be applicable to the User / Practitioner. AHAM NIRVANA does not store complete card details on its own systems unless required for lawful and secure processing. The User / Practitioner may be subjected to KYC verification by third party. Users are requested to peruse the third party policies as provided herein in a complete and thorough manner before proceeding with the access to the Platform.  Privacy Policy: https://razorpay.com/privacy  Terms: https://razorpay.com/terms 4. Wellness and sensitive information voluntarily shared by you Given the nature of the Platform, users may choose to share information relating to health, mental state, emotional condition, lifestyle, self-reflection inputs, spiritual preferences, or other sensitive personal information to the extent necessary for the requested service. Such information is shared voluntarily by the user and may be collected, used, stored, and disclosed strictly for the relevant service purpose, subject to applicable law and this Privacy Policy. 5. Communications and user-generated content We may collect information that you submit through forms, chat or support interactions, reviews, feedback, survey responses, testimonials, or other content uploaded, posted, emailed, or otherwise transmitted through the Platform. 6. Device, usage, and technical information If you use the Platform, we may collect technical and usage-related information such as IP address, browser type, device details, operating system, pages visited, session duration, referral URLs, exit URLs, timestamps, app interactions, and similar information about how you access and use the Platform. 7. Information from third parties We may receive information about you from third parties such as integrated social media services, payment processors, analytics providers, practitioners, service providers, or business partners, to the extent permitted by law and necessary for providing or improving the Platform. 8. Non-Personal Identifiable Information Such information is collected when the user visits the Website, cookies, etc. and would include but not limited to the following: • URL (Uniform Resource Locator) of the previous website visited by the User before visiting this website or the URL of the website the User visits after visiting this Website. • Internet service provider / IP Address / Telecom service provider. • Type of Browser used for accessing the website. • Geographical Location Such non-personal identifiable information is used by the Website for the purposes including but not limited to troubleshoot connection problems, administer the website, analyze trends, gather demographic information, frequency of visits to the website, average length of visits, pages viewed during a visit, compliance with applicable law, and cooperate with law enforcement activities, etc. How We Collect Information We collect information in multiple ways. • We collect information directly from you when you create an account, book a session, fill out a form, contact us, make a payment, submit feedback, or otherwise interact with the Platform. • We collect information passively through cookies, analytics tools, pixels, web beacons, device identifiers, server logs, and similar technologies when you browse or use the Platform. • We may collect information from practitioners, third-party tools, payment gateways, social media integrations, and other service providers connected with operation of the Platform. Purposes of Processing We may use the information we collect for the following purposes: • To confirm your information through One-Time Passwords and KYC processes. • To create, maintain, and manage your account on the Platform. • To facilitate bookings, session scheduling, rescheduling, cancellations, session records, communication support, and feedback collection between users and practitioners. • To provide customer support and respond to your questions, requests, complaints, and grievances. • To process payments, settlements, refunds, payouts, and related financial or compliance functions. • To personalize and improve the Platform, user experience, service design, and performance. • To monitor usage trends, conduct analytics, troubleshoot issues, maintain security, prevent fraud, and protect the Platform, users, practitioners, and business operations. • To send transactional messages, service notifications, booking confirmations, reminders, account communications, and administrative updates. • To send promotional or marketing communications, where permitted by applicable law and subject to your preferences or consent where required. • To enforce our Terms of Service, investigate misuse, respond to claims, and establish, exercise, or defend legal rights. • To comply with legal obligations, regulatory requirements, lawful requests, court orders, and internal record-keeping requirements. Where required under applicable law, including the Digital Personal Data Protection Act, 2023, consent shall be obtained through clear affirmative action and shall be limited to the personal data necessary for the specified purpose. Where processing is based on consent, you may withdraw consent at any time in the manner made available on the Platform, subject to lawful retention and other permitted uses under applicable law. Cookies and Tracking Technologies We use cookies and similar technologies, such as pixels, tags, scripts, and local storage, to operate and secure our Platform, understand how users interact with it, and improve user experience. Cookies are small text files stored on your device when you visit a website. They help us recognize your browser or device, remember preferences, measure traffic, and provide relevant functionality. We use the following categories of cookies. Strictly necessary cookies: These cookies are essential for the operation of the Platform and enable core functions such as account login, session management, authentication, security, load balancing, and accessibility. These cookies cannot be disabled through our cookie settings, as the Platform may not function properly without them. Analytics and performance cookies: These cookies help us understand how visitors use the Platform, measure page visits and interactions, monitor performance, and identify technical issues. We use this information to improve the Platform and user experience. These cookies may be set by us or by third-party analytics tools. Functional cookies: These cookies remember your choices and preferences, such as login details, language settings, or user interface preferences, so we can provide a more personalized experience. Marketing or advertising cookies: Where applicable, these cookies may be used to deliver relevant promotional content, measure the effectiveness of campaigns, or track engagement across websites and services. We will use these cookies only where permitted by applicable law and, where required, with your consent. Some