Privacy Policy

Leaf Genix Lifesciences ("we", "us", "our") operates the website leafgenix.in. This Privacy Policy explains what personal data we collect when you use the Website, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

The principle we work to is simple: we collect the minimum we need to take your order and get it to you, and we do not sell it to anyone.

• We do not ask for health records, prescriptions, diagnoses or medical history, and you should not send them to us. If you describe a health concern in a message, we use it only to answer that message and do not add it to any profile.
• We do not collect government identity numbers such as Aadhaar or PAN from customers.
• We do not collect biometric data.
• We do not knowingly collect data from children — see the section on children below.
• We do not buy personal data from data brokers or third-party lists.

We do not sell, rent or trade your personal data. We share it only with the service providers who make your order possible, and only to the extent each one needs:

Each provider is bound by its own contractual and legal obligations to protect the data we pass to it, and may use it only to perform the service for us.

Our database and order records are hosted in India, in the AWS Asia Pacific (Mumbai) region. Some of our service providers may process limited data on infrastructure outside India — for example content delivery or error monitoring. Where that happens, we take reasonable steps to ensure a comparable standard of protection applies.

When a retention period ends we delete the data or irreversibly anonymise it so that it can no longer be linked to you.

We use a deliberately small number of strictly necessary technologies. We do not use advertising cookies, behavioural profiling, or third-party marketing trackers.

You can clear both at any time through your browser settings. Clearing them signs you out and empties your bag, but does not affect any order you have already placed.

Under the Digital Personal Data Protection Act, 2023 you have the following rights in relation to your personal data. To exercise any of them, write to support@leafpharmaceuticals.in from the email address associated with your order or account.

1. 1.Right to access — ask for a summary of the personal data we hold about you and how we have processed it.
2. 2.Right to correction — ask us to correct data that is inaccurate or misleading, and to complete data that is incomplete.
3. 3.Right to erasure — ask us to delete your personal data where we no longer need it for the purpose it was collected.
4. 4.Right to withdraw consent — where processing is based on your consent, withdraw it at any time. Withdrawal does not affect processing already carried out.
5. 5.Right to grievance redressal — complain to our Grievance Officer about how we have handled your data.
6. 6.Right to nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

We respond to requests within 30 days. We may need to verify your identity before acting, to make sure we are not disclosing your data to someone else.

• The entire Website is served over HTTPS with TLS encryption.
• Database access is restricted by row-level security policies, so one customer's records cannot be read by another.
• Administrative credentials are held only on the server and are never exposed to the browser.
• Payment credentials never touch our systems at all — Razorpay handles them on its own PCI-DSS compliant infrastructure.
• Payment confirmations are verified using cryptographic signatures before an order is marked paid.
• Access to production data is limited to the people who need it to run the business.

No system can be guaranteed perfectly secure. We take reasonable technical and organisational measures appropriate to the sensitivity of the data we hold, and in the event of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.

This Website and the purchase of our Products are intended for adults aged 18 and over. We do not knowingly collect personal data from children. Some of our Products are formulated for use by children under adult supervision, but the purchase itself must be made by a parent or guardian.

If you believe a child has provided us with personal data, please contact support@leafpharmaceuticals.in and we will delete it.

If you have a concern about how your personal data has been handled, contact our Grievance Officer:

We acknowledge every complaint within 48 hours and aim to resolve it within 30 days. If you remain dissatisfied, you may escalate to the Data Protection Board of India.

We may update this Privacy Policy as our business, our systems or the law change. The updated version takes effect when published on this page and the 'Last updated' date will change.

Where a change materially affects how we use data you have already given us, we will notify you by email before it takes effect.