The short version
- This website has no sign-up, no account and no online form for medical details.
- We handle your data when you call, WhatsApp or email us, and (only if you say yes) when we measure site usage with Google Analytics.
- We do not sell personal data and we do not show advertisements.
- You can say no to analytics, change your mind at any time, and ask us to access, correct or erase your data.
Contents
- Who we are
- What personal data we handle, and why
- Consent and how to withdraw it
- Who receives your data
- Transfers outside India
- How long we keep data
- Security and data breaches
- Children
- Your rights
- Grievances and the Data Protection Board
- Cookies and similar technologies
- Language
- Changes to this policy
- Contact us
1. Who we are
This website, drshrutisagar.com, is run by Dr. B. Shruti Sagar, a Consultant Gastroenterologist and Hepatologist who practises at Krisara Gastro & Liver Clinic, 3rd Floor, Fairmont Square, Petbasheerabad, Quthbullapur, Kompally, Hyderabad - 500100, Telangana, India. For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Dr. B. Shruti Sagar is the Data Fiduciary for personal data collected through this website. "We", "us" and "our" mean Dr. B. Shruti Sagar.
This notice covers the website. Medical records created during a consultation at the clinic are handled under a separate registration and consent process at the clinic, and under the professional rules that apply to doctors in India, including confidentiality and record-keeping. Hospitals that Dr. Sagar works with, such as Yashoda Hospitals, are separate organisations with their own privacy notices.
2. What personal data we handle, and why
We handle only the data below. For each item we say why we need it and the basis for using it under the DPDP Act.
| What | Data | Why | Basis |
|---|---|---|---|
| You contact us by phone, WhatsApp or email | Your name, phone number, email address, and anything you choose to write, which may include health details. | To reply, to arrange or confirm an appointment, and to answer your questions. | You give the data voluntarily for this purpose (section 7(a) of the DPDP Act). We ask you not to send detailed medical reports by chat or email unless we have asked for them. |
| Website analytics (only if you accept) | A random identifier stored in your browser, pages viewed, clicks on call, WhatsApp and booking buttons, device and browser type, approximate location (city level) and referring website. | To understand which pages help patients and to fix problems. We do not use it for advertising or profiling. | Your consent (section 6). Analytics does not run until you click Accept. |
| Hosting and security logs | Your IP address, the time of the request, the page requested and your browser type. | To deliver the website, keep it secure and find faults. These logs are kept by our hosting provider. | Needed to deliver the page you asked for. They are not used to identify you. |
| Content loaded from other services | Your IP address and browser details are sent to the provider when a page loads a Google Map, Google Fonts or an image from another service. | To show maps, fonts and images. | Needed to display the page. See section 4. |
What we do not do. We do not sell or rent personal data. We do not run advertising or retargeting. We do not use website visitors' data to build profiles. We do not publish patient names, photographs, testimonials or health details on this website.
If you tell us about someone else's health, for example a parent, please make sure you have their permission or are acting as their lawful guardian.
3. Consent and how to withdraw it
When you first visit, a banner asks whether we may use Google Analytics. Accept and Decline have equal weight, and nothing is switched on before you choose. Declining does not limit what you can do on the website.
You can change your choice at any time with the Privacy choices link in the footer of every page, as easily as you gave it. Withdrawing consent stops analytics from then on and removes the analytics cookies from your browser. It does not affect anything done before you withdrew. For messages you sent us, withdraw by writing to us (section 14); we will stop using your details except where the law requires us to keep them.
4. Who receives your data
We share personal data only with the following, and only as needed for the purposes above.
- Google LLC and its group provide website hosting (Firebase Hosting), Google Analytics (only if you accept), Google Maps embeds and Google Fonts. They act on our behalf for hosting and analytics and under their own terms for maps and fonts.
- Meta Platforms (WhatsApp), if you choose to message us on WhatsApp. The conversation is then also covered by WhatsApp's own privacy policy.
- Yashoda Hospitals, if you choose "Book on Yashoda". You leave this website and the hospital's own portal and privacy notice apply. We do not send your details to the hospital through this website.