cookies may be placed by third-party service providers that help us operate, analyze, or secure the Platform. These third parties may collect information such as IP address, browser type, device information, pages visited, time spent on the Platform, and referring URLs, subject to their own privacy policies and settings. You may manage or disable cookies through your browser settings or, where available, through our cookie preference tool. If you disable certain cookies, some features of the Platform may not function correctly or may become unavailable. By continuing to use the Platform, you acknowledge the use of cookies and similar technologies as described in this Privacy Policy, subject to any consent or preference settings made available to you under applicable law. Sharing of Information We may share your information in the following circumstances, to the extent permitted by applicable law: • With independent practitioners, where necessary to facilitate bookings, communications, service delivery, support, scheduling, and session management requested by you through the Platform. • With payment processors, payout facilitators, cloud service providers, analytics providers, communication vendors, customer support providers, and other service providers who perform services on our behalf. • With business partners or third-party tools integrated with the Platform, subject to appropriate contractual or legal safeguards and only as necessary for the relevant purpose • Where disclosure is required to comply with law, legal process, governmental request, investigation, court order, or to protect rights, safety, property, users, practitioners, or the Platform • In connection with a merger, acquisition, restructuring, financing, sale of assets, insolvency event, or transfer of all or part of our business, subject to applicable confidentiality and legal requirements • For any other purpose disclosed to you at the time of collection or with your consent, where such consent is required AHAM NIRVANA may also process certain data on behalf of practitioners or third parties and may act as a processor or service provider, where applicable Data Retention We retain personal information for as long as necessary for the purposes described in this Privacy Policy, including to maintain accounts, provide services, complete bookings and settlements, resolve disputes, enforce agreements, comply with legal obligations, and maintain appropriate business and security records. Retention periods may vary depending on the nature of the information, the sensitivity of the data, the purpose of processing, and applicable legal or regulatory requirements. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. At the database level, we enforce strict access controls using Row Level Security (RLS) policies across all tables. These controls ensure that users, including practitioners, can only access data that is specifically authorized to them and cannot view or access data belonging to other users. Similarly, all file storage buckets are configured as private and are protected by equivalent access control mechanisms. We also follow a data minimization approach in our monitoring and diagnostics systems. Our error tracking and performance monitoring tool (Sentry) is configured to avoid the collection of personally identifiable information. In particular, we disable the collection of sensitive data such as IP addresses, request bodies, and user-submitted content. Any identifiers associated with error events are limited to internal system-generated user IDs (UUIDs), which do not directly identify individuals.

These measures are designed to ensure that access to personal data is restricted on a need-to-know basis and that monitoring systems do not inadvertently capture or expose sensitive user information. Your Rights Subject to applicable law, you may have the following rights in relation to your personal information: • Right to access information we hold about you. • Right to request correction, completion, or updating of inaccurate or incomplete information. • Right to request deletion of your personal information, subject to lawful exceptions and retention requirements • Right to withdraw consent for processing based on consent, subject to legal or contractual limitations. Where processing is based on your consent, you may withdraw such consent at any time using the methods made available on the Platform or by contacting us. Withdrawal of consent shall not affect the lawfulness of processing undertaken before such withdrawal and may be subject to legal, operational, contractual, fraud prevention, security, or record-retention requirements. • Right to opt out of promotional communications by using the unsubscribe option or contacting us through the grievance or support details provided below. • You have the right to an easily available grievance redressal mechanism in relation to our processing of your personal data, our compliance obligations, and your rights under applicable data protection law. • You may nominate one or more individuals who, in the event of your death or incapacity, may exercise your rights under applicable data protection law in the manner made available by us and subject to applicable verification requirements • Any additional rights available under applicable law, including the Digital Personal Data Protection Act, 2023. We may require you to verify your identity before acting on a request. Certain rights may be limited where retention or processing is required by law, for fraud prevention, security, dispute resolution, or contractual necessity. Children’s Privacy The Platform is not intended for children and is available only to persons who can form legally binding contracts under applicable law, subject to any permitted supervised use contemplated in the Terms of Service. We do not knowingly collect personal information from children in contravention of applicable law. If you believe that a child has provided personal information in violation of this Privacy Policy, you may contact us to request review and deletion, subject to applicable verification requirements. Security We implement reasonable technical, organizational, and administrative safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. However, no platform, transmission method, or storage system is completely secure, and therefore AHAM NIRVANA cannot guarantee absolute security of information shared over the internet or through digital systems. Third-Party Links and Services The Platform may contain links to, or integrations with, third-party websites, tools, materials, or services. This Privacy Policy does not apply to third-party platforms, and AHAM NIRVANA is not responsible for the privacy practices, policies, accuracy, or content of such third parties. Users are encouraged to review the privacy policies of third-party services before interacting with them or