Privacy Policy

Learn how WARA handles personal information across its care-related services, education and skills initiatives, websites, and commercial marketplace activities, including data use, sharing, security, and individual rights.

This policy explains how WARA handles personal information when people interact with its websites, services, care-related activities, learning initiatives, and commercial systems. It describes the types of information that may be collected, why it may be used, when it may be shared, and the safeguards and choices that may apply.

The specific information and practices depend on the service or activity involved. This policy should be read alongside any service-specific terms or notices that apply.

1. Scope of this policy

WARA’s activities may involve care coordination, education and skills development, digital systems, and commercial marketplace services. These activities can involve different organisations, systems, and responsibilities.

This policy describes general privacy principles for information handled in connection with those activities. The applicable organisation and practices depend on the service you use and the arrangements governing it.

Wara KarmaYoga Foundation Trust has a social and educational role. Wara Systems has a commercial role, including marketplace-related activities. They should not be assumed to be the same legal entity or to handle information under identical arrangements.

Where a service is operated by another organisation, or information is collected directly by a third-party provider, that organisation’s applicable privacy terms may also apply.

2. Definitions

For this policy:

  • WARA, we, us, or our refers to the relevant WARA organisation responsible for the website, service, or activity in question.
  • You or user refers to an individual interacting with a relevant website, service, programme, or system.
  • Personal information means information that identifies an individual or can reasonably be associated with an identifiable individual.
  • Health and care information means information about a person’s health, care requirements, care activities, or related records.
  • Usage and technical information means information generated or collected through the use of a website, application, or digital system.
  • Cookies are small files or similar technologies that may be used by websites to maintain sessions, remember preferences, or support other functions.

3. Information we may collect

The information collected depends on the service you use, the purpose of the interaction, and the information required to carry it out. Not every category listed below applies to every service.

Personal and contact information

Depending on the activity, this may include:

  • Name and contact details, such as telephone number and email address.
  • Address or location information where relevant.
  • Emergency contact details where required for a care-related arrangement.
  • Information you provide when making an enquiry, submitting a form, registering for a programme, or communicating with us.

Health and care information

Where a care-related service requires it, information may include:

  • Relevant medical history or health conditions.
  • Care needs, preferences, routines, and support requirements.
  • Medication-related information or monitoring records, where applicable.
  • Care activity records, observations, and service logs, including Care Ledger entries if that feature is used.

Health and care information can be particularly sensitive. It should be collected and accessed only for appropriate purposes and under the arrangements applicable to the service.

Where relevant to an educational or training activity, information may include:

  • Learner and participant details.
  • Enrolment, attendance, and participation records.
  • Learning progress, assessments, demonstrated competencies, and completion records.
  • Information needed to administer a programme or communicate with a learner or authorised representative.

The information required will depend on the programme and its delivery arrangements.

Where a commercial marketplace or service transaction is involved, information may include:

  • Customer enquiries and service requirements.
  • Provider or business details submitted for a relevant purpose.
  • Information about service requests, transactions, communications, and work records.
  • Information needed to administer payments, resolve disputes, or maintain transaction records, where applicable.

Usage and technical information

When you use a relevant website or digital system, technical information may include:

  • IP address.
  • Browser, device, and operating-system information.
  • Pages accessed and interactions with the service.
  • Technical logs and diagnostic information needed to operate, protect, or troubleshoot the system.

The actual information collected depends on the technologies and functions enabled in the relevant service.

4. How we use information

We use information for purposes connected with the relevant service or activity. Depending on the context, these purposes may include:

  • Responding to enquiries and communicating with users.
  • Providing or coordinating an agreed service.
  • Administering education, training, or skills-development activities.
  • Maintaining relevant learner, care, service, or transaction records.
  • Connecting authorised participants or service providers where the arrangement requires it.
  • Sending service-related updates, notifications, or alerts.
  • Operating, maintaining, troubleshooting, and improving digital systems.
  • Protecting services against misuse, unauthorised access, or other security risks.
  • Meeting applicable legal obligations and handling disputes or complaints.

Information should not be used for unrelated purposes without an appropriate basis. Where consent or another specific legal basis is required, the relevant process should be followed.

5. Cookies and similar technologies

A website or digital service may use cookies or similar technologies to support functions such as:

  • Maintaining sessions and remembering preferences.
  • Supporting security and essential website functions.
  • Understanding usage and diagnosing performance issues.
  • Improving the usability of the service.

The technologies actually used depend on the website or system. Where consent is required for a particular cookie or tracking technology, the applicable consent process should be provided.

You can manage cookies through your browser settings. Blocking certain cookies may affect some website functions.

6. Sharing and disclosure

We do not sell personal information as a commercial data product.