- Instagram. Links to our Instagram page open on Instagram, which then applies its own policy.
- Authorities and courts, where the law requires us to disclose data, or to protect someone's life or safety in an emergency.
We require service providers that process data for us to protect it and to use it only for our purposes.
5. Transfers outside India
Google Analytics, Google Fonts and WhatsApp process data on servers in India and in other countries. The DPDP Act allows transfers outside India except to countries the Government of India restricts by notification. We will stop using a provider for a restricted country if one is notified.
6. How long we keep data
- Messages that do not lead to a consultation: deleted within 12 months of the last message.
- Messages that lead to a consultation: the clinical information becomes part of your medical record and is kept for the period doctors in India must keep records. The rest of the message is deleted after 12 months.
- Analytics data: up to 14 months, then deleted automatically by Google Analytics.
- Hosting logs: kept by the hosting provider for a short rolling period and, where the DPDP Rules require processing logs to be kept, for at least one year.
If you ask us to erase your data and no law requires us to keep it, we will erase it and tell you when it is done.
7. Security and data breaches
The website is served over HTTPS. We limit access to messages and records to the doctor and clinic staff who need them, we protect the accounts that hold contact details with passwords and access controls, and we do not collect payment card numbers on this website.
If a personal data breach affects you, we will tell you without delay in plain language: what happened, what data was involved, what we are doing about it, and what you can do. We will also report it to the Data Protection Board of India as the DPDP Rules require.
8. Children
This website is written for adults. If you are under 18, please ask a parent or guardian to contact us for you. Where a parent or lawful guardian contacts us for a child's care, we handle the child's data only to provide that care, in the child's interest. We do not track, profile or target children, and we do not show them advertisements.
9. Your rights
Under the DPDP Act you have the right to:
- Know what personal data of yours we hold, why, and who it has been shared with.
- Correct data that is wrong or incomplete, and erase data we no longer need.
- Withdraw consent at any time (see section 3).
- Complain if you are unhappy with how we handle your data (see section 10).
- Nominate another person to exercise these rights for you if you die or become unable to do so.
To use a right, email drshrutisagar@gmail.com or call +91 75695 41532. Say which right you want to use. We may ask for a little information to confirm it is you, so that we do not give your data to someone else. There is no charge.
The DPDP Act also asks you to act honestly: do not impersonate someone else, do not give false information, and do not make a false or frivolous complaint.
10. Grievances and the Data Protection Board
If you have a concern, write to the contact in section 14. We will acknowledge it within 7 days and aim to resolve it within 30 days. In any case we will respond within the time the DPDP Rules allow, which is currently 90 days.
If we have not resolved your concern, you may complain to the Data Protection Board of India. The Act asks you to use our grievance process first.
11. Cookies and similar technologies
| Name | Set by | Purpose | Lifetime | Needs consent? |
|---|---|---|---|---|
_ga | Google Analytics | Tells visits from different visitors apart. | Up to 2 years | Yes |
_ga_G-4PMD1KWDXX | Google Analytics | Keeps the state of a visit. | Up to 2 years | Yes |
krisara_privacy_choice_v1 | This website (browser storage) | Remembers your Accept or Decline choice so we do not ask again on every page. | Until you clear it or change your choice | No, it only stores your choice |
We set no advertising cookies. You can also block or delete cookies in your browser settings.
12. Language
This notice is in English. You can ask for it in Telugu, Hindi or any other language in the Eighth Schedule to the Constitution of India by writing to us, and we will provide it.
13. Changes to this policy
If we change what data we handle or why, we will update this page and its "Last updated" date. If a change needs your consent, we will ask for it again before acting on it.
14. Contact us
For any question or request about your data, contact Dr. B. Shruti Sagar, the person who answers for this website's data handling:
- Email: drshrutisagar@gmail.com
- Phone: +91 75695 41532
- Post: Krisara Gastro & Liver Clinic, 3rd Floor, Fairmont Square, Petbasheerabad, Quthbullapur, Kompally, Hyderabad - 500100, Telangana, India