sharing personal information. We engage trusted third-party service providers (“Service Providers”) to perform certain business functions on our behalf. These Service Providers process personal data strictly in accordance with our instructions and applicable data protection laws, and are bound by contractual obligations, including Data Processing Addenda (DPAs), to ensure appropriate confidentiality and security safeguards. The categories of Service Providers we use and their roles are outlined below: I. Infrastructure, Hosting and Data Storage (Supabase and Vercel) We use Supabase for database management, user authentication, and file storage, and Vercel for hosting, content delivery, and serverless infrastructure. • Supabase processes data including email addresses, hashed passwords, user profile information, application data, uploaded files (such as profile photos), audit logs, and status events. Data is stored in the Asia-Pacific region (Tokyo) and retained until account deletion, subject to backup retention practices. • Vercel processes technical and usage data such as IP addresses, request logs, user-agent strings, and inferred geographic data to deliver and optimize our services through a globally distributed infrastructure. Both providers maintain industry-standard certifications (including SOC 2 Type II) and offer GDPR-compliant processing commitments. Their DPAs and sub-processor disclosures are available on their respective websites. II. Communications We use tools to send transactional communications such as account confirmations, status updates, invitations, and password reset emails. Resend processes recipient email addresses, email content, and delivery metadata (such as open and bounce events). III. Payments, KYC and Payouts We use Razorpay to facilitate payments, conduct legally required KYC verification, and process payouts to practitioners. Razorpay processes sensitive financial and identity data including payment instrument details (handled in tokenized form), UPI IDs, bank account details, Aadhaar information (for eKYC), PAN details, and transaction records. Please note that Razorpay acts as an independent data controller for payment-related data and interacts directly with users for such processing. Their collection and use of personal data are governed by their own privacy policy and terms, and we encourage users to review them. Razorpay is an RBI-licensed payment aggregator and complies with applicable Indian regulatory requirements, including data retention obligations under RBI and PMLA regulations. IV. Analytics and Error Monitoring We use tools to monitor application performance and detect errors. Such processes are limited to technical data such as error stack traces, browser and device information, page URLs, and performance metrics. We have configured tools to minimize personal data collection (including disabling default collection of IP addresses and request bodies). V. Development Tools We use tools to manage our source code repositories. Such tools do not process end-user personal data in the ordinary course of our operations. However, in exceptional circumstances (such as inadvertent inclusion of personal data in code repositories), such data may be stored on the said tools’ servers. We conduct reasonable due diligence before engaging Service Providers and periodically review their privacy and security practices. For more information on how these providers handle personal data, users are encouraged to review their respective privacy policies and data processing terms available on their websites. VI. VI. Analytics and User Insights (Google Analytics and Hotjar) We use third party analytics and user insights tools to understand how the Platform is used, measure performance, and improve user experience. Specifically: Google Analytics: We use Google Analytics (provided by Google) to collect and analyse usage data such as pages visited, time spent, referral URLs, device and browser information, IP address (which may be anonymised/IP masked depending on configuration), and interaction events. Google Analytics may place cookies or similar identifiers on your device. Data may be transferred to and processed by Google on servers outside India, including in the United States, in accordance with Google’s terms and privacy policy. Google acts as a service provider / data processor for analytics on our behalf, subject to contractual safeguards. You can learn more about Google’s data practices and opt out mechanisms via Google’s settings and the Google Analytics Opt out Browser Add on (where available). VII. Hotjar: We use Hotjar (provided by Hotjar Ltd.) for behaviour analytics and user feedback, which may include heatmaps, session recordings, conversion funnels, and surveys. Hotjar may collect technical and usage data (such as IP address, device type, browser, screen size, pages visited, time on page, clicks, scrolls, and form interactions) and, where applicable, may mask or exclude certain fields to reduce identifiability. Data may be transferred to and processed by Hotjar on servers outside India, in accordance with Hotjar’s terms and privacy policy. Hotjar acts as a service provider / data processor on our behalf, subject to contractual safeguards. You can opt out of Hotjar data collection via Hotjar’s opt out page or by disabling relevant cookies in your browser. These tools operate subject to your cookie and tracking preferences where required by applicable law. If you disable analytics or marketing cookies through your browser or our cookie settings (where available), some features of these tools may not function correctly. For more details, please review the privacy policies of Google and Hotjar available on their respective websites. Grievance Officer / Contact Details For questions, complaints, rights requests, consent withdrawal, or grievances relating to personal data or Platform use, you may contact AHAM NIRVANA through the designated grievance channel below: Grievance Officer: Priyanka Ray Email: Phone No: [SU1.1]+91 9599447792 If you have any questions regarding this Privacy Policy or wish to exercise your rights, you may also write to the above contact details. Changes to this Privacy Policy AHAM NIRVANA may update or modify this Privacy Policy from time to time to reflect changes in legal, regulatory, operational, or business requirements. The updated version will be posted on the Platform with a revised “Last Updated” date, and material changes will be notified in accordance with applicable law. Last Updated: 25.08.2026 Governing Law and Jurisdiction This Privacy Policy shall be governed by the laws of India. Subject to any valid arbitration arrangement or mandatory legal requirement, matters relating to this Privacy Policy shall be subject to the courts having jurisdiction in Delhi, India, in line with the governing law and jurisdiction clause set out in the Terms of Service.