Privacy notice
Version 2026-10-22 · Applies to this website, our clinic in New Delhi (and our earlier Bengaluru clinic), online consultations and WhatsApp communication. हिंदी में पढ़ें
1. Who is responsible for your data
Tailbone Treatment Clinic (Dr Rajveer Singh) is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP) and the controller under the EU General Data Protection Regulation (GDPR) for patients covered by it.
Grievance & privacy contact: Dr Rajveer Singh · contact@tailbonetreatment.com · +91 98866 88323. We reply to privacy requests and grievances within 30 days.
2. What we collect
- Identity & contact: name, phone/WhatsApp number, optional email.
- Messages: what you tell us when you call, WhatsApp or email the clinic.
- Booking details: clinic, date and time, appointment number and patient ID, preference for a female clinician.
- Appointment details: the clinic or online consultation, date and time, and whether you would prefer to see the female doctor.
- Health information you share (sensitive data): symptoms, pain scores, check-in answers, and the clinician's notes.
- Health information you share (sensitive data): your symptoms and the clinician's notes from your visits.
- Payment records: amount, status and Razorpay reference. We never receive card, UPI or bank details.
- Payment records: the amount, date and how you paid (cash, UPI or card at the clinic, or UPI for an online consultation).
- Stories you choose to submit, with your consent to publish.
- Optional details about you, if you give them: age, gender, city, kind of work, hours of sitting, how long you've had pain, and how you heard about us.
- How you found us: the name of the ad campaign or link you arrived by (for example "Google Ads" or a link we shared on Instagram) and the first page you opened, stored with your booking.
- Referrals: the referral ID you entered when booking, and who it belongs to. If you join our referral programme (as a patient or a partner): your name or organisation, mobile number, optional email and city, a password (stored scrambled), the UPI ID or bank details you give us for rewards, and the rewards and payments.
- Treatment at your place: if you ask the specialist to travel to you, your city, dates, the number of patients and anything you tell us to plan the visit.
- Technical data: standard server logs (IP address, time, page) kept for security. We use no tracking cookies unless you accept them (see Cookies). The only items stored in your browser are your light/dark theme choice, the name of the ad or link you arrived by (until you close the tab), a referral ID from a referral link (for 30 days, so the booking form can fill it in), and sign-in cookies for clinic staff and referral partners.
- Technical data: standard server logs (IP address, time, page) kept for security. We use no tracking cookies unless you accept them (see Cookies). Your browser stores only your light/dark theme choice, your cookie choice, and the name of the ad or link you arrived by (until you close the tab), plus sign-in cookies for clinic staff.
3. Why we use it, and the legal basis
| Purpose | DPDP basis | GDPR basis |
|---|---|---|
| Replying to your calls, WhatsApp messages and emails, and confirming your appointment | Consent, given when you contact us | Consent and steps before a contract (Art. 6(1)(a), (b)) |
| Book, provide and follow up your treatment; keep clinical records | Consent (s.6), given when you book | Explicit consent (Art. 6(1)(a), 9(2)(a)); provision of health care (Art. 9(2)(h)) |
| Appointment confirmations, changes and reminders on WhatsApp | Consent (optional; withdraw any time) | Consent (Art. 6(1)(a)) |
| Payments and refunds; tax and accounting records | Legitimate use: compliance with law (s.7) | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Publishing your story | Consent (separate, optional) | Consent (Art. 6(1)(a)) |
| Optional details about you: to prepare for your visits, and, in totals only (never by name), to understand which patients we reach and which ads and links work | Consent (optional; leave blank or clear any time) | Consent (Art. 6(1)(a)) |
| Referral programme: thanking the person or organisation who referred you, by showing them your initials and how many visits you've had | Consent, given when you enter their referral ID | Consent (Art. 6(1)(a)) |
| Running the partner programme and paying rewards | Consent, and legitimate use to keep tax records (s.7) | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Planning a visit to treat you at your place | Consent, given with your request | Consent and steps before a contract (Art. 6(1)(a), (b)) |
| Keeping the service secure (logs, fraud prevention) | Legitimate use (s.7) | Legitimate interests (Art. 6(1)(f)) |
We do not sell your data, send your personal details to advertisers, or make automated decisions about you. Ad reports in our dashboard are totals only. Treatment is not conditional on optional consents.
