Privacy Policy

This Privacy Policy is issued by Recon Aesthetics Pvt Ltd, operating as Recon Institute of Aesthetic Medicine & Surgery (RIAMS).

Registered contact address: A-26/1, Third Floor, DLF Phase 1, Sector 28, Near Mega Mall, Golf Course Road, Gurugram – 122002, Haryana, India.

For the personal information collected and processed in connection with its educational services, RIAMS generally acts as the data controller or data fiduciary, as applicable under the relevant law.

This Privacy Policy applies to:

• The RIAMS website at riams.co.in.
• RIAMS Communities and the online learning platform.
• Courses, fellowships, webinars, workshops and other educational programmes.
• Registration, payment, enquiry and account-management services.
• Emails, authorised messaging services, AI-assisted interactions and other communications associated with RIAMS.

For privacy-related questions, requests or grievances, please contact contact@riams.co.in with the subject line “Privacy”.

We collect personal information necessary to operate our educational services, manage registrations, provide access to learning resources and communicate with participants. Depending on how you interact with RIAMS, this may include:

a. Identity and contact information

Name, email address, telephone number, city, country and other contact information provided during registration or enquiry.

b. Professional information

Medical specialty, educational qualifications, highest degree, professional experience, medical registration details and documents submitted to establish eligibility for a programme.

c. Enquiry and communication information

Details of courses or programmes you enquire about, messages submitted through website forms, counselling-call bookings, email correspondence, authorised WhatsApp communications and conversations with our AI chat assistant.

d. Registration and payment information

Courses, Communities or other services purchased, transaction amounts, applicable taxes, payment status, instalment arrangements, invoices, transaction references and related billing information. Payments are processed through Razorpay or another authorised payment service provider. RIAMS may receive payment confirmations and relevant transaction information, but does not require access to complete payment-card credentials to administer registrations.

e. Learning and participation records

Course and Community enrolments, access periods, lecture and video progress, webinar registration and attendance, assessment attempts, learning activity, certificates and other records necessary to administer educational programmes.

f. Account and technical information

Account activity, login history, IP address, approximate location, browser and device information, pages visited, referral sources and campaign identifiers, including UTM parameters.

g. Communication preferences and consent records

Marketing preferences and records of consent provided, modified or withdrawn, including the relevant date, method and associated form or interaction.

h. Educational and clinical material

Certain educational programmes may involve clinical photographs, case discussions, surgical or procedural recordings and related teaching materials. Where such materials contain information relating to patients or other identifiable individuals, they must be collected, submitted and used only with the necessary permissions, appropriate consent and applicable confidentiality safeguards. Participants and faculty must not upload or disclose patient-identifiable information through RIAMS services unless the relevant activity expressly permits it and the required authorisations and safeguards are in place.

We aim to collect information relevant to the purposes described in this Policy and avoid unnecessary collection of personal data.

RIAMS processes personal information for the following purposes:

a. Registration and educational access

To create accounts, process registrations and payments, provide access to courses and Communities, administer learning activities, issue certificates and send essential service communications.

b. Enquiries and programme assistance

To respond to enquiries, arrange requested counselling calls, provide information about programmes and assist prospective participants with registration.

c. Eligibility verification

To confirm that applicants meet the professional qualifications, experience and other eligibility requirements of specific educational programmes.

d. Educational administration

To maintain learning records, monitor course progress, administer assessments, verify attendance and manage access to educational resources.

e. Marketing and programme updates

To send information about courses, Communities, webinars, events and related educational opportunities where the necessary consent or another applicable legal basis exists.

f. Website analytics and advertising

To understand website usage, measure campaign effectiveness and improve communications and services, subject to applicable consent and cookie requirements.

g. Platform security and service improvement

To maintain system functionality, protect accounts and educational content, investigate suspected misuse, prevent fraud and improve the quality and reliability of our services.

h. Legal and regulatory obligations

To maintain required financial, accounting, tax and compliance records, respond to lawful requests and fulfil applicable legal obligations.

Legal basis under UK and EU GDPR

Where the UK or EU GDPR applies, processing may be based on:

• Performance of a contract or steps taken at an individual’s request before entering into a contract.
• Consent, including where required for promotional communications or optional tracking technologies.
• Legitimate interests, where appropriate and balanced against the rights and interests of the individual.
• Compliance with applicable legal obligations.

Where we rely on legitimate interests, these may include maintaining platform security, preventing fraud, protecting educational content and improving our services.

Where Indian data-protection law applies, personal information is processed in accordance with the consent requirements and other permitted grounds available under the applicable provisions of Indian law.

RIAMS does not make decisions producing legal or similarly significant effects on individuals solely through automated processing.

RIAMS may communicate with individuals through email, telephone, WhatsApp or other authorised channels in connection with enquiries, registrations and educational programmes.

Service-related communications

These include payment receipts, registration confirmations, access links, schedules, programme changes, learning reminders, instalment notifications and certificate-related information. Such communications are necessary for administering requested or purchased services and are separate from optional promotional communications.

