Privacy Policy

Last Updated: 5 November, 2026

At Tattva Wellness Spa, we value the trust you place in us when you share your personal information. We are committed to handling it responsibly, protecting it from misuse and respecting your privacy – whether you browse our website, book a treatment, visit our spas or shop with us. If you have any questions about how we handle your information, please contact us at wecare@tattvaspa.com

iAbout Us

Elementia Wellness Pvt. Ltd. (“we,” “us,” or “our”) offers wellness services and products under its brands Tattva Wellness Spa, Too Yoo, Unora and VILASA (collectively, the “Brands”). Elementia Wellness Pvt. Ltd., whose registered office is at B-126, Rear Side Basement Malviya Nagar, South Delhi, New Delhi-110017 (CIN: U93090DL2013PTC249644), is the company responsible for the personal information collected under this Policy.

This Privacy Policy explains how we collect, use, share and protect your personal information across our Brands. It applies to our website, www.tattvaspa.com (the “Website”), communications with us (including WhatsApp), booking and reservation systems, physical spa locations, product purchases and any other service that links to this Policy.

Not covered

This Policy does not cover our associates, employees, consultants, vendors, partners or job applicants, whose personal information is handled under separate notices.

This Policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We are also preparing as per the Digital Personal Data Protection Act, 2023 and the Rules made under it, and will align our practices with them as the relevant provisions come into force.

1Information We Collect

We collect information in the following ways:

a Information you give us directly

Basic details: name, email address, phone number, and gender.
Billing/postal address (for gift cards, invoices, or memberships).
Date of birth (for age verification, birthday offers, or membership eligibility).
Booking details – preferred Spa location, service/therapy selected, appointment date and time, and any special requests or comments.
Health-related preferences relevant to your treatment, such as allergies, skin/muscle conditions, pregnancy status, or medical conditions that our therapist(s) and team(s) should be aware of, where you choose to share this with us for your safety during the therapy. (See the note below.)
Account credentials, if you create a login on the Website.
Feedback, reviews, testimonials, or communications you send us (including via email, WhatsApp, phone, or contact/callback forms).
Corporate or hotel-partner enquiry details, if you contact us regarding hotel spa partnerships, franchise enquiries, or corporate wellness programs.
GST number and business name, if you ask for a tax invoice in your company’s name.
Call recordings of calls with our booking team, spa teams and customer care teams. Calls may be recorded for quality, training and dispute-resolution purposes.
CCTV footage from reception, waiting and other common areas of our spa outlets, used for the safety and security of guests, staff and property.

About health information

You share this information voluntarily and with your explicit consent (for example, on our intake form or booking page) so that we can deliver your therapy safely. It is sensitive personal information: you may choose not to provide it, or withdraw your consent at any time, although we may then be unable to offer certain therapies.

Your privacy in our spas

We do not place cameras inside treatment rooms, changing rooms or washrooms. Your privacy & comfort is of utmost importance to us.

b Information collected automatically

When you visit our Website, we may automatically collect information about:

Your IP address, browser, device and operating system.
The pages you visit, the links you click and the time you spend on our Website.
Location data (such as city selection) to show you relevant Spa locations.
Your interactions with our Website through cookies and similar tracking technologies (see Section 4 below).
Information from analytics, advertising and social media tools (such as pixels or SDKs) about how you reached and used our Website, subject to your cookie choices.

c Information from third parties

Payment gateway partners: confirmation and transaction status (we do not receive or store your full card/UPI credentials – see Section 5 below).
Social media platforms, if you interact with us there (e.g., Facebook, Instagram, LinkedIn).
Hotel partners or franchise locations where a Tattva Spa outlet operates within their premises, to the extent needed to fulfil your booking.

2How We Use Your Information

We use the information we collect to:

Process and manage your Spa bookings, reservations, gift cards, and membership.
Personalise your treatment experience, including accommodating health-related preferences you share with your therapist.
Communicate with you about your bookings, order confirmations, and customer service requests.
Send you promotional offers, newsletters, and marketing communications via email, SMS, or WhatsApp, where you have consented to receive these. You can withdraw your consent at any time (see Section 8).
Process payments through our third-party payment gateway and prevent fraud.
Improve our Website, services, and Spa experience through analytics and feedback.
Operate CCTV and call recording for safety, security, quality assurance, training and dispute resolution.
Comply with applicable legal, tax, and regulatory obligations.
Enforce our Terms & Conditions and protect the rights, property, or safety of Tattva Spa, our guests, or others, as applicable.

