Privacy Policy

1. Overview & Data Controller Identity

Wellness Physiotherapy Centre ("we," "our," or "us"), led by Dr. Arun Yadav (PT, Senior Consultant Physiotherapist), operates the healthcare practice located at:

We are committed to safeguarding patient privacy and managing your personal and sensitive data responsibly under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and healthcare confidentiality ethics established by Allied Health Councils.

2. Categories of Personal & Health Data Collected

We minimize data collection strictly to what is necessary for scheduling clinical consultations, providing physiotherapy care, and communicating treatment details. When you interact with our website or appointment request modals, we may receive:

• Basic Identifying & Contact Information: Full name, telephone/mobile number, and email address.
• Clinical Concern & Treatment History (Sensitive Health Data): Category of physical concern (e.g., Spine, Joint Pain, Sports Rehabilitation, Neurological/Paralysis Recovery), duration of symptoms, and any brief notes you choose to share.
• Technical Device Metadata: Standard HTTP server request logs (IP address, user-agent, request timestamp) processed transiently by our static hosting infrastructure provider (Vercel Inc.) to serve and secure web pages.

Note: We do not store financial payment card details, passwords, biometric authenticators, or Aadhaar identity numbers on this website.

3. Purpose of Processing & Lawful Grounds

We process your personal information strictly for legitimate healthcare and communication purposes:

• Appointment Scheduling & Clinical Triage: To schedule appointments, arrange home visit logistics, and assess therapy requirements. (Ground: Consent of the Data Principal under Section 6 of DPDP Act 2023, and direct clinical inquiry).
• Direct Clinical Communications: Sending booking confirmations, clinic directions, appointment reminders, and follow-up clinical guidance via WhatsApp, phone, or email.
• Legal & Regulatory Compliance: Maintaining professional clinical records as mandated by the National Commission for Allied and Healthcare Professions Act, 2021, and defending legal claims.

No Unsolicited Marketing: We will never sell, rent, trade, or distribute your telephone number or email address to third-party telemarketers or ad brokers. Submitting an inquiry form never signs you up for unwanted marketing blasts.

4. Data Flow Architecture & Third-Party Processors

Our technical architecture is built for maximum data privacy and minimisation:

• Zero Database Storage on Website: Our website runs as a secure, static web application. We do not maintain an internet-connected patient SQL database on our web server.
• Direct WhatsApp Hand-off (Meta Platforms): When you click "Request a Call Back" or submit the inquiry form, the information you entered is formatted into an encrypted WhatsApp text message and opens in your WhatsApp client to connect with our official clinic number (+91 63957 16031). WhatsApp communications are end-to-end encrypted under Meta's privacy infrastructure.
• Static Hosting Infrastructure (Vercel Inc.): The website is hosted on Vercel's global CDN edge. Vercel processes transient server logs for DDoS mitigation, DNS resolution, and asset caching under standard enterprise Data Processing Agreements.
• Interactive Google Maps Embed: Our contact page embeds an interactive Google Maps iframe to help patients locate our clinic in Noida Sector 04. Loading Google Maps may transmit your IP address and standard HTTP headers to Google LLC in accordance with Google's Privacy Policy.

5. Cookies and Tracking Technologies

We respect your digital privacy:

• This website uses zero third-party advertising cookies, zero retargeting trackers, and zero cross-site behavioural profiling beacons (no Meta/Facebook Pixel, no Google Ads tags, no third-party marketing trackers).
• All website typography (Google Inter fonts) is self-hosted locally on our servers, ensuring your font requests never leak your IP address to third-party font networks.
• Because we only use strictly necessary technical features to display the web pages, no invasive cookie consent banner is mandated under ePrivacy/GDPR regulations.

6. Data Retention & Erasure Schedule

• Inquiries without treatment: Inquiries submitted via WhatsApp or phone that do not result in a clinical consultation are deleted or archived within 90 days.
• Active Patient Clinical Records: In accordance with Indian healthcare regulations and physiotherapy clinical standards, verified treatment charts, diagnosis assessments, and billing receipts are retained for a minimum of 3 years following discharge, or as required by applicable medical records standards.
• Server Edge Logs: Transient CDN edge logs at Vercel are automatically overwritten within 30 days.

7. Rights of Data Principals (DPDP Act, 2023 & GDPR)

Under the DPDP Act 2023 and relevant data protection principles, you possess the right to:

• Right to Access: Request a summary of the personal and health data we hold regarding your treatment.
• Right to Correction & Updating: Request immediate correction of inaccurate or incomplete contact or health records.
• Right to Erasure: Request the deletion of non-statutory personal data, subject to mandatory medical record retention obligations.
• Right to Withdraw Consent: Withdraw consent for non-essential communications at any time by messaging or emailing our clinic.
• Right of Grievance Redressal: Register a complaint regarding data processing with our designated Grievance Officer.

8. Security Safeguards & Cyber Incident Protocol

We implement industry-standard administrative, physical, and technical safeguards:

• All web traffic is enforced over TLS 1.3/HTTPS encryption in transit.
• Clinic devices accessing WhatsApp patient inquiries are protected by device-level biometrics and passcodes.
• No medical database credentials or API secrets exist in client-side static code.

Incident Reporting: In compliance with CERT-In directions under Section 70B of the IT Act, 2000, and the DPDP Act 2023, in the unlikely event of a verified cybersecurity breach compromising patient personal data, we will notify the Indian Computer Emergency Response Team (CERT-In), the Data Protection Board of India, and affected data principals within statutory timeframes.

9. Grievance Officer & Contact Information

In compliance with the DPDP Act 2023 and Rule 5(9) of the SPDI Rules 2011, for privacy inquiries, exercising statutory rights, or raising grievances, please contact our designated Grievance Officer:

10. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practice or evolving statutory regulations under the DPDP Rules. Revisions become effective upon publication on this page with an updated Effective Date.