This policy explains what personal data Ehsaas – Centre for Comprehensive Psychiatric Care collects through this website, why we collect it, how long we keep it and what rights you have over it. It is written to meet India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Who we are
Ehsaas – Centre for Comprehensive Psychiatric Care is a psychiatric clinic in Chittaranjan Park, New Delhi, led by Dr. Manish Sarkar. For the purposes of the DPDP Act we are the Data Fiduciary for the data described below, and you are the Data Principal.
What we collect
Through the appointment and enquiry forms on this site we collect only:
- Your name, so we know who to address.
- Your mobile number, so we can call you back.
- Your message, if you choose to write one.
We do not ask for your email address, date of birth, address or payment details on this website. Please do not send details of your diagnosis, medication or medical history through the website form — share them with the doctor during your consultation instead.
With a form submission we also record the page you submitted it from, the page you first arrived on, the website that referred you and any campaign details in the link you followed. This tells us which of our pages and campaigns are useful. It is not used to build a profile of you.
Our web server keeps standard access logs, which include IP addresses, for security and troubleshooting.
Medical records are separate
Anything recorded during a consultation or treatment at the clinic is a medical record. It is held in the clinic’s own records, not on this website, and is protected by medical confidentiality and the record-keeping rules that apply to registered medical practitioners in India.
Why we use it, and on what basis
We use what you send us to reply to your enquiry, to arrange or confirm an appointment and to keep an internal record of that request. We rely on the consent you give when you tick the consent box and submit the form, and that consent covers being contacted about your enquiry.
We do not sell or rent your data, and we do not use it to send you marketing unrelated to your enquiry.
Cookies and third-party services
This site sets one first-party cookie that remembers how you first reached us, so that a later visit does not overwrite the original source of your enquiry. It expires after 90 days and holds no name, number or health information.
If the clinic uses analytics or advertising measurement, those services set their own cookies only after you accept them in the cookie notice. YouTube videos and Google Maps are not loaded until you press play or ask to see the map, so they set no cookies unless you choose to open them. Contacting us on WhatsApp is governed by WhatsApp’s own privacy policy.
Who else sees your data
Only the clinic staff who handle appointments, and the providers who run our website hosting, email and spam protection on our instructions. Those providers act as Data Processors and may not use your data for their own purposes. We disclose data beyond that only where the law requires it.
How long we keep it
Website enquiries are kept for up to three years from your last contact with us and are then deleted. Server logs are kept for a short operational period. Medical records are kept for the longer period the law requires of a clinic.
Your rights
Under the DPDP Act you may ask us to:
- confirm what personal data of yours we hold and how it is used;
- correct or complete anything inaccurate or out of date;
- erase data we no longer need for the purpose you gave it for;
- withdraw your consent, which stops any further processing that relied on it;
- nominate another person to exercise these rights if you are unable to.
Withdrawing consent does not undo anything done while it was valid, and it does not affect records we must keep by law.
Keeping it safe
Enquiries are sent over an encrypted connection and stored in a database that only authorised staff can reach, and the site’s administration area is password protected. If a breach ever affects your data we will inform you and the Data Protection Board of India as the DPDP Act requires.
Children
Anyone under 18 is treated as a child under the DPDP Act. Please do not submit an enquiry about a child without the consent of a parent or legal guardian. We do not use a child’s data for tracking or targeted advertising.
Contact and grievances
To exercise any of these rights, or to raise a concern about how your data has been handled, contact the clinic by phone or email using the details on our contact page. We will acknowledge your request and respond within the time the DPDP Act allows. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Changes to this policy
If we change how we handle personal data we will update this page and its “last updated” date.