ADAM: Privacy Notice

1. Our commitment to protecting your personal data

Here at ADAM, we are strongly committed to respecting and protecting your privacy. Part of our commitment is being transparent with you about how we process your personal data. This Privacy Notice (the "Notice") aims to do just that.

Within this notice we explain:

  • Who we are and how to contact us;
  • What personal data we collect about you, and how we collect it;
  • Why we process your personal data (our purposes), and the lawful bases for doing so;
  • Who we share your data with, how long we retain your data for, and any transfers that take place; and
  • What you can do (your rights) in relation to how we use your data and who to contact if you have any concerns.

We endeavour to implement and maintain the highest standards regarding data protection and adopt policies in line with the highest level of compliance. As such, we align to the Personal Data Protection Act No. 9 of 2022 ("PDPA") to handle your personal data in certain ways.

When we use the term "personal data" we mean any information that can be used to identify you as an individual, directly or indirectly.

2. About us

We are BASKR Health (Pvt) Limited ("we"/"us"), trading as ADAM. We are registered in Sri Lanka under company number PV00329126.

Our registered office is located at:

  • 331/2A, Sarappa Mawatha, Welihena South, Kochchikade, Sri Lanka.

Our services

When you become a customer or patient of ADAM, you are likely to use one of our services, each designed to ensure that you enjoy your experience with us. These include, for example:

  • Our 'ADAM' website;
  • Our 'ADAM' app;
  • Our clinician consultations; and
  • Our health coaching and general healthcare services.

3. Our Data Protection Officer and how to contact us

We have appointed a Data Protection Officer ("DPO") to govern how we use your data and how to protect it.

If you need to contact the DPO, they can be reached directly via email at privacy@theadamclinic.com.

They can also be reached by post. If you wish to contact the DPO in this way, please label correspondence 'for the attention of the Data Protection Officer' using the postal address above.

If you wish to make a telephone call to us, please contact our customer care team on +94761498986.

If you have any concerns regarding how we process your personal data, we'd like the opportunity to address them in the first instance. If this is the case, please contact us via privacy@theadamclinic.com.

Where you feel we cannot address your concerns, you have a legal right to contact the Data Protection Authority of Sri Lanka should you wish to obtain further information or raise concerns. The Data Protection Authority can be contacted at https://www.dpa.gov.lk.

4. Changes to this privacy notice and your right to inform us of changes

This privacy notice was last updated on 9/3/2025. Historical versions can be provided by contacting us at privacy@theadamclinic.com.

We aim to keep accurate and up-to-date information about you so we can provide an effective service. Please inform us by emailing privacy@theadamclinic.com, should your personal details change during your relationship with us.

5. Our lawful bases for processing your data

When we process your data, we do it in a lawful manner. Under the PDPA, this means we use one or more of the following lawful bases:

  • Your consent ("Consent");
  • When you undertake a contract with us ("Contract");
  • When it is necessary for us to comply with a law or regulation ("Legal Obligation");
  • When we process information to provide a service or improve our business ("Legitimate Interest");
  • In rare cases where we are asked to process information in the public interest ("Public Interest");
  • In extremely rare cases, we may need to process your information in order to protect life ("Vital Interests").

When we need to process sensitive personal data, e.g., health information, biometric information, or data revealing racial or ethnic origin, we will only do so if we have a further lawful basis to do so, such as your explicit consent ("Explicit Consent").

When we use Legitimate Interests as a lawful basis, this means we weigh privacy rights against the Legitimate Interests of the business for a particular activity. If we rely on our (or a third party's) Legitimate Interests, these interests will normally be to:

  • Operate, provide, and improve our business, including our website and app;
  • Communicate with you and respond to your questions;
  • Improve our website and app or use the insights to improve or develop marketing activities and promote our products and services; or
  • Detect or prevent illegal activities (for example, fraud); and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers, vendors, and visitors.

Where we require your data to pursue our legitimate interests or the legitimate interests of a third party, it will be in a way which is reasonable for you to expect as part of the running of our business and which does not materially affect your rights and freedoms.

6. Personal data we may collect about you

As a customer or patient of ADAM, we may collect and use ("process") certain information; your "personal data", and what is called "sensitive personal data".

Personal data is any information that can be used to identify you, this includes your:

  • Name, surname, and username;
  • Contact information such as your email address, telephone number, and correspondence address; or
  • Demographic information such as your age, date of birth, or gender.

