Privacy Policy

Ayurveda Within is an Ayurvedic wellness coaching practice run as a sole proprietorship in Cape Town, South Africa. In terms of the Protection of Personal Information Act 4 of 2013 ("POPIA"), Ayurveda Within is the responsible party for the personal information described in this policy.

I am an Ayurvedic wellness coach and consultant, not a registered medical or Ayurvedic practitioner. Ayurveda is complementary to and supportive of Western medicine and does not replace medical diagnosis, treatment or prescribing.

This policy applies to everyone who visits the website, sends an enquiry, books a session, or works with me as a client. It explains what information I collect, why, who has access to it, how long I keep it, and what rights you have over it.

I collect only what I need in order to work with you well. I do not buy, sell or trade personal information, and I do not collect information from third-party sources.

Card details. Card payments are taken in person through Yoco or a Capitec card machine. I never see, record or store your card number, PIN or CVV.

Much of what you share with me is information about your physical and mental health. POPIA classifies this as special personal information, and processing it is prohibited unless a specific exception in the Act applies.

Section 32 of POPIA permits medical professionals and healthcare institutions to process health information where it is necessary for proper treatment. I work as a wellness coach rather than a registered practitioner, so I do not rely on that exception.

Instead, I rely on your express consent, which you give in writing on the Introductory Form before your first session. This means:

• Your consent is voluntary, specific and informed — you are told what is collected and why before you give it.
• You may withdraw your consent at any time by writing to hello@ayurvedawithin.co.za.
• If you withdraw consent I may no longer be able to offer you coaching, because I cannot work responsibly without this information.
• Withdrawing consent does not undo processing that has already lawfully taken place, and does not affect records I am required by law to keep.

Information about children

The Introductory Form asks about your children and their ages, as family context that shapes your daily rhythms. This information is recorded only as part of your own file, is processed on the basis of your consent as their parent or guardian, and is never used for any other purpose. I do not knowingly collect personal information directly from anyone under 18.

1. To prepare for, deliver and follow up on your sessions.
2. To produce your personalised written summary and any practice sheets or recommendations.
3. To schedule bookings, send confirmations and reminders, and manage rescheduling.
4. To issue invoices and receipts and keep the financial records required by tax law.
5. To communicate with you about your sessions and answer your questions.
6. To comply with legal obligations and, if it ever became necessary, to establish or defend a legal claim.

I do not use your information to make automated decisions about you, and I do not profile you for advertising.

Your information is not shared with any third party without your express consent. There is no circumstance in which I would discuss your file with another person, including a family member, without your written permission — other than where the law compels disclosure, or where there is a serious and imminent risk to your life or someone else's.

Some service providers process information on my behalf as operators in terms of POPIA. They act only on my instruction and are bound to keep the information confidential and secure:

Some of the providers listed above store information on servers outside South Africa. Section 72 of POPIA permits transfers of this kind where the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection, or where you consent to the transfer.

Before appointing a provider I check that its terms commit it to data protection standards comparable to POPIA. By providing your information to Ayurveda Within, you consent to it being stored and processed in this way.

• All electronic records are held in password-protected accounts with two-factor authentication enabled.
• Devices used for business are password-protected and encrypted.
• Any paper forms are digitised promptly, stored securely in the meantime, and then destroyed.
• Client files are never stored on shared or public devices, and are not accessible to anyone else in my household.
• I review access and passwords periodically, and remove information that is no longer needed.

If something goes wrong. If there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, I will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires. The notification will tell you what happened and what you can do to protect yourself.

You may ask me to delete your file sooner, and I will do so unless the law requires me to keep it.

POPIA gives you the following rights over your personal information. To exercise any of them, write to hello@ayurvedawithin.co.za and I will respond as quickly as I reasonably can.

• To be told what I hold. You may ask whether I hold personal information about you and ask for a copy. Formal requests of this kind are dealt with under the Promotion of Access to Information Act — see my PAIA Manual for the procedure.
• To have it corrected or deleted. You may ask me to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• To object. You may object, on reasonable grounds, to my processing your information.
• To withdraw consent. You may withdraw consent at any time, as described in section 4 above.
• To complain. You may complain to me directly, or to the Information Regulator.

Exercising these rights is free. There is no charge for correcting or deleting information, or for withdrawing consent.

The website uses only the cookies necessary for it to function properly and to keep it secure. These are set by Cloudflare, which hosts the site, and are used to protect it against malicious traffic. It does not use advertising or tracking cookies, it does not run analytics, and it does not sell data to advertisers. You can block or delete cookies through your browser settings, though parts of the site may then not work as intended.

If you believe your personal information has not been handled lawfully, please raise it with me first so I have the chance to put it right. If you are not satisfied, you may lodge a complaint with the Information Regulator:

I will update this policy whenever my practice changes in a way that affects your information. The current version always sits on the website, with the date it was last revised at the top. If a change is significant, I will tell clients directly rather than relying on you to notice.