Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how personal information is collected, used, stored, shared and protected by Heracle Care and Wellness (Private) Limited (“Heracle Care & Wellness”, “we”, “us” or “our”) — a subsidiary of Heracle Holdings (Private) Limited within the Lyceum Global Holdings group (the “LGH Group”) — in connection with our website at https://heraclecare.lk/ (the “Website”) and the enquiries we receive through the contact channels published on it.

This Policy applies to the following individuals (“you”):

• visitors to the Website;
• individuals who contact us by telephone, WhatsApp or email using the details or buttons on the Website — including appointment, service and pricing enquiries, and “Request a Proposal” enquiries from organisations about corporate wellness;
• our healthcare and wellness professionals, whose names, roles, qualifications and professional registration numbers are published on the Website;
• individuals whose Google reviews are reproduced on the Website; and
• individuals — including young athletes — who appear in photographs or descriptions in the Website's Community section.

The Website is an information site. It does not offer patient accounts, online booking, online payments or any online form, and it does not itself collect health information. We aim to collect only the limited personal information described in Section 3.

This Policy does not cover the clinical records we create when you receive treatment at the centre or during a home visit — such as assessments, treatment plans and progress notes — which are handled under our patient-records practices; see Section 18. Nor does it apply to the websites or services of other LGH Group companies, which have their own privacy notices; see Section 19.

In this Policy, “PDPA” means Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025 (its staged commencement is explained in Section 15), and “personal information” has the same meaning as “personal data” in the PDPA. This Policy should be read together with our Terms and Conditions and Cookie Policy.

2. Who We Are

3. Information We Collect

You are not obliged to give us any personal information; however, without a way to reach you we cannot answer an enquiry or arrange an appointment. We do not collect payment details, identity-document numbers or account credentials through the Website, and we ask that you do not send them to us; see Section 6.

4. How We Use Your Information

We use personal information for the following purposes:

• Responding to enquiries, and arranging, confirming, rescheduling or cancelling appointments, walk-ins and home visits;
• Matching you to the appropriate specialist and service, and telling you about pricing, packages, preparation and what to bring;
• Responding to corporate wellness enquiries, preparing proposals, and taking steps towards an agreement with an organisation;
• Presenting our professionals, services, community activities and client feedback on the Website;
• Operating, securing and maintaining the Website, including detecting and investigating misuse, security incidents and technical faults; and
• Meeting our legal, regulatory and professional obligations, and establishing, exercising or defending legal claims.

We do not sell personal information, and we do not use enquiry information to send you marketing messages — by WhatsApp, SMS, email or otherwise — unless you have asked us to.

5. Legal Basis for Processing

We rely on the following legal bases:

• Steps taken at your request, or performance of a contract — for example, where you ask for an appointment, a home visit or a corporate wellness proposal, and we respond or take steps towards providing the service.
• Legitimate interests — for example, responding to general enquiries; operating and securing the Website; and publishing information about our professionals, our community activities and public reviews of our services — where these interests are not overridden by your own interests.
• Consent — for example, where you choose to share health information in an enquiry (see Section 6); where a child's name or identifiable image is published, which is done only with the consent of a parent or legal guardian (see Section 17); and where our professionals agree to their photographs and profiles being published. You may withdraw consent at any time, without affecting processing carried out before withdrawal, using the details in Section 21.
• Compliance with a legal obligation — for example, responding to a lawful request from a court, regulator or law-enforcement authority.

6. Health and Other Special Category Information

Under the PDPA, special categories of personal data include data concerning health; genetic and biometric data; information revealing racial or ethnic origin, political opinions, or religious or philosophical beliefs; data concerning sex life or sexual orientation; data relating to offences, criminal proceedings and convictions; and personal data relating to a child.

Because we are a healthcare and wellness provider, enquiries often touch on health. The Website does not ask you for health information, and you can make an enquiry without giving any. Where you choose to describe a condition or injury, we use that information only to deal with your enquiry and to direct you to the right professional, handle it under the conditions the PDPA sets for health data — including the duty of confidentiality that binds our healthcare professionals — restrict access to the staff who need it, and delete it once it is no longer needed, unless it becomes part of your clinical record (see Section 18).

7. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. Decisions about appointments, specialist allocation and treatment are made by our staff and professionals. The Website does not use chatbots, automated WhatsApp replies or symptom-checking tools.

