Privacy Policy
How Venkata Ganapathy Physiotherapy Clinic collects, uses, stores and protects your personal data under the Digital Personal Data Protection Act, 2023.
1. Introduction & Who We Are
Venkata Ganapathy Physiotherapy Clinic ('the Clinic', 'we', 'us') operates at Opposite Dr. Dutta Ramachandra Rao (Rambabu Garu) Hospital, K.S. Talkies Road, Vijayawada Road, Hanuman Junction - 521105, Andhra Pradesh. Under the Digital Personal Data Protection Act, 2023 ('DPDP Act'), the Clinic acts as a Data Fiduciary — we determine the purpose and means of processing your personal data. This policy explains what data we collect about you (the 'Data Principal'), why we collect it, how long we keep it, the safeguards we apply, and the rights you have under the law. By visiting our clinic, using our website, or submitting an enquiry, you consent to the practices described here.
2. Personal Data We Collect
We collect only the data necessary to provide physiotherapy care and respond to you: • Identity & contact data — name, age, gender, phone number, email address and residential address. • Health data — your medical history, doctor's prescriptions, diagnostic reports (X-ray, MRI, scans), current condition, medications, allergies and treatment notes recorded during physiotherapy sessions. • Appointment data — preferred dates, department chosen, enquiry messages submitted through our website or WhatsApp. • Technical data — when you browse our website, basic information such as pages visited and device/browser type may be collected for site security and performance. We do not collect any data beyond what is needed for the purposes listed below (purpose limitation, s. 4 of the DPDP Act).
3. How We Use Your Data (Purpose Limitation)
Your data is used strictly for: • Providing and managing your physiotherapy assessment, treatment and follow-up care. • Scheduling, confirming and reminding you of appointments (call, SMS or WhatsApp). • Maintaining clinical records as required under applicable medical record-keeping rules. • Responding to enquiries you submit through the website, phone or WhatsApp. • Internal quality improvement, outcome tracking and staff training, in anonymised form wherever possible. • Meeting legal and regulatory obligations applicable to a clinical establishment in India. We do not sell, rent or trade your personal data to any third party for marketing purposes.
4. Consent & Notice (DPDP Act ss. 4–6)
Before or at the time of collecting your data, we give you this notice describing the personal data we seek, the purpose of processing, and your rights. Processing of your data happens only with your consent, or where it is necessary for certain lawful purposes recognised by the DPDP Act — such as providing medical treatment or responding to a medical emergency involving a threat to life. You may withdraw your consent at any time by contacting us; however, withdrawal does not affect processing already completed, and we may be unable to continue treatment where clinical records are essential for your safety.
5. Data of Children & Persons with Disabilities
Where the patient is a child (under 18 years) or a person with a disability or guardianship, we obtain and process their data only with the consent of the parent or lawful guardian, and we process it in a manner that protects the child's wellbeing. Verifiable consent of the guardian is recorded in our clinical records before treatment begins.
6. Data Retention (s. 8(9))
Clinical records are retained for the period prescribed under applicable Indian medical record-keeping norms (typically a minimum of 3 years for adult records, and longer for medico-legal cases, minors — until majority plus the retention period — and statutory requirements). Enquiry data submitted through the website is retained only as long as needed to respond and follow up. Once the retention period expires or the purpose is exhausted, personal data is erased in a secure manner, unless retention is required by law.
7. Security Safeguards (s. 8(5))
We apply reasonable security safeguards to protect your data against breach, unauthorised access, use, modification or disclosure: • Physical records are kept in locked cabinets accessible only to authorised clinic staff. • Digital records and the clinic's administrative systems are password-protected with restricted, role-based access. • Website enquiry data is transmitted over encrypted connections and stored in access-controlled databases. • Staff are trained on confidentiality; access to patient data is limited to the physiotherapist in charge and authorised personnel. Despite our safeguards, no system can be guaranteed as perfectly secure; in the unlikely event of a data breach, we will follow the breach notification process below.
8. Data Sharing & Disclosure
Your data may be shared only in these limited circumstances: • With your referring doctor or a specialist you are referred to, for continuity of care. • With your explicit consent for insurance, medicolegal or employment documentation. • With authorities where disclosure is required by law, court order, or to respond to a medical emergency. • With service providers (e.g., cloud hosting, messaging) strictly under contract to process data only on our instructions. We never share your health data for advertising or to any unrelated third party.
9. Your Rights as a Data Principal (DPDP Act ss. 11–14)
You have the right to: • Access a summary of the personal data we process about you and the processing activities undertaken. • Correct inaccuracies, complete incomplete data, or update your details. • Erasure of your personal data, once the purpose is exhausted and retention is no longer required by law. • Withdraw consent for processing done on the basis of consent. • Nominate another individual to exercise your rights in case of death or incapacity. • Grievance redressal — you may complain to us first; if unresolved, you have the right to approach the Data Protection Board of India. To exercise any right, contact the Grievance Officer below. We will respond within a reasonable period.
10. Breach Notification (s. 8(6))
In the event of a personal data breach, we will without undue delay intimate the affected Data Principals and the Data Protection Board of India, describing the nature of the breach, likely consequences, and remedial action taken or proposed, in the manner prescribed by law.
11. Website & Cookies
Our website may use essential cookies and analytics to keep the site functioning and understand aggregate usage. You can control cookies through your browser settings. Links to third-party platforms (Google Maps, WhatsApp, social media) are provided for your convenience; their privacy practices are governed by their own policies.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in law or our practices. The revised version will be posted on this page with the updated date. Continued use of our services after changes constitutes acceptance of the revised policy.
13. Grievance Officer & Contact
For any privacy concern, data request or grievance: Venkata Ganapathy Physiotherapy Clinic Opposite Dr. Dutta Ramachandra Rao (Rambabu Garu) Hospital, K.S. Talkies Road, Vijayawada Road, Hanuman Junction - 521105, Andhra Pradesh Phone: +91 94418 29648 Email: care@venkataganapathiphysio.com Timings: Monday – Saturday, 9:00 AM – 8:00 PM (Sunday closed) Last updated: August 2026