1. Introduction

Tamira Aesthetics Healthcare & Lifestyle Pvt. Ltd. ("Tamira", "we", "us", "our") is engaged in the business of providing plastic cosmetic surgeries and medical consultancy services ("Services") to patients (referred to as "you", "your", or "User" as applicable). The Services are rendered through our website at https://www.aesthatiq.com ("Website") or through various mobile/web applications made available to you from time to time ("Applications"). The Website and Applications are collectively referred to as the "Platform", which is owned, controlled, and operated by Tamira.

This Privacy Policy explains how we collect, use, share, disclose, and protect personal information about the Users of the Services and the visitors of the Website (jointly and severally referred to as "you" or "Users").

By using the Services or by otherwise giving us your information, you will be deemed to have read, understood, and agreed to the practices and policies outlined in this Privacy Policy and agree to be bound by it. If you do not agree with this Privacy Policy at any time, do not use any of the Services or access our Platform.

2. Consent and changes to this Policy

You hereby consent to our collection, use, sharing, and disclosure of your information as described in this Privacy Policy. We reserve the right to change, modify, add, or delete portions of the terms of this Privacy Policy at our sole discretion, at any time.

If you use the Services on behalf of someone else (such as your child) or an entity (such as your employer), you represent that you are authorised by such individual or entity to (i) accept this Privacy Policy on their behalf, and (ii) consent on their behalf to our collection, use, and disclosure of their information as described in this Privacy Policy.

If you are located in the European Union ("EU") or European Economic Area ("EEA"), you will be asked to provide clear and affirmative consent to the collection, processing, and sharing of your personal information, subject to withdrawal of your consent at any time on request. This Privacy Policy is intended to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") with respect to Users who are in the EU and EEA. Tamira will not share any personal information with any third party without your consent, except as outlined in this Privacy Policy or as permitted by law.

3. Collection of personal information

When you access our Platform, we collect, store, and retain certain information for the provision of Services, when you fill out the requisite documentation as may be required by Tamira (as applicable), including but not limited to the following:

• Your personal details such as name, date of birth/age, and gender;
• Contact details such as residential address, contact number, and email address;
• Pre-existing health conditions along with any personal medical records and history;
• Insurance details (if relevant);
• Login ID (we do not store a copy of your password);
• User details as provided at the time of registration or any time thereafter;
• Usage details such as time, frequency, duration, and pattern of use, features used, and the amount of storage used;
• Photographs and video/audio recordings of consultations, and any other information that is willingly shared by you or is essential for rendering our Services.

4. Sensitive personal data (SPDI Rules)

"Personal Information" is defined under the Information Technology (Reasonable Security Practices & Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") to mean any information that relates to a natural person which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.

The SPDI Rules further define "sensitive personal data or information" of a person to mean personal information relating to the following:

• Passwords;
• Financial information such as bank accounts, credit and debit card details, or other payment instrument details;
• Physical, physiological, and mental health condition;
• Sexual orientation;
• Medical records and history;
• Biometric information;
• Information received by a body corporate under lawful contract or otherwise;
• Visitor details as provided at the time of registration or thereafter; and
• Call data records.

5. Cookies and information collected automatically

To improve the responsiveness of the Platform, certain information may be passively collected (that is, gathered without your actively providing it) using technologies such as Internet Protocol (IP) addresses, cookies, internet tags, and navigational data collection.

An IP address is a number assigned to your computer by your Internet service provider and is generally considered non-personally identifiable information, because in most cases it is dynamic rather than static. We use your IP address to diagnose problems with our server, report aggregate information, determine the fastest route for your connection, and administer and improve the Platform. Navigational data is used for system management, to improve content, for market research, and to communicate information to visitors.

A cookie is a string of information that a website stores on a visitor's computer and that the visitor's browser provides back to the website on each return visit. We use cookies to help identify and track visitors, their usage of our Website, and their access preferences. Users who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using our Website, with the drawback that certain features may not function properly without cookies.

6. Accuracy of your information

You are responsible for maintaining the accuracy of the information you submit to us, such as the contact information provided as part of account registration. If your Personal Information changes, you may correct, delete inaccuracies, or amend information by notifying us at privacy@aesthatiq.com.

If you provide any information that is untrue, inaccurate, out of date, or incomplete (or becomes so), or Tamira has reasonable grounds to suspect the same, Tamira may, at its sole discretion, discontinue the provision of the Services to you. Tamira retains the right not to correct, delete, or update your Personal Information where (a) the information is opinion data kept solely for an evaluative purpose, or (b) the information is in documents related to a prosecution where all proceedings have not been completed.

7. Consent to use personal information

By providing your Personal Information (including any changes thereto) and/or accessing the Platform, you consent to the collection, storage, use, and disclosure of your Personal Information by Tamira for the purposes and to the persons outlined in this Privacy Policy. Collection of information designated as "sensitive personal data or information" under the SPDI Rules requires your express consent, and by affirming your assent to this Privacy Policy you provide such consent as required under applicable law. Our Services may be unavailable to you if such consent is not given or if you choose to withhold Personal Information, and in such cases Tamira will not be liable for the denial of Services.

Insofar as your patient records are maintained with us, they will be kept strictly confidential and accessible only by you and the Practitioner to the extent required to enable the provision of Services. In the event of a dispute relating to the Services or this Privacy Policy, Tamira shall be permitted to access your patient records.

