Privacy policy
This policy explains what PraKul collects from students and patients, why, who else can see it, and how to have it corrected or deleted. It is written to the Digital Personal Data Protection Act, 2023.
Last updated: 26 October 2026
1. Who we are
PraKul is operated by [Registered legal name — to be provided], the practice of Dr. Prasanna Kulkarni, at [Registered address — to be provided]. In this policy “we” means that business and “you” means anyone using the PraKul website, whether as a BAMS student or as a patient of the clinic.
We are the data fiduciary for the personal data described here. GSTIN: [GSTIN, if registered — to be provided].
2. What we collect
We collect only what the service needs to work.
When you create an account: your name, email address, and — if you choose to give them — your phone number, college, year of study and location. Students are issued a PraKul ID.
To sign you in: a secret shared with your authenticator app, and one-time backup codes. The backup codes are stored only as salted hashes; we cannot read them back. If you set a password, we store only a hash of it. A signed session cookie keeps you logged in.
As you study: which chapters you have opened or completed, your bookmarks, your assessment answers and scores, and the schedule of your revision cards.
When you book a consultation: your name, phone number, email address if you give one, whether the visit is in clinic or by video, the date and time, the health concern you want to discuss, and any notes you add.
Automatically: server logs containing the request, the time, and technical details such as your browser type. If website analytics are switched on, Google Analytics also receives usage events.
We do not buy personal data, and we do not collect it from anyone other than you.
3. Why we use it
- To give you access to the learning platform and to show your own progress back to you.
- To arrange, confirm and carry out your consultation with the doctor.
- To keep your account secure, including verifying your authenticator and limiting repeated sign-in attempts.
- To take payment and keep the records the law requires us to keep, once paid access is available.
- To fix faults and keep the service running, and — where analytics are enabled — to understand which parts of the site are used.
4. Our basis for using it
We process your personal data with your consent, given when you create an account or book a consultation, and for the legitimate uses the Act permits — chiefly providing the service you asked for. You can withdraw consent at any time by closing your account or contacting us; withdrawing it does not undo processing already carried out, and may mean we can no longer provide the service.
5. Health information
What you tell us when booking — your health concern and any notes — is sensitive. It is visible only to the doctor and to clinic staff who need it to run the appointment. It is never used for advertising and never sold.
Clinical records created during a consultation are kept by the clinic as part of your medical record, separately from this website.
6. Who else can see it
We do not sell personal data. We share it only with the providers that run the service for us, each bound to use it only on our instructions:
- Supabase — hosts our database. Data is stored on servers in the Asia-Pacific (Seoul) region.
- Vercel — runs and serves the website.
- Resend — delivers booking and notification emails, when email delivery is enabled.
- Razorpay — processes payments, once paid access is available. Card and bank details are entered on Razorpay’s systems and never reach ours.
- Google Analytics — receives usage events, when analytics are enabled.
Because these providers operate internationally, your data may be stored or processed outside India. We may also disclose data where the law requires it.
8. How long we keep it
- Account and learning data: for as long as your account is open, and for 90 days after you close it, after which it is deleted.
- Consultation records: 3 years from the appointment, or longer where medical record-keeping rules require it.
- Payment and tax records: for the period Indian tax law requires.
- Server logs: a short rolling period for troubleshooting.
9. Your rights
Under the Act you may ask us to:
- tell you what personal data of yours we hold and why;
- correct anything inaccurate, or complete anything missing;
- erase your data, where we are not required to keep it;
- nominate someone to exercise these rights if you are unable to;
- deal with a grievance about how we have handled your data.
Write to [Contact email — to be provided] and we will respond. If you are not satisfied, you may complain to the Data Protection Board of India.
10. Children and students under 18
The Act requires verifiable consent from a parent or guardian before processing the data of anyone under 18. First-year BAMS students may be under 18. If you are, please ask your parent or guardian to create the account and give consent on your behalf. If we learn that we hold a child’s data without that consent, we will delete it.
11. How we protect it
Sign-in requires an authenticator app as well as your email, and repeated failed attempts are rate-limited. Passwords and backup codes are stored as salted hashes, never in readable form. Sessions are carried in a signed, HTTP-only cookie.
Course material is served only to signed-in students who have access to that subject, and the site sends strict security headers including a content security policy.
No system is perfectly secure. If a breach affects your data, we will notify you and the Data Protection Board as the Act requires.
12. Changes to this policy
If we change this policy we will update the date at the top of the page, and tell you directly where the change materially affects you.
13. Contact and grievances
Grievance Officer: [Grievance officer — to be provided].
Email: [Grievance officer email — to be provided].
Post: [Registered address — to be provided].
For anything else, write to [Contact email — to be provided] or call [Contact phone — to be provided]. You can also use our contact page.