Promotional communications

These may include announcements about new courses, Communities, webinars, academic events, educational offers and newsletters. Promotional communications are sent where the necessary consent or other applicable legal permission has been obtained.

Where consent is required, it is requested through an affirmative action, such as selecting an optional, non-preselected checkbox, subscribing to a newsletter or choosing to receive programme updates.

Individuals may withdraw their marketing consent at any time through the unsubscribe link in promotional emails, available account preferences or by contacting RIAMS.

Withdrawal of marketing consent does not prevent RIAMS from sending essential communications relating to an active registration, payment, account or educational programme. We maintain records of communication preferences and consent changes to support these choices.

Most personal information is collected directly from individuals when they:

• Submit an enquiry or registration form.
• Create an account or purchase an educational programme.
• Upload professional documents or complete an assessment.
• Contact RIAMS through email, telephone, WhatsApp or the website.
• Attend webinars, participate in educational activities or use the learning platform.

Additional information may be received from authorised service providers, including:

• Payment confirmations and transaction status from Razorpay.
• Webinar registration and attendance information from Zoom.
• Scheduling information from Calendly.
• Account details provided through Google Sign-In, where selected.
• Technical and usage information generated through website interactions and authorised analytics technologies.

Information may also be received from faculty, institutional partners or programme organisers where relevant to an individual’s participation and where the disclosure is authorised.

RIAMS does not sell personal information. We share information with service providers and other recipients where necessary to operate our services, fulfil contractual requirements, comply with applicable law or carry out activities authorised by the individual.

The service providers used by RIAMS include:

a. Payments

Razorpay, for payment processing, transaction confirmation and related payment services.

b. Email delivery

Brevo and our SMTP email service provider, for transactional emails, educational communications and authorised marketing messages.

c. Hosting, storage and databases

Amazon Web Services (AWS), including file storage in the European Union where applicable, Vercel and MongoDB Atlas.

d. Video delivery and live teaching

Zoom, Vimeo, Cloudflare Stream and YouTube, for webinars, educational videos and associated delivery functions.

e. Scheduling

Calendly, where individuals choose to book counselling or other scheduled calls.

f. AI-assisted interactions

OpenAI, which processes information submitted through the RIAMS AI chat assistant to generate responses and assist with enquiries. Information entered into the AI assistant is transmitted and processed in accordance with the applicable service configuration, contractual arrangements and data-handling settings. Users should avoid entering unnecessary sensitive personal information, confidential patient details or identifiable clinical records into the AI assistant. Conversation records may be retained by RIAMS for service administration, support and security in accordance with the retention practices described in this Policy.

g. Account authentication

Google, where an individual chooses to use Google Sign-In.

h. Location and currency services

IP-based location services, including ipapi.co and BigDataCloud, to assist with displaying relevant currency information and pre-filling approximate city details.

i. Advertising and analytics

Meta, including Facebook and Instagram advertising technologies, where the necessary marketing-cookie consent has been provided.

j. Legal and regulatory disclosures

Relevant authorities, courts, professional advisers and other recipients where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.

Service providers may act as processors on behalf of RIAMS or as independent controllers for certain activities, depending on the nature of the service. We use applicable contractual, technical and organisational safeguards when personal information is shared with third parties.

RIAMS is based in India and uses service providers that may store or process personal information in several countries, including India, countries within the European Union and the United States.

As a result, information provided by individuals in the United Kingdom or European Economic Area may be processed outside their country or region.

Where applicable data-protection law requires safeguards for international transfers, RIAMS uses the relevant transfer mechanisms and contractual protections.

These may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or other legally recognised transfer mechanisms, as applicable to the particular transfer.

Additional technical and organisational measures are used where required to protect personal information. Individuals may contact contact@riams.co.in to request further information about the safeguards relevant to their personal information.

Individuals may have rights concerning their personal information, depending on their location and the data-protection laws applicable to the processing. These may include the right to:

a. Access personal information

Request information about the personal data RIAMS holds or processes and obtain a copy where applicable. Where available, account information may also be downloaded through the “Download My Data” feature in the learner profile.

b. Correct inaccurate information

Request correction or updating of personal information that is inaccurate, incomplete or outdated.

c. Request erasure

Request deletion of personal information where the applicable legal conditions are met. Where available, users may initiate account and data deletion through the “Delete My Account & Data” feature or submit a request by email. Certain records may need to be retained for legal, regulatory, accounting, contractual or legitimate record-keeping purposes.

d. Restrict or object to processing

Request restriction of, or object to, certain processing activities where the applicable law provides that right.

e. Data portability

Request personal information in a structured, commonly used and machine-readable format where the applicable law provides this right.

f. Withdraw consent

Withdraw consent for processing activities based on consent, including optional marketing communications and relevant tracking technologies. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

g. Nominate another individual

Where provided under applicable Indian law, nominate another person to exercise relevant data rights in the circumstances permitted by that law.

h. Raise a complaint

Submit a privacy-related concern to RIAMS or approach the appropriate data-protection authority where the law provides that right.

