Privacy Notice

Who we are

Dr. Sujeeth's Healthcare Clinic, operated by Dr. Sujeeth Kumar Bashetty, is responsible for the patient information described in this notice. We decide why and how your information is used, which makes us the data fiduciary under the Digital Personal Data Protection Act, 2023.

You can reach us on 9963009090 or at drsujeeth@drsujeeth.com.

What information we collect

• Identity and contact details — your name, age, sex, phone number, email address and area of residence.
• Clinical information — your symptoms, diagnosis, examination findings, vital signs, allergies, past medical and surgical history, prescriptions issued, and follow-up advice.
• Reports you upload — laboratory and imaging reports you send us through the patient upload link.
• Appointment and billing records — visit dates, consultation type, invoices, receipts and payment references.
• Intake form answers — the pre-visit questionnaire you complete before your appointment.

Why we use it

• To provide your medical care — diagnosis, treatment, prescriptions and follow-up.
• To maintain your medical record as required of a registered medical practitioner.
• To send you your prescription, receipts, appointment confirmations and follow-up reminders on WhatsApp and email.
• To raise and settle bills for the consultation or procedure.
• To meet our obligations under medical council regulations and applicable law.

The legal basis

We process your information with your consent, which you give when you book an appointment, complete the intake form, or attend a consultation. We also process it where the law requires a doctor to create and retain a medical record, and to protect your vital interests in a medical emergency.

You may withdraw your consent at any time. Withdrawing consent does not affect anything already lawfully done, and we may still be required to retain your medical record for the period the law prescribes.

Who we share it with

We do not sell your information, and we do not share it for advertising. We share it only with service providers who help us run the clinic, and only to the extent each one needs:

• Our database and file storage provider, which hosts your medical record securely.
• Our application hosting provider, which runs the clinic software.
• Our payment provider, which processes card and UPI payments. We never store your card details.
• Our email and WhatsApp messaging providers, which deliver your prescription, receipts and reminders.
• An artificial intelligence provider, which helps read uploaded reports and draft clinical documents for the doctor to review. Its terms prohibit using your information to train its models. Every output is reviewed by the doctor before it forms part of your care.
• Your treating hospital or another doctor, where you are referred and you have asked us to share.
• Any authority we are legally obliged to disclose to.

Where your information is stored

Some of our service providers store and process information on servers outside India. Indian law permits this transfer. Wherever your information goes, it stays protected by contract and by the security measures described below, and this notice continues to apply to it.

How we protect it

• Your information travels over an encrypted connection and is stored encrypted.
• Access to the clinic system requires a password, and only the doctor and authorised clinic staff have accounts.
• Every clinical and billing action is written to an audit log.
• Links we send you for prescriptions, receipts and forms use unguessable addresses and stop working after a set period.
• Uploaded files are checked and size-limited before they are accepted.

How long we keep it

We keep your medical record for at least three years from the date of your last consultation, as the medical council requires, and longer where a longer period applies — for example, while a claim, insurance matter or legal proceeding is open. Billing records are kept for the period tax law requires. When a record is no longer needed for any of these purposes, we delete it.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• Tell you what information about you we hold and who we have shared it with.
• Correct anything that is wrong, incomplete or out of date.
• Erase information we no longer need to keep.
• Nominate someone to exercise these rights on your behalf if you are unable to.
• Address a grievance about how we have handled your information.

To exercise any of these, contact us using the details below. We will respond as quickly as we can, and in any case within the time the law allows. Separately, as a patient you are entitled to a copy of your medical record on request, which we will provide within 72 hours.

If something goes wrong

If your information is ever exposed in a security breach, we will notify the Data Protection Board of India and every affected patient, as the law requires.

If you are not satisfied with how we have dealt with your concern, you may complain to the Data Protection Board of India.

Changes to this notice

We may update this notice as our practice or the law changes. The date at the top of this page tells you when it was last revised.