4. Who we share it with
Only service providers (Data Processors) who help us run the clinic, under contracts that require them to protect it:
- Hosting: Netlify (website) and our application host (Render), which stores the encrypted database.
- Hosting: Netlify, which serves the website. No patient records are stored on the website.
- Supabase: the website text the clinic changes in its dashboard, and the clinic staff's sign-ins.
- Razorpay: payments and refunds.
- Meta (WhatsApp): messages you have agreed to receive.
- Meta (WhatsApp): when you message us on WhatsApp.
- Email provider (Resend): notifications to the clinic, if enabled.
- Google Maps and Instagram: load only when you open a map or tap a video.
- Google Ads and Google Analytics: only if you accept cookies (see Cookies).
- YouTube, Vimeo and Instagram videos in articles load from those sites when you open the article (YouTube in its privacy-enhanced mode).
Referral partners: if you booked with someone's referral ID, that person or organisation can see your initials, when you were referred, how many visits you've had and the reward for each. Never your name, contact details or anything about your health.
Cookies and ad measurement
Our website works without tracking cookies. If you choose Accept on the cookie banner, we load Google Analytics and Google Ads to learn which of our ads and pages help people find us, for example how many people contacted us after seeing an ad. Google receives your device and browsing information on our site and the fact that a WhatsApp, phone or email tap or a booking happened, with the appointment number. We never send your name, phone number, email or anything about your health. If you choose No thanks, nothing is loaded. You can change your choice at any time with Cookie choices at the bottom of every page.
International transfers: some providers process data outside India (for example in Singapore, the EU or the USA). DPDP permits this except to countries the Government restricts. For EU patients we rely on the providers' Standard Contractual Clauses. We may also disclose data where the law requires it.
5. How long we keep it
- Patient and clinical records: 3 years after your last visit, then automatically erased.
- Payment and invoice records: kept de-identified for as long as tax law requires (up to 8 years).
- Message history: text cleared after 1 year.
- Security logs: at least 1 year, at most 2 years.
- Encrypted backups: rotated every 14 days.
6. How we protect it
We use:
- HTTPS everywhere
- AES-256 encryption of clinical notes and symptoms in the database, and of all backups
- individual staff accounts with two-factor sign-in and automatic sign-out
- account lockout after failed sign-ins
- a log of who viewed or exported records
- two-step sign-in for the clinic's website dashboard, and a log of every change made in it
- no patient records on the website: they are kept at the clinic
- strict browser security policies
- daily encrypted backups
If a breach happens, we will inform affected patients and the Data Protection Board of India without delay. Where the GDPR applies, we will also notify the competent EU authority within 72 hours.
7. Your rights
- Access a summary or copy of your data. Request it from My appointments (ready to download within 7 days), or ask us.Ask us by email or WhatsApp; we reply within 7 days.
- Correction of inaccurate or incomplete data. Request it from My appointments; it is, done within 7 days.
- Erasure of data we no longer need (request it from My appointments; done within 7 days once you have no upcoming appointment). Records the law makes us keep, such as payment records, are de-identified instead.
- Withdraw consent at any time; this doesn't affect processing already done. WhatsApp updates can be switched off on the My appointments page.
- Grievance redressal through our contact above. If you're not satisfied, you may complain to the Data Protection Board of India, or to your EU supervisory authority.
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP s.14).
- GDPR only: data portability, restriction and objection.
8. Make a request
We may contact you to verify your identity before acting. You'll receive a reference number and an answer within 30 days.
Email contact@tailbonetreatment.com or WhatsApp +91 98866 88323 with what you would like (a copy, a correction, deletion, withdrawing consent or a complaint), your name and the phone number you used with us.
9. Changes
If we change this notice, we'll update the version date above. For material changes, we'll ask for your consent again where the law requires it.