Sensitive personal data

Sensitive personal data is information about you that is more sensitive. We have further protections in place for this category of personal data.

Sensitive personal data we process about you may include:

  • Health information, such as your physical or mental health, healthcare provider visits, medicines administered (if you have chosen to provide these to us), as well as your responses to our online consultations, and any other information you provide to us relating to your health;
  • Image data, such as images of formal identification;
  • Information about your care, including details about your continued care by other people, for instance, other health professionals or your healthcare provider;
  • Race/ethnicity Data, details about your race or ethnic background;
  • Biometric information, such as details contained within formal identification documents, such as your passport;
  • Disability information, such details regarding any disability you may suffer from;
  • Your language preferences; and
  • Sex life information.

We do not knowingly collect the data of children. Please do not access our services, or provide data to us unless you are at least 18 years old.

7. How we collect your information

As a user of our services or as a patient, we may collect information about you in a number of ways, including:

Directly from you when you:

  • Take one of our online consultations or register to receive communications;
  • Contact us via email or phone - if you do, we may keep a record of that correspondence and record the phone call;
  • Choose to participate in surveys that we use for research purposes;
  • Purchase services or products through our online service;
  • Use our AI chat bots;
  • Provide us with formal identification information;
  • Provide services to us and/or our website users;
  • Provide feedback to us;
  • Otherwise contact us, including with queries, comments, or complaints; or
  • Make a claim under one of our guarantees.

From our website, such as your:

  • Marketing and communications preferences;
  • Cookies preferences;
  • Consent preferences;
  • Contact data;
  • Identity data;
  • Technical data; and
  • Usage data.

Data we receive from others

We work with third party identification verification providers to confirm your identity, who in turn may use, for example, credit reference agencies, and the electoral register, to verify identity.

We may also receive data about you from our third party service providers, including our payment service provider and our analytic service providers.

As our business relies on collaboration with third parties such as our prescribers, pharmacies, and doctors, we may also receive information about you from them.

8. Your rights in relation to your personal data

We strongly believe in the fair and transparent processing of your personal data and as such, we need to make you aware that you have rights under data protection law. These are called your 'Individual Rights', and include:

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. However, there are some exemptions, which means you may not always receive all the information we process, for example, other peoples' personal information, or information that is commercially sensitive.

Your right to rectification

You have the right to ask us to rectify (i.e., correct) information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to be forgotten (erasure)

You have the right to ask us to erase your personal information in certain circumstances. Whilst we will do our best to erase your personal data where we can, the right to be forgotten is not an absolute right - this is because we may need to keep certain elements of your information for legal obligations or other legitimate purposes. However, we will tell you if this is the case.

Your right to restrict processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to the processing of your personal information, in certain circumstances if you believe our processing impacts on your rights and freedoms and where we use either consent or legitimate interests. If we are processing on the basis of consent, you can also withdraw your consent at any time.

Your right to data portability

You can request that we transfer your data to another service provider, or to you. Your right applies if you initially provided consent for us to use the data, or were under, or in talks about entering into a contract - and that the processing is automated. Note that your right only applies to information you have given us.

Exercising your rights

Please contact us at privacy@theadamclinic.com, by post, or over the phone if you wish to make a request. We will respond to your request without undue delay, and always endeavour to complete requests within one calendar month.

Please note that not all rights are absolute. For example, where we are required to process your data as part of a legal obligation, we may be required to maintain this information.

We won't charge for exercising your rights. However, we do reserve the right to charge an admin fee if your request is deemed to be manifestly unfounded or excessive.

For more information about your rights, we encourage you to visit the Data Protection Authority of Sri Lanka's relevant site at: https://www.dpa.gov.lk.

9. Other information you may find useful

Clicking on external links? We encourage you to read their privacy notice too

If you click on a link external to our service, please understand that you are leaving our service and we cannot therefore control the privacy practices and content of those third parties.

Any personal data you provide will not be covered by this privacy notice, and we strongly encourage you to read their privacy policies to understand how they collect and process your personal data.

When you use passwords to verify and enable access to our services - keep them safe

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our online services, you are responsible for keeping this password (and other personal details) safe.

We encourage you to avoid sharing your password with anyone, or to write it down. When you create a password, our tip is to use three random (but memorable) words, with numbers and symbols included.

The legal stuff

If any provision of this notice is held by a court of competent jurisdiction to be invalid or unenforceable, then such provision shall be construed, as nearly as possible, to reflect the intentions of the parties, and all other provisions shall remain in full force and effect.