Who is responsible for your data
Dr Divya Rajawat is the Data Fiduciary. Contact: [email protected]. Contact: +91 93805 58623 or [email protected].
What is collected, and why
| Data | Why | Basis |
|---|---|---|
| Name and mobile number | To identify you and send appointment messages | Your consent |
| What you type at booking | So Dr Rajawat can prepare for the consultation | Your consent |
| Clinical records — history, examination, diagnosis, prescriptions | To provide care, and because medical records must be maintained | Legal obligation and your consent |
| Payment reference and amount | To confirm bookings, issue receipts and process refunds | Contract and legal obligation |
| Website analytics | To understand which pages are useful | Your consent |
Card and bank details are never seen or stored by us. They are handled entirely by Razorpay.
Who else processes your data
A small number of service providers process data on our instructions. They cannot use it for their own purposes.
| Provider | What they handle | Where |
|---|---|---|
| Eka Care | Appointment schedule and clinical records | India (AWS Mumbai) |
| Razorpay | Payments and refunds | India |
| Meta (WhatsApp) | Appointment messages | Global |
| Google Workspace | Email and calendar | Global |
| Amazon Web Services | Website and application hosting | India (Mumbai) |
Your clinical records are held in India. Appointment messaging and email involve providers who operate globally; that is disclosed here so you can decide with it in mind.
What is deliberately not collected
- Your consultation is not recorded, unless you are told and agree in advance.
- Condition names, diagnoses and clinical details are never placed in calendar entries, analytics, or anything that leaves our own systems. Calendar entries carry a booking reference only.
- We do not sell, rent or share your data for advertising. Ever.
How long it is kept
- Clinical records: at least three years from the last entry, as required by the telemedicine guidelines, and longer where a clinical reason exists.
- Payment records: as required by tax law, currently eight years.
- Booking messages and contact details: deleted on request, unless part of a clinical or financial record we are required to keep.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- ask what data is held about you, and get a copy;
- have inaccurate data corrected or completed;
- ask for data to be erased, where no legal duty requires it to be kept;
- withdraw consent at any time — this stops future processing but does not undo what has already happened, and may mean treatment cannot continue;
- nominate someone to exercise these rights if you become unable to;
- complain to the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these, email [email protected]. We respond within 30 days.
Confidentiality, specifically
Mental health records carry protection beyond general data law. Under the Mental Healthcare Act, 2017 your records are confidential and are not disclosed to family, employers or insurers without your written consent. The exceptions are narrow: where a court orders it, where law requires it, or where disclosure is necessary to prevent a serious and imminent risk to life.
If something goes wrong
In the event of a personal data breach, affected individuals and the Data Protection Board of India are notified as required by law.
Children
Where the patient is under 18, a parent or guardian books, consents and attends. We do not knowingly collect data directly from a child.
Cookies
This site uses only what is needed to function, plus privacy-respecting analytics that do not track you across other websites. No advertising or profiling cookies are used.
Grievances
If you are unhappy with how your data has been handled, write to [email protected] marked Grievance. If unresolved within 30 days, you may escalate to the Data Protection Board of India.