Privacy

This Privacy Policy was last revised on 2 September 2026. It explains what personal data the SOMA Academy website collects, why, who sees it, how long it is kept, and what you can ask us to do about it.

1. Who is responsible for your data

SOMA Academy is a brand of SOMAFUSION WELLNESS LLP, registered office A-507, Kohinoor Square, Plot No. 46, N. C. Kelkar Marg, opposite Shiv Sena Bhavan, Shivaji Park, Dadar West, Mumbai 400028, Maharashtra, India. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here; for the purposes of the EU and UK General Data Protection Regulation, where they apply, we are the controller. "We", "us" and "our" mean SOMAFUSION WELLNESS LLP.

This policy covers academy.somalongevitysciences.com, the accounts and purchases made on it, The Thread newsletter, and email you exchange with the Academy. It does not cover the clinic's own website or any clinical care, which have their own policies.

2. What we collect, and when

When you create an account. Your name, email address, a username, and a password, which is stored only in hashed form. Anything you choose to add to your profile, such as a profession, organisation, photograph or biography.

When you enrol or pay. Your billing name, email address, telephone number, postal address, city, state, country and postcode; a GSTIN if you choose to give one for a business invoice; the Course bought, the price, the taxes charged, the date, and the order and invoice numbers. Payment itself is taken by Razorpay on its own systems. Your card number, CVV, UPI credentials and bank login are entered there, never on our servers, and we never see or store them. Razorpay returns to us only a payment reference, the amount, the status, the payment method type and, where Razorpay provides them, the last four digits of a card.

While you learn. Which Courses you are enrolled in, which lessons you have opened and completed, your quiz and assessment attempts, answers, scores and pass or fail results, your completion dates, certificates issued and their verification codes, where you paused audio narration, playback preferences, and the marks of progress and recognition the Academy displays to you. A certificate is only meaningful if it is backed by this record, so we keep it.

When you review or comment. The text you write, the rating you give, the Course it relates to and the date. Reviews are published on the Site with your display name, or your first name and last initial.

When you subscribe to The Thread. Your email address and, if you give it, your name, together with the date and source of your subscription and a record of your confirmation.

When you write to us. Whatever you include in the message, and our reply, so that we can help you and keep a record of it.

When you verify a certificate. The verification page shows the name of the certificate holder, the Course and the completion date to anyone holding the verification link. That is the purpose of a verifiable certificate; do not share a link you do not want checked.

Automatically. Your IP address, approximate location derived from it, browser and device type, operating system, language, the pages you request, the time you request them, the page you came from, and cookies and similar identifiers described in section 7. Our video and audio players also record how far through a lesson you are.

We do not ask for, and ask you not to send us, sensitive personal data such as your own health conditions, and we do not collect government identity numbers, biometric data or financial account numbers.

3. Why we use it, and the legal basis

To provide what you have signed up for. Creating and running your account, opening the Courses you enrol in, tracking progress so that lessons unlock and certificates can be issued and verified, sending receipts, invoices, enrolment confirmations and other transactional messages, and answering your questions. Basis: performance of our contract with you; under the DPDP Act, your consent given when you register and enrol.

To take payment and keep the books. Processing payment through Razorpay, raising a tax invoice, and keeping the accounting and GST records the law requires. Basis: performance of the contract and compliance with our legal obligations under Indian tax and company law.

To send The Thread. Only to people who subscribed and confirmed. Basis: your consent, which you can withdraw at any time using the unsubscribe link in any issue.

To keep the Site working and safe. Server logs, security monitoring, fraud prevention, preventing account sharing and unauthorised copying of Material, backups, and defending or bringing legal claims. Basis: our legitimate interests in operating a secure service and protecting our rights; under the DPDP Act, the legitimate uses the Act permits.

To understand how the Site is used. Aggregated analytics, described in section 7, so that we can see which pages are read and where the Site can be improved. Basis: your consent, given through your browser and cookie settings, and our legitimate interest in improving the Site.

To publish reviews. With your display name, on the Course they relate to and in our marketing. Basis: your consent, given when you post the review.

We do not sell personal data, we do not share it with anyone for their own advertising, we do not run advertising on the Site, and we do not make decisions about you by automated means that have legal or similarly significant effects.

4. Who sees your data

We share personal data only with the providers we need to run the Academy, each of which sees only what its task requires and is bound by contract to use it for that task alone:

• Razorpay Software Private Limited (India): payment processing, refunds where due, and fraud checks. Razorpay is an independent controller of the payment data you enter on its pages, under its own privacy policy.
• Zoho Corporation Private Limited (India data centre): invoicing and accounting records through Zoho Books, and delivery of The Thread through Zoho Campaigns, which also manages your subscription confirmation and unsubscribe.
• Our hosting provider: the servers, databases, backups and logs on which the Site runs.
• Our video and audio streaming provider: serves lesson video and narration and, in doing so, receives your IP address and player events.
• Our email delivery provider: sends transactional email from the Site on our behalf.
• Google: Google Analytics for the aggregated usage statistics in section 7, and Google Fonts, which serves the Site's typefaces and receives your IP address when a page loads. YouTube, a Google service, serves any embedded podcast episode and sets its own cookies when you play one.
• Professional advisers: our accountants, auditors, lawyers and insurers, where they need it to advise us.

We will also disclose personal data where the law requires it, in response to a lawful request from a court, regulator, tax authority or law-enforcement agency, to enforce our Terms and Conditions, to protect the rights, property or safety of the Academy, our users or others, or, in the event that the business or a part of it is sold, merged or reorganised, to the successor, who will be bound by this policy.