We will not process your Personal Information without a lawful basis. In general, we may process your Personal Information on the legal basis of: (i) consent; (ii) contract (where you have availed Services and/or entered into an agreement with Tamira and such processing is a necessary part thereof); (iii) compliance with applicable laws; or (iv) to protect the vital interests of any individual.

8. If you are a User from the EU or EEA

Under the GDPR, EU/EEA residents have the following rights, which can be exercised at any time by contacting Tamira at dpo@aesthatiq.com:

• To know the purpose for processing the Personal Information;
• To know the status of Personal Information processed;
• To access the Personal Information that is processed;
• To erase or rectify the Personal Information;
• To restrict the processing of the Personal Information;
• Data portability — to download all Personal Information shared with Tamira in a readable format for your own purposes; and
• To opt out of processing the Personal Information (unless Tamira has otherwise compelling legitimate grounds).

9. Access, retention, and deletion of Personal Information

When you sign up for the Services, you opt in to receive emails from Tamira. You can manage your email preferences and follow the "unsubscribe" instructions in commercial email messages. As a User, you have the right to access, correct, delete, or transfer the Personal Information that Tamira holds, including registration details.

If required by you, Tamira will delete the Personal Information provided by you in connection with the Services, remove your public posts from view and/or dissociate them from your account profile, and thereafter either delete your Personal Information or de-identify it. Upon deletion, copies of your Personal Information may remain viewable in cached and archived pages. Tamira may retain information about you for the purposes authorised under this Privacy Policy unless prohibited by law.

We can retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria for determining the retention duration include: (i) the length of time we have an ongoing relationship with you and provide the Services; (ii) any legal obligation to which Tamira is subject; or (iii) the legitimate interests of Tamira (such as litigation or regulatory investigations). Tamira is not responsible for the retention or use of Personal Information by any Practitioner.

10. Listing of Practitioner information

Tamira automatically enables the listing of Practitioners' information on its Platform for every "Doctor" or "Clinic" it has partnered with. This information is displayed when Users search for doctors and is used by Users to request appointments. "Practitioners" refers to the medical practitioners, health care providers, or similar institutions listed on the Website, including their designated, authorised associates.

Any personally identifiable information of Practitioners listed on the Website is not generated by Tamira; it is provided by Practitioners who wish to enlist on the Platform or is collected from the public domain. Tamira displays such information on an as-is basis, making no representation or warranty as to its accuracy or completeness. We strongly encourage Practitioners to check the accuracy and completeness of their information from time to time and inform us of any discrepancies. Tamira may also display information for Practitioners who have not yet registered, and does not undertake any liability for incorrect or incomplete information appearing on the Platform for such Practitioners.

11. Security and confidentiality

Your Personal Information is maintained by Tamira and may also be converted to physical form from time to time, in accordance with applicable laws. Tamira takes all necessary precautions to protect your Personal Information both online and offline, and implements reasonable security practices and measures commensurate with the information collected and the nature of our business.

No administrator at Tamira will have knowledge of your password. It is important for you to protect against unauthorised access to your password, computer, and mobile phone. Tamira does not undertake any liability for any unauthorised use of your account and password. If you suspect any unauthorised use of your account, you must immediately notify Tamira at privacy@aesthatiq.com. You shall indemnify Tamira against any loss suffered due to such unauthorised use.

Tamira makes User information accessible to its employees, agents, partners, and third parties only on a need-to-know basis, and binds its employees to strict confidentiality obligations. Tamira will not rent or sell personally identifying information. To enable the provision of Services, Tamira may engage and share Personal Information with third parties towards the limited purpose of provision of Services, and by accepting this Privacy Policy you consent to such sharing. Where a third party requires you to accept its own privacy policy and/or terms of use, Tamira shall not be responsible for any breach, action, or omission on the part of such third party.

Tamira is not responsible for the confidentiality, security, or distribution of your Personal Information by partners and third parties outside the scope of our agreement with them, nor for any breach of security or actions of third parties or events beyond Tamira's reasonable control, including acts of government, computer hacking, unauthorised access, computer crashes, breach of security and encryption, or poor quality of Internet or telephone service.

12. Business transfers

If Tamira, or substantially all of its assets, were acquired, or in the unlikely event that Tamira goes out of business or enters bankruptcy, the acquired Personal Information would be one of the assets transferred to or acquired by a third party. You acknowledge that such transfers may occur and that any acquirer of Tamira may continue to use your Personal Information as set forth in this Privacy Policy.

13. Amendment

This Privacy Policy may be amended at any time by Tamira at its sole discretion. The same shall be intimated to you through the Platform and/or by email at the point of go-live of the amended Privacy Policy. Your continued use of the Platform after such amendment shall constitute your acceptance.

14. Contact

For any questions, queries, feedback, comments, or concerns about this Privacy Policy, contact us by email at privacy@aesthatiq.com or by mail at 2nd Floor, No. 27, 1st Street, KGEYES Sreyas Apartments, Gopalapuram, Chennai, Tamil Nadu — 600086, India.

Data Protection Officer: dpo@aesthatiq.com. Grievances: grievance@aesthatiq.com.

15. Acceptance

Your acceptance of this Privacy Policy is effected by your usage of the Platform. Should you have any concerns with using our Platform, kindly contact us at the email above and immediately cease using our Platform.