Privacy Policy

Last updated 2 July 2026

This policy describes what personal data AuraPharmLab collects, why, who else sees it, and what rights you have over it. We try to keep this short and honest. AuraPharmLab is a brand of Harshad Ramineni Content Solutions (OPC) Private Limited (CIN: U74909MH2026OPC467411), based in Mumbai, Maharashtra, India — the company responsible for your personal data (the data fiduciary).

1. What we collect

Data	Source	Why
Email address, name, profile photo URL	Google Sign-In (when you sign in)	To identify you, to display your name in the watermark, to look up your subscription status.
Payment details (card number, UPI ID, billing address)	Razorpay (during checkout)	To process subscription payments. We never see or store these directly — Razorpay handles them as the payment processor.
Subscription record (your email, plan, status, subscription ID, activation/expiry timestamps)	Generated when you subscribe	To check whether you can access subscriber-only content.
Server request logs (IP address, user agent, timestamp, requested URL, country)	Cloudflare (our hosting/edge layer)	Standard web operations, debugging, and abuse prevention. Retained per Cloudflare's defaults.
Session cookie (encrypted Google ID token, HttpOnly, 1-hour lifetime)	Set after sign-in	To keep you signed in across pages without re-prompting Google every request.
Enquiry & contact details (name, phone/WhatsApp number, email, and the course, university, department, topic and deadline you share) — for Thesis Support and our other done-for-you services	The enquiry form or WhatsApp message you send us	To scope your project, communicate with you, and deliver the work you commission.
Order, payment & contribution records (email, the item/subject/class, amount, order and payment IDs, timestamps and receipts) — for thesis orders, crowdfunding contributions, live-class purchases and the Fit programme	Generated when you pay through Razorpay	To fulfil your order, issue receipts, honour refunds where applicable, and keep the accounting records Indian law requires.

We do not use any analytics tracker, advertising tracker, social pixel, heatmap tool, or similar. The site has no third-party trackers beyond what's listed above.

2. How we use your data

To deliver the service. Sign-in, subscription gating, watermarking, and serving the content you paid for.
To send transactional messages. Order confirmations, payment receipts, subscription renewal and expiry reminders, and replies to your enquiries — only about the service you're using, never marketing.
To prevent abuse. If we see content from your account being redistributed, we use the watermark + logs to confirm and may suspend your subscription.

We do not sell, rent, or share your data with third parties for marketing. Ever.

3. Who else sees your data

To run the service, we use these third-party services. Each has its own privacy policy that you should review separately:

Google — for Sign in with Google. Receives the same information any "Sign in with Google" implementation does. Google Privacy Policy.
Razorpay — for payment processing. Receives your name, email, billing address, and payment instrument details. Razorpay Privacy Policy.
Cloudflare — for hosting, edge serving, and storing your subscription record (Cloudflare KV) and your order/contribution records (Cloudflare D1). Cloudflare Privacy Policy.
Resend — for transactional email (order confirmations, receipts, and faculty notifications). Receives your email address and the message content. Resend Privacy Policy.

4. Where data is stored

Your subscription record (email + status + timestamps) is stored in Cloudflare KV, replicated globally. Your order, contribution and enquiry records — for thesis orders, crowdfunding, live classes and Fit — are stored in Cloudflare D1, our database on Cloudflare's infrastructure. Cloudflare's edge servers may be in various regions; in practice for users in India, traffic is usually served from Cloudflare's Mumbai edge. Razorpay processes payment data in India per RBI requirements.

5. How long we keep it

Subscription record: for the duration of your subscription, plus a reasonable period afterward (typically up to 12 months) for accounting and dispute resolution. After that, the record is deleted or anonymised.
Server request logs: per Cloudflare's defaults (typically a few weeks).
Session cookies: 1 hour, then they expire on their own.

6. Your rights

You can:

See what we have on you — email hello@aurapharmlab.com and we'll reply within 30 days.
Correct it — your name and email come from Google; correct them there and they propagate next time you sign in.
Delete it — cancel your subscription and email us asking for full deletion. We'll remove your subscription record and any associated data, except where we're required to retain something for accounting (typically minimal — invoice copies for a few years per Indian tax law).
Withdraw consent / sign out — click "Sign out" anywhere on the site. We disable Google's auto-select and clear your session cookie. To stop the recurring subscription itself, see the Refund & Cancellation Policy.

7. Cookies

We use a single cookie called apl_session. It's set after you sign in, lives for 1 hour, is HttpOnly (so JavaScript can't read it), is Secure (only sent over HTTPS), and SameSite=Lax. Its only purpose is to keep you signed in. There are no advertising or tracking cookies.

8. Children

The site is intended for medical postgraduate students (typically aged 23+). It is not directed at children under 18, and we don't knowingly collect data from children.

9. Changes to this policy

We may update this policy as the service evolves. The "Last updated" date at the top will reflect the most recent change. Material changes will be communicated by email to active subscribers.

Privacy questions or requests?

Email hello@aurapharmlab.com with subject line "Privacy". We'll get back within 30 days.

Grievance Officer: Dr. Harshad Ramineni, for Harshad Ramineni Content Solutions (OPC) Private Limited, Mumbai, Maharashtra, India — hello@aurapharmlab.com. We acknowledge grievances within 24 hours and work to resolve them within 15 days, in line with applicable Indian law (including the Information Technology Rules, 2021 and the Digital Personal Data Protection Act, 2023).

eLogbook (elog.aurapharmlab.com)

The eLogbook collects more than the rest of the site, because it maintains a training record. In addition to the sign-in data above, for elog.aurapharmlab.com we process:

Profile. Residents: name, email, phone, specialty, institution, university, and joining year. Faculty: name, email, phone, designation, institution, specialty, NMC registration number, and HoD status.
Roster links. The faculty you invite (guide, co-guide, unit faculty, HoD) and the status of each link.
Log entries and verifications. The training-log entries you record and the faculty reviews/verifications of them.

Who sees your log data. Faculty you have added to your roster can view and verify the roster and log entries of residents linked to them. This sharing is the purpose of the product — only add faculty you intend to share with. We do not otherwise share your log data.

Patient data. The eLogbook is for de-identified academic records. Do not enter patient-identifiable information; you are responsible for keeping entries confidential and compliant with applicable law.

Retention & export. Because a logbook is an academic record, we retain it for the life of your account and a reasonable period afterward. You can request an export of your own entries at any time, and request deletion subject to any records we're legally required to keep.