5. Where your data goes

We are based in India and our core records are kept with providers that process in India. Some providers, including our hosting, streaming and email providers and Google, may process data on servers in other countries. Where that happens we rely on the provider's contractual commitments to protect your data to a standard consistent with this policy and, where the GDPR applies to you, on European Commission or UK-approved transfer mechanisms such as standard contractual clauses, or on an adequacy decision. You can ask us for more detail on the safeguards used.

6. How long we keep it

Account, enrolment and learning records: for as long as your account exists, and afterwards for as long as we need them to verify a certificate we issued, to resolve a dispute, or to comply with the law.

Order, invoice and payment records: for at least eight years after the end of the financial year in which the purchase was made, as Indian tax law requires, even if you delete your account.

Certificate records: indefinitely, so that a certificate can be verified for as long as its holder relies on it, unless you ask us to delete your account, in which case the record behind your certificate is removed and the certificate can no longer be verified.

Newsletter subscription: until you unsubscribe, after which your address is kept only on a suppression list so that we do not email you again.

Correspondence: for as long as it may be needed to deal with the matter and any follow-up, usually no more than three years.

Server logs and security records: for a short period, usually no more than ninety days, unless they are needed to investigate an incident.

Analytics data: retained by Google Analytics for the period set in our configuration, currently fourteen months, in aggregated form.

When data is no longer needed for any of these purposes it is deleted or made anonymous.

7. Cookies and analytics

A cookie is a small file the Site places in your browser. We use three kinds.

Essential cookies keep you signed in, protect forms against forgery, remember what is in your cart, and let the Site work. They cannot be switched off without breaking the Site.

Functional cookies and local storage remember your place in a Course, where you paused narration, your playback speed and similar preferences, so that the Site behaves the same way the next time you visit.

Analytics. The Site uses Google Analytics 4 to produce aggregated statistics about which pages are visited and how visitors move through the Site. Google Analytics is not loaded for signed-in users. Google's IP-address handling means full IP addresses are not stored in analytics reports. You can prevent analytics by blocking third-party cookies in your browser, by installing Google's Analytics opt-out browser add-on, or by using any consent control the Site offers. Where the law of your country requires consent before analytics cookies are set, they will not be set until you give it.

Embedded YouTube players set Google's own cookies when a video is played; they are governed by Google's privacy policy. We do not use advertising, retargeting or cross-site tracking cookies of any kind.

8. Your rights

Depending on where you live, you have some or all of the following rights, and you can exercise every one of them by writing to us as described in section 12.

Under the Digital Personal Data Protection Act, 2023, if you are in India: to obtain a summary of the personal data we hold about you, the processing we carry out, and the other Data Fiduciaries and Data Processors with whom it has been shared; to have inaccurate or incomplete data corrected, updated or completed; to have your personal data erased where we no longer need it for the purpose it was collected or for a legal obligation; to withdraw any consent you have given, as easily as you gave it; to a grievance-redressal process, described in section 12; and to nominate another person who may exercise these rights on your behalf if you die or become incapacitated. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Under the GDPR or UK GDPR, if you are in the European Economic Area, Switzerland or the United Kingdom: to access your data and receive a copy; to have it rectified; to have it erased; to restrict or object to our processing; to receive the data you gave us in a portable format; to withdraw consent at any time without affecting earlier processing; not to be subject to solely automated decisions with legal effect; and to lodge a complaint with your national supervisory authority.

Elsewhere, you have whatever rights your local law provides, and we will honour any of the rights listed above that you ask us to.

To protect you, we may ask you to confirm your identity before acting on a request, usually by writing from the email address on your account. We respond within thirty days, or sooner where the law requires. There is no charge for a reasonable request. Some data cannot be deleted while the law obliges us to keep it, such as tax invoices, and deleting your account means any certificate we issued to you can no longer be verified; we will tell you if that applies before we act.

9. How we protect it

The Site is served over HTTPS. Passwords are stored hashed, never in plain text. Access to personal data inside the Academy is limited to the people who need it for their work, under confidentiality obligations. Our providers are chosen for their security practices and bound by contract. Backups are kept and access to them is restricted. No system is perfectly secure, and you are responsible for keeping your password private and for the security of the devices you use.

If a breach of personal data occurs that is likely to affect you, we will notify you and the Data Protection Board of India, or any other authority the law requires, in the manner and within the time the law prescribes.

10. Children

The Academy is for adults. It is not intended for, and we do not knowingly collect personal data from, anyone under 18 years of age. Under the DPDP Act, processing a child's data requires verifiable parental consent, which the Site is not designed to obtain. If you believe a person under 18 has given us personal data, tell us and we will delete it and close the account.

11. Links to other sites

The Site links to other websites, including SOMA Longevity Sciences, publishers of research we cite, and the services named above. Their privacy practices are their own, and this policy does not apply to them.

12. Grievance Officer and contact

Questions about this policy, requests to exercise any right in section 8, and any complaint about how your personal data has been handled go to our Grievance Officer, who is also our point of contact for data-protection matters:

Grievance Officer, SOMAFUSION WELLNESS LLP
A-507, Kohinoor Square, Plot No. 46, N. C. Kelkar Marg, opposite Shiv Sena Bhavan, Shivaji Park, Dadar West, Mumbai 400028, India
Email: academy@somalongevitysciences.com

We acknowledge every grievance within two working days and aim to resolve it within thirty days of receipt. If you are in India and are not satisfied with our resolution, you may approach the Data Protection Board of India. If you are in the EEA or UK, you may approach your supervisory authority.

13. Changes to this policy

We may revise this policy from time to time. The revised version is published on this page with a new "last revised" date, and where a change materially affects how we use data you have already given us, we will email the address on your account. Continued use of the Site after a change is acceptance of it.