Privacy Policy

1. Introduction

This Privacy Policy and Terms of Use ("Policy") governs all interactions between users ("you", "User") and the digital platforms, websites, mobile applications, online consultations, health programmes, and related services operated by or under the authority of Dr. Kunal Sarkar ("Dr. Sarkar", "we", "us", "our"). By accessing or using any service offered by Dr. Kunal Sarkar, you unconditionally agree to be bound by this Policy in its entirety.

This Policy is published in accordance with Rule 3(1) of the Information Technology (Intermediaries Guidelines) Rules, 2011, Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the provisions of the Digital Personal Data Protection Act, 2023 ("DPDPA"). It constitutes a legally binding agreement under the Indian Contract Act, 1872.

2. Identity of Data Fiduciary / Controller

For the purposes of the DPDPA, 2023 and the SPDI Rules, Dr. Kunal Sarkar (hereinafter "Data Fiduciary") is the individual responsible for the collection, processing, storage, and use of all personal data submitted by Users. Dr. Sarkar operates as a licensed medical practitioner and health educator, and all data processing activities are carried out in the lawful exercise of his professional functions.

3. Information We Collect

We may collect the following categories of data, classified as per the SPDI Rules and DPDPA:

• Personal Data: Name, email address, residential/billing address, phone number, date of birth, gender, and payment information when you register, purchase, or subscribe to our services.
• Sensitive Personal Data or Information (SPDI): Health records, medical history, symptoms, diagnostic reports, lifestyle information, or any other health-related information you voluntarily provide in consultations, questionnaires, or health programmes. Collection of SPDI is governed strictly under Rule 3 of the SPDI Rules and requires your explicit written consent.
• Automatically Collected Data: IP address, browser type, device identifiers, cookies, usage data, and browsing behaviour collected through cookies and similar technologies under the IT Act, 2000 and applicable rules.
• Aggregated / Anonymised Data: Non-identifiable, aggregated statistics for research, analytics, and public health education purposes.

4. Purpose of Processing and Legal Basis

We process your data for the following purposes and rely on the following legal bases under Indian law:

• Contractual Necessity: To process appointments, manage billing, deliver health programmes, and provide customer support (Indian Contract Act, 1872; Consumer Protection Act, 2019).
• Consent: To send newsletters, promotional communications, health tips, and to collect and use SPDI for research or educational purposes. Consent is obtained explicitly and may be withdrawn at any time without affecting prior lawful processing (DPDPA, 2023; SPDI Rules, 2011).
• Legal Obligation: To comply with applicable Indian laws, court orders, or directions from regulatory/government authorities, including the Indian Medical Council Act, 1956, and directions of the Medical Council of India.
• Legitimate Interest: To operate, secure, and improve our services, prevent fraud, and protect the rights of Dr. Sarkar and his practice, where such interest is not overridden by your fundamental rights under Article 21 of the Constitution of India.
• Public Health / Medical Research: Anonymised data may be used for public health education and research publications. Your identity shall never be disclosed without your explicit consent.

5. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal data to any third party. Your information may be shared only with:

• Authorised service providers (e.g., payment gateways, cloud hosting providers, email marketing platforms) who are bound by contractual data processing agreements and are prohibited from using your data for any purpose other than providing the contracted service.
• Referring doctors or medical professionals, only with your prior written consent and strictly for your medical benefit.
• Law enforcement, courts, or government authorities, when required by a court order, statutory duty, or directive under applicable Indian law, including the IT Act, 2000.

All third-party data processors are required to maintain confidentiality and implement security standards no less stringent than those required by the SPDI Rules and DPDPA.

6. Data Localisation and Cross-Border Transfers

In compliance with applicable provisions of the DPDPA, 2023, personal data of Indian residents shall primarily be stored on servers located within India. Any cross-border transfer of personal data shall be carried out only to countries or entities notified by the Central Government under Section 16 of the DPDPA or where adequate safeguards have been established by way of Standard Contractual Clauses or equivalent protections. SPDI shall not be transferred outside India without your prior written consent, in accordance with Rule 7 of the SPDI Rules.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to enhance your experience on our platforms. These technologies are used to recognize returning visitors, personalise content, and analyze traffic patterns. You may manage or disable cookies through your browser settings; however, doing so may impact certain features of our services. Our use of cookies is governed by the IT Act, 2000, and applicable regulations.

