Privacy & Data Protection Policy
This Privacy Policy outlines how Vetecura Life Sciences Private Limited collects, processes, stores, and protects personal data in strict compliance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and applicable Indian regulatory standards.
TLS 1.3 Encryption
End-to-end encrypted cryptographic transit for all store and checkout sessions
No Data Monetization
Personal data is strictly never sold, rented, or traded to third-party advertisers
Clinical Confidentiality
Pet medical records and prescriptions governed by professional veterinary ethics
DPDP Act Rights
Enforceable statutory rights to access, data summary, correction, and permanent erasure
1. Identity of Data Fiduciary & Regulatory Framework
This Privacy and Data Protection Policy governs the collection, processing, storage, and transfer of personal information by Vetecura Life Sciences Private Limited (operating under the registered trade name Furrfab, hereinafter designated as the "Data Fiduciary", "Company", "we", "us", or "our").
Corporate Entity: Vetecura Life Sciences Private Limited
Registered Trade Name: Furrfab
Registered Office: Ground Floor, Shop No. C-02, Building No. 02, Regency Plaza, Kalyan Ambarnath Road, Vithalwadi, Kalyan, Thane, Maharashtra – 421003, India
Regulatory Compliance: Digital Personal Data Protection Act, 2023; Information Technology Act, 2000; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; Consumer Protection (E-Commerce) Rules, 2020.
Official Contact: contact@furrfab.com | +91 89569 99074
This policy applies to all users, consumers, and data principals who access our e-commerce platform hosted at furrfab.com, purchase products, register customer accounts, access pet health records, or schedule veterinary tele-consultation services.
2. Categories of Personal Data Collected
In accordance with the principle of data minimization under Section 6 of the Digital Personal Data Protection Act, 2023, the Company collects only such personal data as is strictly necessary to perform e-commerce fulfillment, maintain registered customer profiles, and facilitate professional veterinary consultations:
-
•
Identity & Contact Data: Full legal name, mobile phone number, email address, physical delivery address, billing address, and postal PIN code, collected for account registration, order verification, and doorstep courier fulfillment.
-
•
Pet Health & Profile Information: Companion animal name, species (dog, cat, bird, etc.), breed, age, date of birth, body weight, activity level, known dietary allergies, clinical sensitivities, and uploaded digital veterinary prescriptions (Rx) or vaccination documentation.
-
•
Transaction & Billing Information: Line items purchased, transaction value, payment mode selection, invoice details, and tokenized payment confirmations issued by licensed payment aggregators. The Company does not store, process, or retain raw credit card numbers, debit card PINs, CVVs, or NetBanking credentials on its internal servers.
-
•
Tele-Veterinary Consultation Data: Health symptoms described during appointment booking, triage questionnaires, consultation transcripts, and post-consultation clinical care summaries generated by licensed veterinary practitioners.
-
•
Technical, Device & Log Data: Internet Protocol (IP) address, device identifiers, browser type and version, time zone setting, operating system, and telemetry logs collected automatically for fraud detection, cybersecurity monitoring, and site performance optimization.
3. Lawful Grounds and Specific Purposes of Processing
The Company processes personal data under statutory lawful bases, including the execution of a commercial contract, explicit consent of the Data Principal, and compliance with statutory legal obligations under Indian law:
Generating commercial tax invoices, printing shipping labels, dispatching orders, transmitting real-time tracking updates via SMS/WhatsApp, and processing return or refund requests.
Facilitating clinical evaluation by registered veterinary medical practitioners, maintaining case notes, and transmitting digital prescriptions under applicable veterinary telemedicine standards.
Executing one-time password (OTP) identity verifications, authenticating customer account sessions, and preventing fraudulent transactions or Return to Origin (RTO) commercial losses.
Generating Goods and Services Tax (GST) compliant documentation, maintaining commercial accounting books, and complying with statutory inspection orders from law enforcement bodies.
4. Authorized Third-Party Data Processors
The Company engages select third-party service providers acting as Data Processors under contractual agreements that enforce strict data protection and non-disclosure obligations:
1. Shopify Inc. (E-Commerce Infrastructure)
Platform hosting, database management, and order checkout architecture are provided by Shopify Inc. Shopify complies with Level 1 PCI-DSS standards and maintains SOC 2 Type II certifications for data security and operational resilience.
2. GoKwik Commerce Technologies (Checkout & Identity Verification)
GoKwik provides expedited checkout infrastructure, automated OTP identity verification, and address validation to prevent fake COD orders. By entering your mobile number in the checkout interface, you acknowledge processing under GoKwik's verified data terms.
3. Licensed Payment Aggregators (Razorpay / Cashfree / PhonePe / GoKwik UPI)
Electronic payments are executed via RBI-authorized payment aggregators utilizing end-to-end tokenization in accordance with RBI guidelines. The Company never receives, stores, or handles raw cardholder data.
