Privacy Policy

 

Effective Date: 11 May 2026 Last Updated: 11 May 2026

1. Introduction

Welcome to HealthSheba ("we," "us," "our"), operating at healthsheba.com.bd. We are an e-commerce platform based in Bangladesh, offering health, wellness, and lifestyle products to customers across the country.

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the choices you have. By using our website or making a purchase, you agree to the practices described here.

In short: We collect only what's needed to deliver your order, improve your experience, and run our business legally and securely. We never sell your personal data.

2. Information We Collect

A. Information You Provide Directly

  • Identity & Contact: Full name, mobile number, email address, delivery address, billing address.
  • Account Information: Username, password (stored in encrypted form), order history, wishlist, preferences.
  • Order & Transaction Details: Products purchased, quantity, price, delivery instructions, special notes.
  • Customer Support Communications: Messages, complaints, reviews, photos, or any content you send us via WhatsApp, Messenger, email, or our contact form.

B. Information Collected Automatically

  • Device & Technical Data: IP address, browser type, operating system, device model, screen resolution, language settings.
  • Usage Data: Pages viewed, products clicked, time spent, referring URL, search queries on our site.
  • Location Data: Approximate location (city/area) inferred from IP address — used for delivery estimates and regional offers.
  • Cookies & Similar Technologies: See Section 4 for full details.

C. Information from Third Parties

  • Social Login: If you sign in via Facebook or Google, we receive your name, email, and profile photo (per the platform's permissions).
  • Payment Gateways: Transaction confirmations from bKash, Nagad, Rocket, SSLCommerz, or card processors.
  • Delivery Partners: Delivery status updates from Pathao, RedX, Sundarban, Steadfast, or our own delivery team.

3. How We Use Your Information

We use your information for the following legitimate business purposes:

  • Order Fulfilment: Processing orders, arranging delivery, issuing invoices, handling returns and refunds.
  • Customer Service: Responding to inquiries, resolving complaints, providing post-purchase support.
  • Account Management: Creating and maintaining your account, sending OTPs, password resets.
  • Marketing & Promotions: Sending offers, newsletters, SMS, or push notifications about products, sales, and seasonal campaigns (you may opt out anytime).
  • Personalisation: Recommending products based on browsing or purchase history.
  • Analytics & Improvement: Understanding how customers use our site, fixing bugs, improving the user experience.
  • Fraud Prevention & Security: Detecting suspicious activity, preventing chargebacks, protecting our customers and business.
  • Legal Compliance: Meeting tax, accounting, and regulatory obligations under Bangladeshi law.

4. Cookies & Tracking Technologies

Cookies are small text files stored on your device. We use cookies and similar technologies (pixels, web beacons, local storage) for the following purposes:

  • Strictly Necessary Cookies: Required for the site to function — login, shopping cart, checkout. These cannot be disabled.
  • Functional Cookies: Remember your preferences (language, region, recently viewed items).
  • Analytics Cookies: Help us understand site traffic and user behaviour (e.g., Google Analytics).
  • Advertising Cookies: Used by us and our partners (Meta/Facebook, Google) to show you relevant ads on other websites and social media platforms. See Section 5.

You can control cookies through your browser settings. Most browsers let you block or delete cookies, but doing so may affect site functionality (for example, you may not be able to stay logged in or complete a purchase).

5. Advertising & Analytics Partners

To grow our business and reach the right customers, HealthSheba uses advertising and analytics services provided by trusted third parties. These partners may collect information about your visit to our site (such as pages viewed, products added to cart, or purchases made) using cookies, pixels, and SDKs.

Meta Platforms (Facebook & Instagram)

We use the Meta Pixel and Conversions API to measure ad performance, optimise our advertising, and show you relevant ads on Facebook and Instagram. Data shared may include hashed email, hashed phone number, IP address, browser data, and events such as "View Content," "Add to Cart," and "Purchase."

Learn more in Meta's Privacy Policy: https://www.facebook.com/privacy/policy. Manage your ad preferences in your Facebook settings.

Google Services

We use Google Analytics 4, Google Ads, Google Tag Manager, and Google Merchant Center to measure traffic, run shopping campaigns, and remarket to past visitors. Google may collect device identifiers, IP addresses, and behavioural data.

