Privacy Policy

Sara Kinetic Sports Lab (“SKSL”, “we”, “us”) operates the recovery facility and this online booking platform. This policy explains what personal data we collect, why, who processes it on our behalf, how long we keep it, and the choices you have. It is written to comply with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Information we collect

• Account details — your full name, email address and mobile number, plus a one-way hash of your password (we never store the password itself). We also record when you accepted these terms.
• Booking details — the service, date, time slot, price and GST amounts for every reservation, the booking reference, and the resulting tax invoice.
• Payment references — the Razorpay order ID, payment ID and payment status. We never receive or store card numbers, UPI PINs, CVVs or bank credentials.
• Health declaration — your confirmation, made when booking, that you have read the safety guidance and have no listed contraindication. We do not collect medical records.
• Technical data — your IP address and the time of login and booking attempts, used only for security (rate limiting and abuse prevention) and standard web-server logs.
• Email delivery records — the recipient, type, subject and outcome (sent/failed) of the operational emails we send you. Email bodies are not stored.

2. How we use it

Your data is used strictly to:

• create and secure your account and let you sign in;
• reserve, confirm, reschedule or cancel your recovery sessions and manage facility capacity;
• take payment and issue the GST tax invoice the law requires us to keep;
• send essential service emails — booking confirmations with your invoice, password-reset links, and notices about your account. We do not send marketing email;
• verify your identity at reception and keep athletes safe in thermal and hydrotherapy modalities;
• detect and block abuse (repeated failed logins, automated booking attempts).

3. Who processes your data for us

We share data only with the service providers needed to run the platform, each acting on our instructions:

• Razorpay Software Pvt. Ltd. (payments). When you pay, we pass your name, email address, mobile number, the booking reference and the amount to Razorpay so the checkout can be prefilled and the payment matched to your booking. Card and bank data is entered directly into Razorpay’s PCI-DSS certified checkout and never touches our servers. Razorpay’s own privacy policy applies to that processing.
• Our email provider (SMTP). Transactional emails are relayed through the email service configured by SKSL; it receives your email address, name and the message content in order to deliver it.
• Our hosting provider. The website, database and invoice files are stored on servers operated for SKSL. Access is restricted to authorised SKSL staff.

We do not sell personal data and we do not use advertising networks, analytics trackers or social-media pixels on this site. Typefaces are served from our own domain, so ordinary page views make no requests to third parties; only the payment step contacts Razorpay.

4. Cookies

We set one cookie: the PHPSESSID session cookie that keeps you signed in and protects forms against cross-site request forgery. It is HttpOnly (not readable by scripts) and SameSite=Strict (not sent on cross-site requests). On the live site, which is served over HTTPS, it is also marked Secure. It expires when you close your browser or sign out. There are no third-party, advertising or tracking cookies.

5. Security

Passwords are stored as bcrypt hashes. Admin access uses one-time email codes. All traffic to the live site is encrypted with TLS. Sessions opened before a password change are invalidated automatically. Uploads, logs and invoices are kept outside the public web root. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the Data Protection Board as the law requires.

6. How long we keep data

• Bookings, payments and tax invoices — retained for the period required by the GST and Income-tax laws (currently up to 8 years from the end of the financial year), even after an account is closed.
• Account details — kept while your account is active and for up to 12 months after your last booking, unless you ask us to delete them sooner.
• Security logs (login attempts, rate limits, email delivery records) — deleted or anonymised within 90 days.
• Password-reset tokens and payment holds — expire within an hour and are purged automatically.

7. Your rights and choices

You can view and correct your name and mobile number and change your password at any time from My Profile. You may also ask us to:

• provide a copy of the personal data we hold about you;
• correct inaccurate data;
• delete your account and personal data (we will keep only the invoice and payment records the tax laws require, and remove your account within 30 days of the request);
• raise a grievance about how your data has been handled.

Send requests from the email address on your account to the contact below. We respond within 30 days. If you are not satisfied with our response you may complain to the Data Protection Board of India.

8. Children

Our services involve intense thermal exposure and are intended for adults. Accounts may only be created by persons aged 18 or over; a parent or guardian must book and accompany younger athletes in person.

9. Changes to this policy

We will post any changes on this page and update the date at the top. Material changes will also be announced in the booking portal.

10. Contact & grievance officer

Sara Kinetic Sports Lab, #6, 11th Main, 3rd Cross, Opp. Surya Signature Apartment, Tata Nagar, Kodigehalli, Bengaluru, Karnataka 560092. Email: info@sarakineticsportslab.com. Phone: +919620431690. You can also reach us through our contact page.