4. Logistics & Courier Service Partners (Shiprocket / Delhivery / BlueDart / DTDC / Xpressbees)
Recipient name, physical delivery address, contact phone number, and parcel metadata are securely shared with Shiprocket and assigned courier carriers strictly to execute physical shipment and delivery tracking updates.
Statutory Covenant: The Company does not sell, lease, commercialize, or trade personal data or veterinary records to third-party data brokers or marketing intermediaries under any circumstances.
5. Veterinary Tele-Consultation & Clinical Confidentiality
All companion medical records, clinical notes, and prescription documentation handled on the platform are subject to veterinary medical confidentiality standards:
-
•
Restricted Professional Access: Pet medical histories, health logs, and uploaded clinical prescriptions (Rx) are restricted and accessible solely by the account holder and the registered veterinary surgeon assigned to the patient consultation.
-
•
Veterinarian-Client-Patient Relationship (VCPR): Consulting veterinary practitioners operate in compliance with the Veterinary Council of India (VCI) Code of Professional Conduct and statutory tele-veterinary practice norms.
-
•
Database Segregation: Clinical records and pet health files are maintained in access-controlled database environments, segregated from promotional email databases.
7. Data Retention & Information Security Standards
The Company retains personal data only for such duration as is necessary to satisfy the purposes for which it was gathered, or as required under statutory legislation:
- • Customer Account Records: Retained throughout the operational lifespan of the user's registered account or until an authenticated erasure request is received.
- • Tax & Statutory Invoices: Retained for a mandatory duration of 7 (seven) years from the conclusion of the relevant financial year to satisfy the Central Goods and Services Tax Act, 2017 and the Companies Act, 2013.
- • Security Safeguards: In compliance with Section 43A of the Information Technology Act, 2000 and SPDI Rules, 2011, the Company implements technical and organizational safeguards including Transport Layer Security (TLS 1.3), salted cryptographic hashing, role-based database permissions, and continuous perimeter monitoring.
8. Statutory Rights of Data Principals under DPDP Act, 2023
Pursuant to Chapter III of the Digital Personal Data Protection Act, 2023, data principals are entitled to the following statutory rights regarding their personal data:
Obtain a clear summary of personal data being processed, details of processing activities, and identities of authorized third parties with whom data has been shared.
Request the correction of inaccurate or misleading data, the completion of incomplete records, and the updating of contact or delivery credentials.
Request the permanent erasure of personal data when retention is no longer necessary for the purpose collected, unless retention is mandated by statutory taxation or commercial laws.
Nominate an individual who, in the event of death or incapacity of the Data Principal, shall exercise statutory rights on their behalf.
To submit a statutory rights request, email our designated privacy desk at privacy@furrfab.com from your registered email address. The Company verifies identity and resolves authenticated requests within statutory timelines without charging fees.
9. Statutory Grievance Redressal Mechanism
In compliance with Section 43A of the Information Technology Act, 2000, Rule 5(9) of the Consumer Protection (E-Commerce) Rules, 2020, and Section 13 of the Digital Personal Data Protection Act, 2023, the designated Grievance Officer details are published below:
Designation: Grievance Redressal & Data Protection Officer
Corporate Entity: Vetecura Life Sciences Private Limited (Trade Name: Furrfab)
Registered Office Address: Ground Floor, Shop No. C-02, Building No. 02, Regency Plaza, Kalyan Ambarnath Road, Vithalwadi, Kalyan, Thane, Maharashtra – 421003, India
Dedicated Email Address: privacy@furrfab.com (cc: contact@furrfab.com)
Customer Helpline: +91 89569 99074 (Operational: Monday to Saturday, 10:00 AM – 6:00 PM IST)
Statutory Redressal Timeline: Grievances are formally acknowledged within 48 (forty-eight) hours of receipt and addressed within 30 (thirty) days in accordance with applicable rules.
10. Protection of Minors
The platform is intended strictly for individuals who are competent to contract under the Indian Contract Act, 1872 (at least 18 years of age). We do not knowingly solicit or collect personal data from individuals under the age of 18 without verifiable parental or guardian consent. If it comes to our notice that data has been collected from a minor without lawful authorization, we promptly purge such records from our systems.
11. Policy Modifications and Updates
The Company reserves the right to amend this Privacy Policy periodically to reflect operational changes, technological developments, or legislative updates under Indian law. Any revised version will be published on this page with an updated effective date. Continued access to the platform following notice of revisions constitutes your acknowledgment of the amended policy.
Data Protection Desk
Submit formal requests to access personal data summaries, correct registered details, or request account erasure under the DPDP Act.
Review our commercial and usage terms
Terms & Conditions →