8. Health Survey and Research Data

If you voluntarily provide health information through a questionnaire, programme, or survey administered by Dr. Sarkar, such information may be used for:

• Clinical and public health research, including potential publication in peer-reviewed or scientific journals — in fully anonymised, aggregate form only.
• Educational and marketing content demonstrating programme outcomes, using only non-identifiable aggregate data.
• Personalised outreach, such as follow-up recommendations or programme offers, only where your separate, explicit consent has been obtained.

Your identity and personal details shall never be disclosed, published, or marketed in any identifiable form without your explicit written consent. Consent for research use shall be obtained in a separate, specific consent form at the time of data collection, in compliance with the SPDI Rules and the Indian Council of Medical Research (ICMR) Ethical Guidelines.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable Indian law, whichever is longer. Medical records shall be retained in accordance with the guidelines issued by the Medical Council of India. Upon expiry of the applicable retention period, data shall be securely deleted, anonymised, or destroyed.

10. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, and other applicable Indian laws, you have the following rights:

• Right to Access: To obtain confirmation of and access to your personal data held by us.
• Right to Correction and Erasure: To request correction of inaccurate or incomplete data, and erasure of data no longer necessary for the original purpose.
• Right to Grievance Redressal: To have grievances addressed within a reasonable period, and to escalate unresolved complaints to the Data Protection Board of India under the DPDPA.
• Right to Withdraw Consent: To withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before withdrawal.
• Right to Nominate: To nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of the above rights, please contact our Grievance Officer at the details provided in Section 2.

11. Children's Privacy

Our services are not directed to children below the age of 18 years. We do not knowingly collect personal data from minors without verifiable parental or guardian consent. If we become aware that personal data of a minor has been collected without proper consent, we shall take immediate steps to delete such data. This is in accordance with Section 9 of the DPDPA, 2023.

12. Data Security

We implement reasonable technical, administrative, and physical security measures to protect your personal data from unauthorised access, disclosure, alteration, misuse, or destruction, in compliance with Rule 8 of the SPDI Rules. These measures include, but are not limited to, encryption, access controls, and regular security audits.

Notwithstanding the above, no transmission or storage system can guarantee absolute security. Users are advised to maintain the confidentiality of their login credentials and to inform us immediately in the event of any suspected unauthorised use of their account.

13. Medical Disclaimer and Limitation of Liability

14. Intellectual Property Rights

All content on Dr. Sarkar's platforms, including text, images, videos, logos, programme materials, and data compilations, are the exclusive intellectual property of Dr. Kunal Sarkar and are protected under the Copyright Act, 1957, the Trade Marks Act, 1999, and other applicable Indian intellectual property laws. Unauthorised reproduction, distribution, modification, or commercial use is strictly prohibited and may attract civil and criminal liability under Indian law.

15. Governing Law and Dispute Resolution

This Policy is governed by the laws of the Republic of India. Any dispute arising out of or in connection with this Policy shall first be attempted to be resolved by mediation. If mediation fails within 30 days, the dispute shall be referred to arbitration under the Arbitration and Conciliation Act, 1996, with proceedings conducted in the English language in [Insert City], India. The courts of [Insert City], India shall have exclusive jurisdiction for any matters not subject to arbitration.

16. Amendments to This Policy

We reserve the right to update or modify this Policy at any time. All material changes shall be notified to registered users via email or a prominent notice on our platforms, with a revised "Effective Date". Continued use of our services following such notice shall constitute your acceptance of the updated Policy.

17. Grievance Redressal Mechanism

In accordance with Rule 5(9) of the SPDI Rules and Section 13 of the DPDPA, 2023, any grievance or complaint regarding the collection, use, or processing of your personal data may be directed to our designated Grievance Officer at the contact details in Section 2. We shall acknowledge your complaint within 72 hours and endeavour to resolve it within 30 days of receipt. If your grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India.