Privacy Policy NuruMassage Pro · Hyderabad

1. Information We Collect

We collect only the information necessary to provide our spa services, process bookings and comply with legal obligations. The categories of information we collect include: (a) contact information you provide when booking a session, such as your name, phone number, email address and preferred branch; (b) therapy preferences you share with us, such as preferred therapy, duration, therapist gender and special requests; (c) medical information relevant to your session, such as injuries, allergies or conditions the therapist should be aware of; (d) payment information processed through our payment gateway (we do not store card numbers or UPI credentials on our servers); (e) website usage information collected automatically through cookies and analytics, such as IP address, browser type, pages visited and time spent on site.

1.1 Booking Information

When you book a session via phone, WhatsApp, Telegram, Signal or our website form, we collect your name, phone number, preferred branch, preferred therapy, preferred date and time, and any special requests you share. This information is used solely to confirm your booking, assign the appropriate therapist, prepare your therapy suite and contact you in case of any changes to your booking.

1.2 Session Information

During your session, our therapists may note observations relevant to your therapy — areas of tension, pressure preferences, ambient preferences — for the purpose of providing you with consistent service across future sessions. These notes are stored in your guest profile, accessible only to the therapists and front desk staff at your preferred branch, and are deleted after 90 days unless you opt into our loyalty programme.

1.3 Payment Information

Payments are processed through PCI-DSS compliant payment gateways. We do not store your card number, CVV or UPI PIN on our servers. We retain only a record of the transaction amount, date, payment method and transaction reference number for accounting and tax compliance purposes.

1.4 Website Analytics

Our website uses privacy-respecting analytics to understand aggregate usage patterns — pages visited, time on site, exit pages. We do not use cross-site tracking cookies. We do not sell or share website analytics data with any third party.

2. How We Use Your Information

We use your information for the following specific purposes: (a) to confirm and process your booking; (b) to assign the appropriate therapist and prepare your therapy suite; (c) to contact you about your booking, including confirmation, reminders and any changes; (d) to maintain your guest profile for consistent service across future sessions; (e) to process payments and issue receipts; (f) to respond to your enquiries and feedback; (g) to comply with legal, tax and regulatory obligations; (h) with your explicit opt-in consent, to send you occasional promotional messages about seasonal offers and new services.

We do not use your information for any purpose not listed above without your explicit consent. We do not sell, rent, trade or share your personal information with any third party for marketing purposes. We do not use your personal information to train automated decision-making systems or AI models.

3. How We Store and Protect Your Information

Your personal information is stored on secure servers located in India, with access restricted to authorised personnel only. Booking and guest profile data is stored in an encrypted database with role-based access control — only the therapists and front desk staff at your preferred branch can access your profile, and only for the purpose of providing your service. Payment data is processed by PCI-DSS compliant payment gateways and is not stored on our servers.

We retain guest profile data for 90 days from your last session, after which it is automatically deleted unless you opt into our loyalty programme. Loyalty programme members' data is retained for the duration of their membership plus 12 months. Payment records are retained for 7 years as required by Indian tax law. Website analytics data is aggregated and anonymised within 30 days of collection.

We implement industry-standard technical and organisational measures to protect your information, including TLS encryption for data in transit, AES-256 encryption for data at rest, multi-factor authentication for staff access, regular security audits and staff training on data protection. In the unlikely event of a data breach, we will notify affected guests and the relevant authorities within 72 hours, in compliance with applicable law.

4. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data: (a) the right to access your personal data held by us; (b) the right to request correction of inaccurate personal data; (c) the right to request erasure of your personal data, subject to legal retention requirements; (d) the right to withdraw consent for processing at any time; (e) the right to data portability; (f) the right to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, please contact us at pro@nurumassage.pro or call us at our front desk. We will respond to your request within 30 days. Please note that certain data may be exempt from erasure if it is required to be retained under applicable law (such as tax records).

Email: pro@nurumassage.pro
Phone: our front desk
Hours: 10 AM to 2 AM daily
Address: NuruMassage Pro, Hyderabad, Telangana, India