Privacy Policy

1. Who we are

AIKYA Pain and Spine Centre ("AIKYA", "we", "us", "our") is a pain and spine care centre at S-10, Silver Springs Layout, Munekolalu Village, Varthur Hobli, Marathahalli, Bengaluru 560037, Karnataka, India, led by Dr. Kalpana K (Medical Reg. No. 70967).

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the data fiduciary for the personal data described in this policy. We are also a "body corporate" under Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

2. What this policy covers

This policy applies to personal data we collect through the website aikyahealth.co, our appointment and contact forms, telephone and WhatsApp conversations, tele-consultations, email, and in person at the centre. It does not cover websites or apps run by other organisations that we link to, such as YouTube, Instagram, Google or your insurer; their own privacy policies apply there.

3. Information we collect

Information you give us

• Appointment enquiry form: full name, email address, mobile number, preferred language, primary concern (for example "lower back pain" or "second opinion on surgery advised elsewhere"), preferred time, and anything you write in the message box.
• Phone, WhatsApp and email: your number or address, the content of the conversation, and any reports, scans or photographs you send us.
• Tele-consultation and clinic visits: identity and contact details, date of birth, medical history, symptoms, examination findings, imaging and test reports, diagnosis, treatment plan, prescriptions, consent forms, and follow-up notes.
• Billing, insurance and EMI: invoices and payment records, insurance policy and TPA details, pre-authorisation and claim documents, and, where you choose an EMI facility, the information the finance partner requires.
• Newsletter: your email address.
• Careers: your CV, qualifications, registration details and anything else you submit with a job application.
• Reviews and feedback: the content of any review, testimonial or feedback you give us.

Information collected automatically

• Technical data such as IP address, browser type, device type, operating system, referring page, pages visited, time spent, and approximate location derived from your IP address.
• Cookie and similar identifiers as described in section 8.
• Call records and WhatsApp message logs on our clinic phone.

Information from other sources

• Referral letters, reports and imaging sent by your referring doctor, hospital, laboratory or diagnostic centre.
• Policy, eligibility and claim information from your insurer or TPA when you ask us to assist with insurance.
• Public reviews you post about us on Google or social media.

4. Health information is sensitive personal data

Information about your physical or mental health, medical records and history is "sensitive personal data or information" under the SPDI Rules and is treated with additional care. We collect it only for the purpose of providing you with medical care, and the related administration (appointments, billing, insurance, record-keeping and legal compliance).

Your clinical records are maintained under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations and the applicable National Medical Commission regulations, and are accessible only to the treating team and staff who need them for your care or its administration.

5. How we use your information

We do not sell your personal data, and we do not use your health information for advertising.

6. Consent and lawful basis

We process your personal data on the basis of your consent, which you give when you submit a form on this website (by ticking the consent box), contact us, book or attend a consultation, or sign a treatment consent form. In some situations we rely on a "legitimate use" recognised under the DPDP Act, for example to provide medical treatment in a medical emergency, or to comply with a law or a court order.

You may withdraw your consent at any time by contacting us as set out in section 17. Withdrawal does not affect processing that already took place, and we may still need to keep certain records (such as your medical record, invoices and consent forms) for the periods required by law.

7. Who we share your information with

We share personal data only when it is necessary for your care, when you ask us to, or when the law requires it. Recipients may include:

• Our clinical and administrative team: doctors, physiotherapists, nurses, technicians and care coordinators involved in your treatment.
• Other healthcare providers: laboratories, imaging centres, hospitals, anaesthetists, referring or referred doctors, and pharmacies, where this is needed for your treatment.
• Insurers and third-party administrators (TPAs): only when you ask our insurance desk to assist with cashless approval or reimbursement, and only the documents the insurer requires.
• EMI and finance partners: only when you choose an EMI facility, in which case the partner's own privacy policy and terms also apply.
• Service providers who act on our instructions: website hosting, form and email delivery, appointment and patient-record software, payment gateway, newsletter platform, cloud storage, IT support and analytics providers. They are bound by contract to use your data only for the service they provide to us.
• Messaging platforms: when you contact us on WhatsApp, Meta Platforms processes your messages under its own terms and privacy policy.
• Regulators, courts and law enforcement: where required by law, by a court order, or to protect the safety of a person.
• A successor organisation: if the centre is reorganised, merged or transferred, patient records will be passed on in accordance with medical-record regulations and this policy.

