Privacy Policy

This Privacy Policy is an electronic record in the form of an electronic contract formed under the Information Technology Act, 2000 and the rules made thereunder, and to the extent applicable, the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It does not require any physical, electronic, or digital signature. You agree to the terms of this Privacy Policy by your usage of the Website/App.


Digitalist Tech Media Pvt. Ltd. (“Company”/ “We”/ “Us”/ “Our”), a company incorporated under the laws of India, having its registered office at 17th Floor, 1701, Sky Flama, T J Road, Parel, Mumbai, Maharashtra, 400015, is committed to ensuring the privacy of our users (“User”, “You”, “Yourself or “Your”). This “Privacy Policy” elucidates the manner in which your information is collected, stored and used by Us in the course of your use of the Website (www.shop.gytree.com).


PLEASE READ THIS PRIVACY POLICY CAREFULLY, TOGETHER WITH OUR TERMS OF USE. BY USING THE WEBSITE, YOU CONFIRM THAT YOU UNDERSTAND, AGREE TO, AND CONSENT TO THE DATA PROCESSING, CONSENT COLLECTION INTERFACE, AND CHOICE FOR OPTIONAL PURPOSES UNDER THE PRIVACY POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT USE THIS WEBSITE.


This Policy may be amended from time to time. We will update the "Last Updated" date above whenever we do, and where a change is material, we will notify You through the Website, a pop-up notice, or by e-mail, as appropriate. We encourage You to review this Policy periodically.

1. Scope

This Policy applies to Personal Data collected through the Website and Apps, whether You are a registered User, a guest checkout customer, or simply a visitor. It is drafted with reference to:


The Information Technology Act, 2000, the (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") and the Digital Personal Data Protection Rules, 2025 which are currently the operative data-protection law in India;


The Digital Personal Data Protection Act, 2023, whose provisions are being brought into force in phases by the Central Government (with substantive obligations relating to consent, notice, data principal rights, and breach reporting scheduled to take full effect in 2027). We have proactively aligned our practices to the DPDP Act's principles ahead of that date; and


The Consumer Protection (E-Commerce) Rules, 2020, which require e-commerce entities to appoint a Grievance Officer and meet defined grievance-redressal timelines.


Under the DPDP Act, Gytree acts as a "Data Fiduciary" in respect of Your Personal Data, and You are the "Data Principal."

2. Information We Collect

2.1. Personal Data — Personal Data is information that can identify You, directly or indirectly. This includes but is not limited to:

  1. Name, address, telephone number, e-mail address, date of birth, gender;
  2. Transaction and purchase history on the Website;
  3. Internet Protocol (IP) address and device/communication identifiers;
  4. Information You provide during registration or checkout;
  5. Health/Medical Information, such as consultation history, symptoms, reports, prescriptions, nutrition information or reproductive-health information, where necessary collected only where You avail medical, wellness, or health-advisory services through the Website, and used solely to enable our Health Professionals / Registered Medical Practitioners ("RMP") to provide those services;
  6. Any Personal Data You provide about a third party (e.g., a family member for whom You are booking a service) — You confirm You have that person's authority to share it, and it will be governed by this Policy as well.

We may also receive Personal Data about You from third parties, such as social media platforms (if You log in or connect via a social media service), payment partners, or business partners, in accordance with their own terms.


2.2. Non-Personal / Technical Data — We also collect information that does not, on its own, identify You: geographic location, ISP/telecom provider, browser and device type, operating system, referring website, log files, and session duration. This is collected via cookies, web beacons, and similar technologies. See our Cookie section below.


2.3. Sensitive Personal Data or Information (SPDI) — Where applicable, certain categories above (e.g., health data, payment-related information) qualify as "Sensitive Personal Data" under the SPDI Rules. We collect such data only where necessary for the Purposes below, and with Your explicit consent.

3. Consent

By providing Your Personal Data or using the Website, You consent to its collection, storage, processing, and transfer as described in this Policy. Where the DPDP Act requires it, we will obtain Your free, specific, informed, unconditional, and unambiguous consent through a clear affirmative action (e.g., a checkbox), accompanied by an itemized notice describing what data is collected and why.


You may withdraw consent at any time by writing to us at customercare@gytree.com, by informing us which service you intend to withdraw.


Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and We will cease processing (and, where applicable under Section 7 below, delete) Your Personal Data within a reasonable time after withdrawal, unless retention is required by law.


Please do not submit any Personal Data or Sensitive Personal Data unless it is specifically requested through the registration, checkout, or service-booking process.

4. Purposes of Collection and Use

We collect, use, store, and process Your Personal Data for purposes connected with our business, including to:

  1. Facilitate Your use of the Website and its services;
  2. As required by Shopify for allowing You to use and interact with our Website;
  3. Process orders, payments, and deliveries, and provide related customer support;
  4. Respond to inquiries and provide information about products/services;
  5. Send administrative communications (order updates, policy changes, security alerts);
  6. With Your consent, send marketing communications and personalized offers;
  7. Personalize Your experience on the Website;
  8. Diagnose and resolve technical issues;
  9. Where You avail health/medical services, enable our Health Professionals/RMPs to deliver those services, including related customer support;
  10. Detect, investigate, and prevent fraud, security breaches, or illegal activity;
  11. Comply with legal, judicial, or regulatory requirements, including responding to lawful requests from law enforcement;
  12. Support a potential merger, acquisition, or investment diligence process (see Section 9).

We will not use Your Personal Data for a purpose incompatible with the purpose for which it was originally collected, without seeking fresh consent where required by law.

