1. Information Collection

Explicitly state exactly what data the website collects through the intake forms and browsing activity.

•⁠ ⁠Personally Identifiable Information (PII): Full name, phone number, and email address collected via the booking form.
•⁠ ⁠Sensitive Health Information: Broad reasons for visit (e.g., “Consultation Type” dropdowns for pregnancy, infertility, or intimacy) submitted voluntarily by the patient.
•⁠ ⁠Technical Data: IP addresses, browser types, and cookies used for basic website functionality and analytics.

 2. Purpose of Data Collection

Define exactly how the collected information will be used, ensuring patients know their data is strictly for medical and administrative purposes.

•⁠ ⁠To schedule, confirm, and manage clinic or teleconsultation appointments.
•⁠ ⁠To send automated appointment reminders and essential follow-up communications.
•⁠ ⁠To triage patient inquiries to the correct medical staff.
•⁠ ⁠Explicitly state that patient data, especially phone numbers and consultation reasons, will never be sold or rented to marketing agencies.

3. Third-Party Data Processors (Crucial for Automations)

Since the website relies on digital tools to route patient requests, the policy must declare that data passes through secure third-party services.

•⁠ ⁠Web Infrastructure: Acknowledge that the site is hosted on third-party servers and utilizes content management and form-building software (e.g., WordPress, Elementor).
•⁠ ⁠Communication & Automation: State that form submissions may be processed by secure automation platforms (like Pabbly Connect) to trigger instantaneous appointment confirmations via official messaging APIs (like AiSensy for WhatsApp) or email servers.
•⁠ ⁠Ensure the clause clarifies that these third-party processors are bound by confidentiality and only use the data to facilitate clinic operations, not for their own marketing.

 4. Data Security Protocols

Provide reassurance on how the patient’s intimate health data is protected from unauthorized access.

•⁠ ⁠Mention the use of Secure Socket Layer (SSL) encryption for all data transmitted through the website forms.
•⁠ ⁠Outline administrative safeguards, such as restricting access to submitted form data strictly to Dr. Shinde and authorized front-desk personnel.

 5. Patient Rights and Consent

Empower the patient with control over their digital data, aligning with the Digital Personal Data Protection (DPDP) Act of India.

•⁠ ⁠Right to Access and Modify: Patients can request a copy of the personal data collected through the website or ask for corrections to their contact details.
•⁠ ⁠Right to Erasure: Patients can request the deletion of their web-submitted data from the clinic’s digital databases, subject to medical record retention laws.
•⁠ ⁠Opt-Out Clause: Clear instructions on how to opt out of automated WhatsApp or SMS appointment reminders.

6. Cookie Policy Integration

Briefly cover the use of cookies.

•⁠ ⁠Explain whether the site uses strictly necessary cookies (for the site to function and forms to submit) or analytical cookies (to see how many visitors the site gets).
•⁠ ⁠Provide a brief note on how users can disable cookies in their browser settings.

7. Policy Updates and Contact Information

•⁠ ⁠State that the Privacy Policy may be updated periodically and note the “Last Updated” date at the top of the page.
•⁠ ⁠Provide a direct email address or phone number for the clinic’s designated privacy officer or administration desk so patients can direct privacy concerns there.