Your data. Your controls.
Last updated: 24 September 2026. This is a legal document — clarity over attitude.
1. Who we are
NewHair Health is a technology platform that facilitates teleconsultation and e-pharmacy services through licensed practitioners and registered pharmacies. We are the data fiduciary under the Digital Personal Data Protection Act 2023 ("DPDP Act").
2. What we collect
Identity data (name, phone number — your phone number is your account), health data (screening responses, scalp photographs, prescriptions, progress photos), transaction data (orders, payments), and usage data (app and WhatsApp interactions). Health data is classified as sensitive personal data under the DPDP Act and is processed only with your explicit consent.
3. Why we process it
To provide the hair-health service you asked for: screening, diagnosis by a registered dermatologist, prescription, dispensing, and ongoing support. For marketing communication we ask separately — and you can refuse it without losing any part of the clinical service. Consent is versioned and revocable at any time from your DPDP Consent Centre.
4. Where it lives
All personal data is stored in India and never leaves Indian territory. This is a hard technical constraint, not a policy statement.
5. Your rights
Under the DPDP Act you have the right to access, correct, and erase your personal data (with the exception of records we are legally required to retain — prescriptions are kept per the Drugs & Cosmetics Rules). You can export your data as JSON within 24 hours of request. Account deletion is honoured within 30 days.
6. Photographs & AI
Scalp photographs are processed by Tricho (our AI screening assistant) to produce a screening estimate — never a diagnosis. A registered dermatologist confirms every clinical finding. Consent to photo-for-AI processing is separate from marketing consent, and revocable independently. Every photo and prescription carries an audit trail.
7. Grievance Officer
Per IT Rules 2021, see /contact for the named officer and the response SLA (15 days acknowledge / 30 days resolve).