5. Sharing and Disclosure of Your Information

5.1. Service Providers, including Shopify — Gytree's Website is hosted and operated using Shopify as our e-commerce platform provider. In this relationship, Shopify acts as a data processor / service provider on Gytree's behalf for certain functions (e.g., store hosting, payment facilitation, order management). Shopify's own privacy commitments (available at shopify.com/legal/privacy) apply to its handling of data as our processor, and Shopify states that it does not sell Personal Data.


5.2. Other Third Parties — We may share Your Information with:

  1. Payment gateways, banks, and financial institutions, to process transactions (Gytree does not itself store Your card/payment credentials);
  2. Logistics and delivery partners, to fulfil Your orders;
  3. Analytics, security, and fraud-detection service providers;
  4. Health Professionals/RMPs, where You avail medical services;
  5. Law enforcement, courts, or regulators, where required by law or a valid legal process;
  6. A successor entity, in the event of a merger, acquisition, or sale of business/assets (Section 9).

We do not sell Your Personal Data to third parties for their independent marketing use.


5.3. Cross-Border Transfer: We may store or process Your Information outside India (including on servers used by our service providers such as Shopify, which may process data in Canada, the United States, or other jurisdictions). Under the DPDP Act, cross-border transfer of Personal Data is permitted to all countries except those specifically restricted by the Central Government by notification. We require our processors to maintain reasonable security standards for any data processed outside India.

6. Third-Party Links

The Website may contain links to third-party websites or advertisements not controlled by Us. We are not responsible for the privacy practices or content of such third-party sites. Please review their privacy policies independently before sharing information with them.

7. Data Retention and Deletion

7.1. We retain Your Personal Data only for as long as necessary to fulfil the Purposes described in Section 4, or as required by applicable law (e.g., tax, accounting, or consumer-protection recordkeeping requirements).


7.2. You may request deletion of Your Personal Data at any time by writing to customercare@gytree.com. On receiving a valid request, We will verify Your identity and, forward the request to Shopify which is our Data recorder and processor who shall as be responsible for, subject to any legal retention obligations, deletion or anonymization of Your Personal Data within 90 days of the request, subject to identified legal retention requirements. Please note that deletion of Your data will mean You can no longer use Our Services under that account; You may sign up afresh as a new User if You choose to return.


7.3. We use Shopify as a service provider and as per their privacy policy which can be accessed at https://www.shopify.com/in/legal/privacy?country=in&lang=en#how-we-protect-your-information, the customer may at any time request for the deletion of their personal data.


7.4. We do not store Your credit/debit card information; all online payment processing is handled by our third-party payment gateway(s) under their own security standards.


7.5. Non-Personal (aggregated/anonymized) Information may be retained indefinitely, as it does not identify You.


7.6. We are not liable for loss, damage, or misuse of Your Information arising from a Force Majeure Event (e.g., natural disaster, war, government action, or a security breach despite reasonable safeguards being in place), subject to any applicable statutory duty.

8. Your Rights as a Data Principal

Subject to applicable law and any exemptions, You have the right to:

  1. Access a summary of the Personal Data We hold about You and the processing activities undertaken;
  2. Correct or update inaccurate or incomplete Personal Data;
  3. Erase Personal Data that is no longer necessary for the purpose it was collected, or on withdrawal of consent (Section 7);
  4. Withdraw consent at any time (Section 3);
  5. Nominate another individual to exercise these rights on Your behalf in the event of Your death or incapacity;
  6. Grievance redressal: raise a complaint with Us in the first instance (Section 11), and if unresolved, escalate to the Data Protection Board of India once its complaint-handling functions are operational.

To exercise any of these rights, write to customercare@gytree.com. We may request additional information to verify Your identity before acting on the request.

9. Business Transfers

If We are involved in a merger, acquisition, reorganization, or sale of assets, Your Information may be transferred as part of that transaction. Any successor entity will be bound to handle Your Information in accordance with this Policy (or a policy providing at least equivalent protection), unless You are notified otherwise and given an opportunity to object where required by law.

10. Children's Data

Our Website and services are not directed at, and We do not knowingly collect Personal Data from, individuals under 18 years of age, except with verifiable consent of a parent or lawful guardian,. If We become aware that We have collected Personal Data from a child without appropriate consent, We will take steps to delete it.

11. Grievance Officer

In accordance with the Information Technology Act, 2000, the SPDI Rules, and the Consumer Protection (E-Commerce) Rules, 2020, the details of Our Grievance Officer are:


Name: Akash Singh
Designation: Grievance Officer, Digitalist Tech Media Pvt. Ltd.
E-mail: customercare@gytree.com


We will acknowledge Your grievance within 48 hours of receipt and resolve it within one month from the date of receipt, in line with the Consumer Protection (E-Commerce) Rules, 2020.

12. Data Breach Notification

In the event of a Personal Data breach, You will be notified and, where applicable, the Data Protection Board of India, without undue delay, along with the nature of the breach and the steps being taken to mitigate it, in accordance with applicable law.

13. Cookies

We use cookies, web beacons, and similar technologies for functionality, security/fraud-detection, analytics, and (where consented) advertising purposes. You may configure Your browser to block or alert You to cookies; doing so may limit certain Website features. By continuing to use the Website, You consent to Our use of cookies as described here.

14. Security

We implement reasonable security practices and procedures, as mandated under the IT Act and SPDI Rules, to protect Your Personal Data from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission or storage over the internet is 100% secure, and We cannot guarantee absolute security.

15. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Courts at New Delhi shall have exclusive jurisdiction over any disputes arising from this Policy, subject to applicable consumer-protection forums available to You.

16. Contact Us

For any questions, requests, or grievances regarding this Policy or Our handling of Your Personal Data, please contact:

E-mail: Customercare@gytree.com
Grievance Officer: Akash Singh as stated above