Health information stays protected

We do not use health-related information you share with your therapist for any purpose other than delivering your treatment safely. Access to this information is limited to the therapists and team members who are involved in the reservation process & those who need it for this specific purpose.

We provide a clear notice when collecting any personal data, explaining the specific purposes, how consent may be withdrawn, and how to exercise applicable rights. Where processing relies on consent, we will obtain it through a clear affirmative action and record it.

We share your Personal Information with third parties to help us use your Personal Information, as described above.

Third-party service providers

We may share your personal information on a need-to-know basis with external partners who help us run our Website and deliver our products and services. Their support may include hosting, processing payments, fulfilling orders, sending communications, marketing, analysing data, assisting customers and gathering feedback through research or surveys. We require service providers to protect personal data through appropriate contractual safeguards and to process it only for authorised purposes.

Personalisation and behavioural analytics

To tailor your Website experience and better understand browsing behaviour, we may provide selected service providers with relevant information on a need-to-know basis. Depending on the purpose, this may include your name, email address, mobile number, device details, location or network carrier. Where you have permitted advertising cookies or marketing, we may also use advertising platforms (such as social media or search advertising) and share limited identifiers with them, such as an email address or phone number in hashed form, to measure and deliver our advertising.

Technology and communication providers

We use third-party tools to manage customer relationships and bookings, to run our telephony (including IVR, and call-dialling systems) services and to send messages (including WhatsApp Business communication platforms, SMS and email services). These providers process your personal information only on our instructions and for the purposes described in this Policy. Some of them may store or process data on servers outside India. Where this happens, we take steps to keep your information appropriately protected and we comply with any restrictions the Government of India places on such transfers.

Spa and hotel partner locations

Where your chosen Spa is located within a hotel or other partner premises, we may share relevant personal information with that partner on a need-to-know basis to coordinate your appointment and fulfil your booking.

Franchise partners

If your chosen Spa is operated by a franchise partner, we may share the information needed to manage your booking, provide your requested services and assist with related enquiries, on a need to know basis. We ask franchise and hotel partners to handle this information only to fulfil your booking and in line with this Policy.

Group companies

Group companies under Elementia Wellness Pvt. Ltd. (including associated brands), for internal business and customer service purposes.

Business transfers

If we are involved in a merger, acquisition, restructuring or sale of assets, personal information may be transferred to the successor entity, which will be required to honour this Policy. Where the law requires, we will notify you.

Legal and regulatory authorities

Where required to comply with law, legal process, or government request, or to protect our rights, property, or the safety of our guests, staff, or the public.

Our promise

We do not sell your personal information. We do not disclose it to third parties for their independent marketing purposes without your consent.

4Cookies and Similar Technologies

We may use cookies and similar technologies to operate, safeguard and improve our Website and services. These help us personalise your experience, display relevant advertisements, measure their effectiveness and understand how visitors use our Website.

You can block or delete cookies through your browser or device settings. However, doing so may limit certain Website features or affect your access to some of our services.

We will ask for your consent before enabling non-essential analytics or advertising cookies, and you can change your cookie preferences at any time through the cookie settings on our Website.

The cookies we use fall into three broad categories:

Essential cookies

Needed for the Website to work, for example to keep your booking session active.

Analytics cookies

To help us understand how visitors use the Website.

Advertising cookies

To show you relevant advertisements and measure their effectiveness.

5Payments

All online payments made on the Website are processed through PCI-DSS compliant, third-party payment gateway providers. PCI-DSS stands for Payment Card Industry Data Security Standard, a set of security requirements maintained by the PCI Security Standards Council to help protect cardholder information and support the secure handling of card payments.

Online payments

We do not collect or store your full card number, CVV, or net-banking/UPI credentials on our servers. These details are provided directly to our payment gateway providers and processed in accordance with their security standards and privacy policies. We receive your transaction status and limited details necessary to process your booking or order.

At our outlets

When you pay at one of our spa or retail outlets by card or UPI, the payment is processed through the card terminal or payment app of our acquiring bank or payment provider. We do not store your card details. We keep only limited transaction details, such as the transaction reference, amount and date, for billing, reconciliation and refunds.

