Privacy Policy

Last updated: 3 October 2026

Vaidhya Homeo Clinic (Vaidhya Homeo) provides online homeopathy consultations with Dr. Jyothirlatha. This policy explains how we handle your personal and health information. It is written to meet our obligations under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the professional confidentiality expected of a registered medical practitioner.

We are the data fiduciary for the information described here. You are the data principal.

1. What we collect

Information you give us when booking

• Your name
• Your phone number (this is also how we reach you on WhatsApp)
• Your email address, if you provide one
• The health concern you select, and anything you write in the message field
• Your preferred consultation date and time

Information collected during care

• Your medical history, symptoms, current medicines, and the details discussed during case-taking
• Reports or documents you choose to share with the doctor
• The prescription and treatment notes resulting from your consultation
• Records of follow-up consultations

Health information is sensitive. We collect only what the doctor needs in order to treat you, and we do not ask for health details in any form or channel that is not part of providing your care.

Information collected automatically

Our website uses Google Analytics to understand which pages are useful, in aggregate. This records page views, approximate region, browser and device type. We do not attach your health information to analytics, and we do not put any health detail in a page address, a link we send you, or a payment description. If you prefer not to be measured at all, an ad or tracker blocker, or Google's Analytics opt-out browser add-on, will prevent it. Google Analytics does not act on your browser's "do not track" setting.

2. Why we use it, and your consent

We use your personal and health information to arrange and provide the consultation you requested, and for nothing else without asking you first. This is subject to the consent you give and to this policy.

3. Messages we send you

We contact you on WhatsApp at the number you booked with. Appointment messages (the doctor's reply to your request, the payment link, the confirmation and your prescription) are sent for the consultation you requested. Some appointment messages, such as the payment link and the booking confirmation, are sent automatically through the WhatsApp Business Platform from the same clinic number; the doctor sends your prescription herself. Marketing messages are sent only if you opted in.

If you gave us an email address, the automatic appointment messages are also emailed to you from appointments@vaidhyahomeo.com, with the same limited contents. Every email has an unsubscribe link: it stops emails only, and WhatsApp messages continue. Replying STOP on WhatsApp stops WhatsApp messages only, and emails continue.

We do not put your health information into the text of a payment link, a payment description, or a message subject. Messages identify your appointment, not your condition.

To stop marketing messages, reply STOP on WhatsApp, or contact us on any channel listed below. To stop appointment messages, cancel the appointment.

4. Who can see your information

• Dr. Jyothirlatha: your full medical record, in order to treat you.
• Our reception staff: only what is needed to schedule your appointment, send your payment link and handle support. Staff cannot read your clinical notes.
• Our payment provider: processes the payment itself. They receive the amount, your name, phone number and (if you gave one) email address, which they use to take the payment and to send you the payment link by SMS and email. They do not receive your health information.
• WhatsApp (Meta Platforms): delivers our messages to you and acts as our data processor for the automatic ones, which reach Meta through our WhatsApp service provider, Gupshup. Meta can see their content. We have asked Meta to store this message data in India, but while delivering a message Meta may still process it on servers outside India. Automatic messages carry only your first name, phone number, appointment date and time, fee and payment link. This is why we keep health detail out of every message.
• ZeptoMail (Zoho Corporation): sends our automatic appointment emails as our data processor, from its data centre in India. It receives your email address, first name, appointment date and time, fee and payment link, never your health information. We do not track whether you open our emails.
• Google Analytics: aggregate website usage only, never linked to your health information.

We do not sell your information, and we do not share it for anyone else's advertising. We disclose it otherwise only where the law requires it.

5. Where your information is stored

Your personal and health information is stored on Google Cloud infrastructure located in India. This is a deliberate choice: patient records stay within Indian jurisdiction. The one exception is the WhatsApp messages described in section 4: they are stored in India, but their limited contents may be processed outside India while Meta delivers them. Your medical record never leaves India. The most sensitive fields, including the doctor's private clinical notes, are additionally encrypted so they cannot be read from the stored data alone.

6. How long we keep it

• Medical records: retained for at least three years from the last consultation, as expected of a registered practitioner.
• Payment records: retained as long as tax and accounting law requires.
• Enquiries that never became a consultation: deleted once the enquiry is closed.

7. Your rights under the DPDP Act

• Access: ask what information we hold about you.
• Correction: have inaccurate or incomplete information fixed.
• Erasure: ask us to delete your information. We will do so unless we are legally required to retain a medical or financial record; where that applies we anonymise what we can and tell you what must be kept and why.
• Withdraw consent: for marketing at any time; for medical processing, noting that withdrawing it means we can no longer provide treatment.
• A copy of your data: request an export of your records.
• Nominate someone: name a person to exercise these rights on your behalf if you are unable to.
• Complain: to us first, and to the Data Protection Board of India if we do not resolve it.

To exercise any of these, contact us on WhatsApp, email. We verify identity before acting on a request about health information, then respond within 30 days.

8. Children

We treat children. Where the patient is under 18, the booking must be made by a parent or legal guardian, who gives consent on the child's behalf. We do not knowingly collect a child's information from anyone else, and we do not send marketing messages about a child.

9. Keeping it secure

Access to patient records requires an authenticated staff account, and what each account can see is limited to its role. Records are transmitted over encrypted connections and the most sensitive fields are encrypted in storage. No system is perfect: if a breach affects your information, we will notify you and the Data Protection Board as the DPDP Act requires.

10. Changes to this policy

If we change how we use your information we will update this page and change the date at the top. A change that materially affects how we use health information will be notified to you directly, and where the law requires it we will ask for your consent again.