Learn more in the Google Privacy Policy: https://policies.google.com/privacy. You may opt out of personalised ads at https://adssettings.google.com.

Other Tools

  • TikTok Pixel — for ad measurement and remarketing on TikTok (when applicable).
  • Hotjar / Microsoft Clarity — for heatmaps and session recordings to improve UX (we anonymise sensitive inputs).
  • Email & SMS Service Providers — for sending transactional and marketing communications.

Your control: You can opt out of interest-based advertising at any time via your browser settings, your Facebook ad preferences, Google Ad Settings, or by emailing us directly.

6. Sharing With Third Parties

We do not sell your personal information. We share data only with parties who help us operate our business, and only to the extent necessary:

  • Delivery Partners (Pathao, RedX, Sundarban, Steadfast, etc.) — to deliver your order. They receive your name, address, phone number, and order details.
  • Payment Gateways (bKash, Nagad, Rocket, SSLCommerz, card networks) — to process payments. We do not store your full card details.
  • Technology Providers — hosting, cloud storage, email, SMS, and customer-support tools.
  • Advertising & Analytics Partners — as described in Section 5.
  • Government & Legal Authorities — when required by Bangladeshi law, court order, or to protect our rights and safety.
  • Business Transfers — in case of merger, acquisition, or sale of assets, your data may be transferred to the new owner under the same protections.

7. Payment Information

All online payments on HealthSheba are processed through licensed payment gateways that comply with Bangladesh Bank regulations and PCI-DSS standards. We do not see, store, or have access to your full card number, CVV, or mobile wallet PIN.

For Cash on Delivery (COD) orders, no payment information is collected at the time of order — payment is made directly to the delivery agent.

8. Data Retention

We keep your personal information only as long as necessary:

  • Account data: until you delete your account, plus a short period for legal records.
  • Order & transaction records: at least 5 years, as required by Bangladeshi tax and accounting laws.
  • Marketing data: until you unsubscribe or opt out.
  • Analytics & cookie data: up to 26 months (or as set by the analytics provider).

9. Data Security

We take reasonable technical and organisational measures to protect your information:

  • SSL/TLS encryption for all data transmitted between your browser and our servers.
  • Encrypted password storage (we never store passwords in plain text).
  • Restricted access — only authorised staff can access customer data.
  • Regular security audits, software updates, and backups.
  • Secure third-party hosting infrastructure.

Important: No method of internet transmission is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. Please use a strong password and never share your account credentials.

10. Your Rights & Choices

As a HealthSheba customer, you have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Update or correct inaccurate information in your account.
  • Deletion: Request deletion of your account and personal data (subject to legal retention requirements).
  • Opt-out of Marketing: Unsubscribe from emails, opt out of SMS by replying STOP, or update preferences in your account.
  • Withdraw Consent: Withdraw consent for data processing where consent is the legal basis.
  • Object to Profiling: Ask us to stop using your data for personalised marketing.

To exercise any of these rights, please contact us using the details in Section 14. We will respond within 30 days.

11. Children's Privacy

HealthSheba is not intended for children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

If you are between 13 and 18, please use our services only with the involvement and consent of a parent or guardian.

12. International Users & Data Transfer

HealthSheba primarily serves customers in Bangladesh. However, some of our service providers (such as cloud hosting, analytics, and advertising platforms) may process data outside Bangladesh, including in the United States, the European Union, or other countries.

When data is transferred internationally, we ensure appropriate safeguards are in place — such as standard contractual clauses or the provider's own privacy frameworks — to keep your information protected.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

  • Update the "Last Updated" date at the top of this page.
  • Notify registered users by email or in-app notice for significant changes.
  • Post a prominent notice on our website.

We encourage you to review this page periodically. Your continued use of our services after changes are posted means you accept the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

HealthSheba — Privacy Team

This Privacy Policy is governed by the laws of the People's Republic of Bangladesh, including the Information and Communication Technology Act, 2006 (as amended) and the Digital Security Act, 2018. Any disputes shall be subject to the exclusive jurisdiction of the courts of Dhaka, Bangladesh.