6Data Retention

We retain personal information only for as long as needed for the purposes stated in this Policy, or as required by applicable law or taxation records. Different categories of data may have different retention periods. Once retention is no longer necessary, we delete or de-identify the data, subject to lawful retention requirements.

Our indicative retention periods are:

Type of data	How long we keep it
Booking and treatment records, including health-related information	3 years after your last visit
Account details and marketing preferences If you opt out, we keep only your contact detail on a suppression list so that we don’t contact you again.	Until you delete your account or withdraw consent
Invoices and transaction records	8 years (as required by tax and company law)
CCTV footage	30 days, unless needed to investigate an incident
Call recordings	90 days, unless needed to investigate an incident
System, access and security logs	At least 1 year (as required by law)

7Data Security

We take reasonable technical and organisational measures to safeguard your personal information against loss, misuse, unauthorised access, alteration or disclosure. These measures include access controls and encryption of information transmitted during online transactions. We also take reasonable steps to keep paper records, such as treatment intake forms, in secure storage with restricted access.

If a personal-data breach occurs, we will assess it and make notifications to affected individuals and the relevant authority where required by applicable law.

We work to protect your information both during transmission and while it is stored with us. However, no security system, internet transmission or method of electronic storage is completely secure, and we cannot guarantee absolute security. If you have any questions about how we protect your information, please contact us using the details in Section 11.

8Your Rights and Choices

Subject to applicable law (including India’s Digital Personal Data Protection Act, 2023), you may have the right to:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Withdraw consent at any time for processing that relies on your consent, including marketing communications and health-related information. Withdrawing consent will be as easy as giving it, but may mean we cannot provide some services
Request deletion of your personal information, subject to our legal and record-keeping obligations
Raise a grievance regarding how your information is handled
Request information about the personal information we process and the parties with whom we have shared it
Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity

To opt out of marketing

You can unsubscribe from promotional emails using the “unsubscribe” link in any email, reply “STOP” to promotional SMS/WhatsApp messages, or contact us using the details in Section 11.

To exercise any of these rights, please contact us using the details in Section 11. We may need to verify your identity before acting on your request. We will acknowledge your request within [48 working hours] and aim to respond within [30 days].

Some of these rights depend on the commencement of the relevant provisions of the Digital Personal Data Protection Act, 2023. We will honour them as and when they apply to us.

Subject to applicable law and commencement of the relevant provisions, you may also request information about processing and sharing, nominate another individual to exercise your rights in specified circumstances, and seek grievance redressal through the applicable statutory mechanism.

9Children’s Privacy

Our Website is intended for users aged 18 and above. Minors (under 18) may receive spa services only where booked by, and accompanied by, a parent or legal guardian, subject to the age and accompaniment requirements of the relevant outlet.

In such cases we collect the minor’s information only from the parent or legal guardian, only as needed to deliver the service safely, and only with their verifiable consent. We do not use a minor’s personal information for marketing, profiling, behavioural monitoring or targeted advertising.

If we discover that we have collected a minor’s personal information without the required consent, we will take steps to delete it as soon as possible. If you are a parent or legal guardian and believe your child has provided us with personal information, or you wish to review, correct or withdraw your consent for your child’s information, please contact us so we can take appropriate action and delete the information.

10Third-Party Links and Platforms

The Website may contain links to other websites and platforms, including our associated webshop (shoptattva.com), social media pages, partner hotel websites, and any other third-party websites. This Privacy Policy does not apply to these external websites or platforms. We encourage you to review their respective privacy policies before sharing any Personal Information with them.

11Contact Us / Grievance Officer

If you have any questions regarding this Privacy Policy or our privacy practices, you may email us at wecare@tattvaspa.com with the subject title ‘Privacy Policy’.

In case of any escalation/concerns regarding this Privacy Policy, please contact our Grievance Officer:

Name: Vinay Singh

Designation: Senior Manager – Human Resources & Compliance

Email: grievance@tattvaspa.com

We will acknowledge your complaint within [48 working hours] and aim to resolve it within [30 days] of receiving it. If you are not satisfied with our response, then once the relevant provisions of the Digital Personal Data Protection Act, 2023 come into force, you may also complain to the Data Protection Board of India.

For customer support and enquiries, you can also reach us at:

Phone: 9999120413

Website: Contact Us

12Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We encourage you to review this Policy periodically. Where a change requires fresh consent under applicable law, we will seek that consent before undertaking the relevant processing.

We will post the updated version with its effective date and provide additional notice for material changes where appropriate.