Some service providers may store data on servers outside India. Where that happens, we take reasonable steps to ensure the data remains protected to a standard consistent with Indian law, and we comply with any restrictions on cross-border transfer notified under the DPDP Act.

8. Cookies and embedded content

Cookies are small text files placed on your device by a website. We use:

• Strictly necessary cookies that keep the website secure and let forms work. These cannot be switched off.
• Analytics cookies (for example Google Analytics) that tell us which pages are visited and how the site performs, in aggregate.
• Third-party embeds: YouTube videos, Instagram posts and Google Maps on our pages are served by those companies, which may set their own cookies and collect data about your interaction with the embed under their own policies.

You can block or delete cookies through your browser settings. Doing so may affect some features of the website, such as embedded videos.

9. How long we keep your information

When a retention period ends, we delete or anonymise the data unless we are required to keep it longer by law or for a pending legal matter.

10. How we protect your information

We use reasonable security practices and procedures appropriate to the sensitivity of the data, including password-protected and access-controlled systems, HTTPS encryption on this website, role-based access to patient records, staff confidentiality obligations, and contracts with service providers that require them to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

11. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed, and obtain a copy of your medical records (medical records are normally provided within 72 hours of a written request, as required by professional regulations).
• Correct inaccurate or incomplete data, and update it.
• Erase data that is no longer necessary for the purpose it was collected for, unless we must retain it by law.
• Withdraw consent at any time, as easily as you gave it.
• Nominate a person to exercise your rights on your behalf in the event of death or incapacity.
• Raise a grievance with our Grievance Officer, and if you are not satisfied with our response, approach the Data Protection Board of India.

To exercise any right, write to us using the details in section 17. We may need to verify your identity before acting on a request, and we will respond within the time required by law.

12. Children and dependants

If you are booking for a person under 18 or an adult who is unable to decide for themselves, you confirm that you are their parent or lawful guardian and that you consent on their behalf. We obtain verifiable guardian consent before processing a child's personal data, and we do not track or target children with advertising.

13. Newsletter and marketing

If you subscribe to our newsletter, we send one doctor-reviewed article a month about managing back, neck and joint pain. Every email includes an unsubscribe link. We may also send service messages about your appointments and care; these are not marketing and you cannot opt out of them while you are a patient. We do not send promotional SMS or WhatsApp messages unless you have opted in.

14. Reviews, photos and videos

We publish patient stories, reviews, photographs and videos on this website and on social media only with the written consent of the person concerned (or their guardian), and we use first names or initials unless you ask us to use your full name. You may withdraw this consent at any time by contacting us, and we will remove the content from the properties we control as soon as reasonably practicable. Public reviews you post on Google or social media are governed by those platforms' terms.

15. Links to other websites

This website links to third-party sites and services, including YouTube, Instagram, Google Maps, Google reviews and WhatsApp. We are not responsible for their content or privacy practices. Please read their policies before sharing information with them.

16. Changes to this policy

We review this policy periodically and update it when our practices or the law change. The current version is the one published on this page. If a change materially affects how we use your data, we will tell you through this website or by email where we have your address.

17. Grievance officer and contact

If you have a question, a request about your data, or a complaint, please contact our Grievance Officer. Under the Information Technology Act and the DPDP Act, we aim to acknowledge every grievance promptly and resolve it within the statutory timeline.

This policy is governed by the laws of India. Any dispute relating to it is subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka. See also our Terms of Use.