8. Cookies and Similar Technologies

The Website sets no cookies of its own and stores nothing in your browser. It uses Cloudflare Web Analytics, which counts visits in aggregate without cookies or browser storage. Our technical review of 25 September 2026 did not identify any advertising or cross-site tracking tags; the embedded Google Map may set Google's own cookies. Full details are set out in the separate Heracle Care & Wellness Cookie Policy.

9. How We Share Information

Personal information is not sold, rented or traded. It may be shared in the following circumstances:

• Within Heracle Care & Wellness — with the reception, operations and professional staff who need it to deal with your enquiry, on a need-to-know basis.
• With Heracle Holdings and other LGH Group companies — where your enquiry relates to, or is best answered by, another Heracle or LGH Group company (for example, ZEUS Gymnasium), we may forward it to that company, which is then responsible for how it handles it; and with LGH Group shared services, such as Group IT, that support our systems under confidentiality.
• With Zuse Technologies (Private) Limited, which maintains the Website on our behalf, and with Cloudflare, which hosts it and provides its visitor statistics.
• With Google — when your browser loads the embedded Google Map, your IP address and technical information about your browser are sent directly to Google.
• With WhatsApp (Meta) — if you contact us on WhatsApp, the service is provided by WhatsApp, which processes your account and message information under its own terms and privacy policy. WhatsApp messages are end-to-end encrypted, but WhatsApp receives information about the communication itself.
• With a corporate client — where you take part in a corporate wellness programme arranged by your employer, only information needed to organise the programme (such as attendance) is shared with that organisation. Individual health information is not shared with an employer without your explicit consent.
• With professional advisers and auditors, under duties of confidentiality, where reasonably necessary.
• With the public — content published on the Website, including professional profiles, reproduced reviews and community content, is visible to anyone and may be indexed by search engines.
• For legal reasons — where required to comply with applicable law, a court order, or a lawful request by a public authority, or to protect the rights, property or safety of Heracle Care & Wellness, our clients, our staff or others.

Links from the Website to our Facebook, Instagram and TikTok pages are ordinary links: no information is passed to those platforms unless you choose to follow them.

10. International Data Transfers

We are based in Sri Lanka. Some of the providers described in Section 9 operate internationally: the Website is hosted by Cloudflare, whose global network delivers it from the data centre nearest to you (for visitors in Sri Lanka, usually Colombo) and may process technical request data in other countries; Google's services are delivered from Google's infrastructure worldwide; and WhatsApp messages pass through Meta's global infrastructure. Information about your visit, and any WhatsApp message you send us, may therefore be processed on servers outside Sri Lanka.

Where personal information is transferred outside Sri Lanka, we aim to ensure that it receives an appropriate standard of protection. Once Part III of the PDPA is in operation, we will apply Section 26 of the PDPA (as amended in 2025), including by adopting any transfer instruments that the Data Protection Authority of Sri Lanka specifies to secure binding and enforceable commitments from the recipient.

11. Data Security

We protect the information entrusted to us with measures that include:

• encrypted (HTTPS) connections between your browser and the Website, with HTTP Strict Transport Security enforced;
• a Website with no log-in, database or form, which limits the personal information exposed through it;
• operating our WhatsApp and email enquiry channels on accounts and devices controlled by Heracle Care & Wellness, rather than on staff members' personal accounts; and
• restricting access to enquiry records and to the Website's source code and hosting account to authorised Heracle Care & Wellness, Zuse Technologies and Group IT personnel who need it.

No system or organisation can guarantee complete security. Please let us know promptly of any concern about the security of your information, and avoid sending sensitive information by WhatsApp or email (see Section 6).

12. Security Incidents and Breach Notification

If we become aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal information we hold, we will assess the risk it poses and take reasonable steps to contain it. Where the incident is likely to put you at risk, or where applicable law requires, we will notify affected individuals and the Data Protection Authority of Sri Lanka without undue delay.

Please report any suspected security incident affecting the Website to info@heracle.lk.

13. Data Retention

In the absence of a longer period required by law or needed to deal with a dispute, we apply the following default retention periods:

• Enquiry records (WhatsApp chats, emails and call notes) — retained for twelve (12) months from our last communication with you, unless you become a client, in which case the relevant details move into your client record (see Section 18).
• Health information shared in an enquiry that does not lead to an appointment — deleted within three (3) months of our last communication with you.
• Corporate wellness enquiries and proposals — retained for twenty-four (24) months from the proposal date, or for the duration of any resulting agreement.
• Hosting request logs — retained for the period set by our hosting provider, and in any case for no longer than ninety (90) days unless needed to investigate a security incident.
• Published content — professional profiles are kept while the professional is associated with Heracle Care & Wellness; reviews and community content are kept while relevant, reviewed periodically, and removed or amended earlier upon a valid request.