Requests may be submitted to contact@riams.co.in with the subject line “Privacy Request”. RIAMS may take reasonable steps to verify the identity of the person making the request before disclosing, correcting or deleting information.

We respond within the timelines required by applicable law. Under the UK and EU GDPR, the standard response period is generally one month, subject to permitted extensions and exceptions.

Individuals in the UK may contact the Information Commissioner’s Office at ico.org.uk. Individuals in the European Union may contact the relevant supervisory authority in their jurisdiction. Individuals in India may use the applicable statutory grievance and complaint mechanisms as they become operational.

RIAMS retains personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, regulatory, contractual and record-keeping requirements. Retention periods vary according to the type of information and the purpose of processing.

a. Account, enrolment and learning records

Account information, enrolment history, learning progress and certificates may be retained while an account remains active and for an appropriate period afterwards where necessary to maintain educational records, verify participation or fulfil legitimate administrative requirements. Expiry of a purchased Community access period does not automatically require deletion of the associated learner account or educational records.

b. Financial and transaction records

Invoices, payment records, tax information and accounting documents are retained for the periods required by applicable financial, tax and accounting laws.

c. Professional eligibility documents

Documents submitted for qualification or eligibility verification are retained only for as long as required for verification, programme administration, legitimate record-keeping or applicable legal obligations.

d. Enquiries and correspondence

Enquiry records and communications are retained while necessary to respond to requests, administer related services or maintain appropriate business records. Where an individual does not enrol, the information is deleted or anonymised when it is no longer required, subject to any applicable lawful retention purpose.

e. Marketing preferences and consent records

Marketing information is retained while the individual remains subscribed or until it is no longer required. Where consent is withdrawn, limited information may be retained to record the withdrawal and prevent further unwanted promotional contact.

f. AI conversations and technical records

AI chat conversations, login histories and technical records are retained for periods necessary for support, security, service administration and related legitimate purposes, after which they are deleted or anonymised in accordance with applicable retention procedures.

g. Clinical educational material

Patient-related educational material is retained according to the permissions, educational requirements, confidentiality obligations and applicable retention rules associated with the relevant activity.

Individuals may request deletion of their personal information, subject to applicable legal exceptions and obligations. RIAMS periodically reviews retained information and takes appropriate steps to delete or anonymise information that is no longer required.

RIAMS uses appropriate technical and organisational measures to protect personal information against unauthorised access, misuse, alteration, disclosure or loss. These measures include, as applicable:

• Encryption of information during transmission.
• Access controls and authentication measures.
• Restricted access to uploaded documents and sensitive records.
• Role-based permissions for staff and authorised service providers.
• Secure links and controlled access to relevant communications.
• Monitoring and appropriate measures to protect the learning platform and associated systems.

Access to personal information is limited to individuals who require it for legitimate operational purposes. No digital system can be guaranteed to be completely secure. RIAMS maintains procedures to assess and respond to suspected security incidents.

Where a personal-data breach creates a notification obligation under applicable law, RIAMS will notify the relevant authorities and affected individuals as required.

RIAMS provides professional educational services primarily for qualified doctors, medical professionals and eligible students in relevant fields. Eligibility requirements vary according to the particular course, Community, webinar or programme.

Our services are not intended for children under the age of 18, and we do not knowingly collect personal information from children through ordinary registration and learning services.

Where we become aware that personal information has been collected from a child without the necessary lawful basis or authorisation, we will take appropriate steps in accordance with applicable law.

RIAMS may update this Privacy Policy periodically to reflect changes in its services, technology, data-processing activities or applicable legal requirements. The latest version will be published on this page with a revised “Last Updated” date.

Where changes materially affect how personal information is processed or an individual’s rights, RIAMS will provide appropriate notice through the website, email or another relevant communication channel, as required by applicable law.

For privacy-related enquiries, personal-data requests, concerns about the handling of information or complaints, please contact:

Recon Aesthetics Pvt Ltd, operating as Recon Institute of Aesthetic Medicine & Surgery (RIAMS), A-26/1, Third Floor, DLF Phase 1, Sector 28, Near Mega Mall, Golf Course Road, Gurugram – 122002, Haryana, India.

Privacy and Grievance Email: contact@riams.co.in · General Enquiries: info@riams.co.in · Phone: +91 9990824443, +91 9990824447

Please include sufficient details to identify the relevant account, transaction or concern so that the request can be reviewed appropriately.

RIAMS will acknowledge and address privacy-related grievances in accordance with the procedures and timelines required by applicable law.

Where applicable law requires the identification of a designated grievance officer, data-protection contact or representative, the relevant details will be provided through the appropriate official channel.

Individuals retain their rights to approach the relevant statutory authority or pursue other remedies available under applicable law.