Information may be shared where necessary and appropriate for the relevant purpose, subject to applicable requirements. Depending on the service, recipients may include:

  • Authorised care personnel or coordinators involved in an agreed care arrangement.
  • Healthcare professionals or providers where sharing is appropriate and authorised.
  • Emergency responders where disclosure is necessary in an emergency and permitted by applicable law.
  • Instructors, programme administrators, or authorised educational personnel involved in a learning activity.
  • Customers, service providers, or other participants where information is needed to administer a relevant marketplace interaction.
  • Technology, hosting, communications, or other service providers supporting the relevant system.
  • Regulators, public authorities, courts, or other parties where disclosure is required or otherwise permitted by law.

We aim to limit sharing to information relevant to the stated purpose. Access should be restricted according to the recipient’s role and the requirements of the relevant service.

Where consent is required for sharing, it should be obtained through the applicable process. Consent is not assumed to be the appropriate basis for every type of processing or disclosure.

7. Data protection and security

Appropriate safeguards should be used to protect information against unauthorised access, disclosure, alteration, loss, or misuse.

Depending on the system and its implementation, safeguards may include:

  • Access controls and role-based permissions.
  • Secure transmission and storage where supported.
  • Authentication and account-protection measures.
  • System logs, monitoring, and audit records where implemented.
  • Procedures for managing incidents and responding to security concerns.

The controls in place may differ across systems and services. No website, network, storage system, or digital transmission method can be guaranteed to be completely secure.

If a security incident affects personal information, the response and any required notifications will be handled in accordance with the applicable arrangements and legal requirements.

8. Data retention

Information should be retained only for as long as necessary for the relevant purpose, subject to applicable legal, regulatory, contractual, and operational requirements.

Retention periods may differ by information type. For example:

  • Enquiry records may be retained to respond to requests and maintain relevant correspondence.
  • Care-related records may be needed for continuity, accountability, or applicable recordkeeping requirements.
  • Learner and assessment records may be needed to administer a programme and document learning outcomes.
  • Marketplace and transaction records may be needed to administer transactions, address disputes, or meet financial and legal obligations.
  • Technical and security logs may be retained for operational or security purposes.

Some records may need to be retained after a service ends. Where deletion or anonymisation is appropriate and legally permitted, information should be handled accordingly.

Specific retention periods should be established and communicated where required for the relevant service.

9. Data processing and transfers

Information may be processed using systems and service providers located in India or, where applicable, in other jurisdictions.

Where information is handled by an external technology or service provider, the relevant arrangements should address appropriate access, confidentiality, security, and permitted use.

Any transfer or processing outside India must comply with applicable legal requirements. The location of processing, the relevant service providers, and any transfer safeguards depend on the systems and arrangements actually used.

Use of a service does not, by itself, establish blanket consent to every possible transfer or processing activity.

10. Children’s privacy

Where a service involves children, their personal information should be handled with appropriate care and in accordance with applicable legal requirements.

Depending on the activity, appropriate parent or guardian involvement, consent, safeguards, and access restrictions may be required.

Information about a child should be collected and used only for an appropriate purpose connected with the relevant service or programme. The applicable age thresholds, consent process, and responsibilities should be established for each service rather than assumed to be identical across all activities.

11. Your privacy rights and requests

Depending on the applicable law, the relevant service, and the circumstances, you may have rights or options concerning your personal information. These may include requesting access to information, correction of inaccurate information, deletion where permitted, withdrawal of consent where consent is the basis for processing, or information about how your data is handled.

To make a privacy-related request, contact WARA and identify the service or organisation concerned. We may need to verify your identity or authority to act on another person’s behalf before responding.

Some records may need to be retained or certain requests may be limited where applicable law or legitimate recordkeeping requirements require it. Any such limitation should be considered in the context of the specific request.

12. External websites and third-party services

Our websites or services may link to external websites or services operated by other organisations.

Those organisations may have their own privacy policies and data-handling practices. Unless explicitly stated otherwise, WARA does not control their independent systems or policies.

Review the relevant third party’s privacy information before submitting personal information through its website or service.

13. Changes to this policy

This policy may be revised when services, systems, organisational responsibilities, or applicable requirements change.

The published version should show its effective or last-updated date. Where a change requires notice or renewed consent, the applicable process should be followed.

You should review the current version when using a service or when a material change is communicated.

14. Contact and privacy enquiries

For questions, concerns, or requests relating to personal information, contact WARA and identify the service or activity involved.

Email: support@wara.in

Please avoid including unnecessary medical details, identity documents, passwords, or other sensitive information in an initial email. If further information is needed to verify or resolve your request, an appropriate process should be provided.

15. Guiding principle

Information should be handled responsibly, used for appropriate purposes, and protected in ways that respect the people it concerns.

For care, education, skills development, and commercial services alike, privacy depends on clear responsibilities, proportionate collection, appropriate access, and transparent handling of personal information.