14. Data Deletion

Personal information is securely deleted or anonymised once the applicable retention period above has expired, or earlier upon a valid request, subject to any legal, regulatory, professional or contractual requirement that it be kept for longer. Deleting a WhatsApp chat on our side does not delete the copy held on your own device. Requests can be made as described in Section 16.

15. Your Rights Under Applicable Data Protection Law

Sri Lanka's data protection framework is set out in the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the PDPA), which is being brought into operation in stages. By Order published in Gazette Extraordinary No. 2498/16 of 22 July 2026, Sections 2 and 3 of the PDPA, together with its Part I (processing of personal data) and Part III (controllers and processors), come into operation on 1 January 2027. As at the date of this Policy, Part II (rights of data subjects) and Part VII (penalties) remain subject to a separate commencement order that has not yet been issued.

Notwithstanding the above, and on a good-faith basis pending full commencement, we intend to honour the following rights, subject to applicable law and any exceptions it provides:

• the right to be informed about how personal information is processed;
• the right to request access to the personal information we hold about you;
• the right to request correction or completion of inaccurate or incomplete information;
• the right to request erasure of information, where applicable;
• the right to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal;
• the right to object to processing that is based on our legitimate interests — including the reproduction of your review, or your appearance in community content, on the Website;
• the right to request a review of any decision based solely on automated processing (we do not make such decisions; see Section 7);
• the right to raise a concern with us directly; and
• the right to lodge a complaint with, or appeal to, the Data Protection Authority of Sri Lanka (www.dpa.gov.lk), once its complaint-handling functions are operational under the PDPA.

Where the information concerns a child under sixteen (16) years of age, these rights may be exercised by a parent or legal guardian on the child's behalf; see Section 17.

16. How to Exercise Your Rights

Requests can be made by emailing info@heracle.lk with “Privacy Request” in the subject line, or by writing to us at the address in Section 21. To protect your information — particularly health information — we will ask you to verify your identity before we act on a request, and we will not disclose health information over the telephone or WhatsApp without verification. Requests are acknowledged promptly and responded to within one (1) month of receipt. Where we need more time, this period may be extended by up to a further two (2) months, in which case you will be told of the extension and the reason for it. If we are unable to act on a request, we will explain why. Requests are handled free of charge, except where the PDPA or rules made by the Data Protection Authority of Sri Lanka permit a fee.

17. Children's Data

The Website is intended for adults — including parents and guardians arranging care for a child. It is not directed at children, and we do not knowingly accept enquiries directly from children under sixteen (16) years of age — “children” under Section 56 of the PDPA. Appointments for a child, including paediatric physiotherapy, should be arranged by a parent or legal guardian. If we learn that a child has sent us personal information without the consent of a parent or legal guardian, we will delete it.

Because we support school and youth sport, the Website's Community section describes, and may show photographs of, school teams, youth academies and young athletes, some of whom are sponsored by us and represent Heracle Care & Wellness as brand ambassadors.

18. Clinical and Client Records

When you receive a service from us, our professionals create and keep clinical and client records — such as assessments, treatment plans, progress notes and session history — as part of providing safe care and meeting their professional obligations. These records are not collected through the Website and are not covered by this Policy. You will be given information about how they are handled when you register as a client, and you can ask about them using the details in Section 21.

19. LGH Group and Third-Party Websites

The Website links to third-party websites and platforms, including WhatsApp, Facebook, Instagram, TikTok and Google Maps, and refers to other Heracle and LGH Group companies. Each of these is responsible for its own privacy practices, and this Policy does not apply to them. We encourage you to read the privacy notice of any website or app you use.

20. Changes to This Policy

This Policy may be updated from time to time to reflect changes to the Website, our services, our organisation or applicable law — including further commencement orders under the PDPA, and the Website's move from its current address to a permanent domain. The “Last updated” date at the top of this page indicates when this version took effect. The current version is published on the Website, and material changes will be notified there by reasonable means.

21. Contact Us

Questions, concerns or requests relating to this Privacy Policy may be directed to: