Privacy Policy | Dr Aditya Aggarwal, Aggarwal Clinic, Patiala

1. Who we are

Aggarwal Clinic, 1-E, The Mall, opposite Polo Ground, New Lal Bagh Colony, Patiala, Punjab 147001 (“we”) decides why and how your personal data is used. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the data fiduciary, and you are the data principal.

2. What we collect, and why

When you WhatsApp or call us: your name, phone number, messages, and any reports or scans you choose to send. Purpose: to arrange your appointment and prepare for your consultation.
At the clinic: the details needed for your care and your medical record. Purpose: to treat you, and to meet medical-records and other legal duties.
When you visit this website: basic technical data (IP address, browser and device type, pages visited). Purpose: to deliver the site, keep it secure, and count visits.

We collect only what we need for these purposes, and we don’t use your data for anything else without asking you.

3. Health information

Reports, scans and medical details are sensitive. We treat them as “sensitive personal data” under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, alongside the DPDP Act, and protect them with reasonable security safeguards.

4. Our tools run on your device

The knee check, knee score and DICOM viewer run entirely in your browser. Nothing you tick, type or open in them is uploaded, stored or sent to us or anyone else. The DICOM viewer reads scan files on your device only; closing the page clears them.

5. Hosting and analytics

This website is hosted by Cloudflare, which processes technical data to deliver the site and protect it from abuse. We use Cloudflare Web Analytics to count visits. It is cookie-free: it doesn’t set cookies, use local storage or fingerprint your device, and it doesn’t track you across other websites. We see only totals, such as page views, referring sites, country, and browser or device type. The site sets no cookies and has no advertising.

6. Consent

When you send us your details or reports, you consent to us using them for the purposes above. Consent is free, specific and informed, and you can withdraw it at any time, as easily as you gave it, by messaging or calling us (see section 11). After you withdraw, we stop using your data for that purpose within a reasonable time. Withdrawal doesn’t affect anything done before it, or records the law requires us to keep.

7. Children

If the patient is under 18, a parent or lawful guardian should contact us and give consent on the child’s behalf. We may ask the parent or guardian to confirm who they are. We don’t track children or show them advertising.

8. Who we share it with

We don’t sell your data or use it for advertising. We share it only with people involved in your care (for example, a hospital or laboratory where a test or procedure is done), with service providers who process it for us under contract (such as our website host), or when the law requires it.

WhatsApp is run by Meta, and Cloudflare runs a global network, so some data may be processed outside India. This is permitted under the DPDP Act except to countries the Government of India restricts. Messages sent on WhatsApp are also covered by WhatsApp’s own terms and privacy policy.

9. How long we keep it

Messages and reports sent before a visit: only as long as needed to arrange and provide your care, then deleted, unless they become part of your medical record.
Medical records: for the period required by medical council rules and other laws, then deleted securely.
Technical logs: for the period the law requires for security (currently at least one year under the DPDP Rules), then deleted.

When the purpose is over and the law no longer needs the data, we erase it.

10. Your rights

Under the DPDP Act you can ask us:

for a summary of the personal data we hold about you, how we use it, and who we have shared it with;
to correct, complete or update it;
to erase it, unless the law requires us to keep it;
to resolve a grievance about how we have handled it; and
to let a person you nominate exercise these rights if you die or can’t act yourself.

11. Grievance and privacy contact

Dr Aditya Aggarwal, Grievance and Privacy contact
Aggarwal Clinic, 1-E, The Mall, New Lal Bagh Colony, Patiala 147001
Phone: +91 98768 24676 · Email: [email protected]

We will acknowledge your request and aim to respond within 30 days, and in any case within the period the law allows (no more than 90 days under the DPDP Rules, 2025).

12. Complaints to the Data Protection Board

If you are not satisfied with our response, you can complain to the Data Protection Board of India, set up under the DPDP Act. You should first raise the issue with us, as in section 11.

13. If there is a data breach

We use reasonable security safeguards to protect your data. If a breach affects your personal data, we will tell you without delay, in plain language: what happened, the likely impact, what we are doing about it and what you can do. We will also report it to the Data Protection Board as the law requires.

14. Changes to this policy

We may update this policy, for example when the law changes. The effective date above shows the current version. If a change affects how we use data you have already given us, we will tell you.

Privacy policy.