How we collect, use, and protect your personal and health data
Last Updated: September 2, 2026 | Effective Date: September 2, 2026
This Privacy Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 14 November 2025, with obligations commencing in stages), the Information Technology Act 2000, and the National Medical Commission Telemedicine Practice Guidelines that govern online consultations in India.
Certain obligations under the DPDP Rules 2025 come into force on a staggered timeline. Where a requirement is not yet in force, we have adopted it voluntarily rather than waiting for the compliance date.
Dr. Anil Prasad Bhatt (NMC Registration #046358) is the Data Fiduciary for all personal data collected through this website (dranilbhatt.com). For data-related inquiries, contact:
Under Section 13 of the DPDP Act 2023, the person responsible for answering questions about how your data is processed, and for resolving complaints, is Dr. Anil Prasad Bhatt, reachable at nephrology.ckdr@gmail.com or +91 98181 83957. Grievances are acknowledged within 72 hours and resolved within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.
When you book an appointment, use our contact form, or subscribe to our newsletter, we may collect: full name, email address, phone number, age, gender, and city of residence.
If you use our online tools (NephroAI calculators, CKD Trend Estimator, Kidney Health Quiz, Diet Planner, Report Reader, medication and electrolyte checkers), we may process health-related inputs such as symptom descriptions, lab values (creatinine, eGFR, urine reports), dietary preferences, and medication lists.
These values are processed entirely in your browser. They are not transmitted to our server, not written to any database, and are cleared when you close the tab. Files you select in the Report Reader are read in the browser and are never uploaded. Three qualifications you should know:
When you submit an appointment or contact form, the details in that form are transmitted to and stored on our server so the clinic can respond to you, and are handled as described in Sections 3 and 7.
We automatically collect: IP address (anonymised), browser type, device type, pages visited, time spent, and referral source via Google Analytics (GA4).
| Purpose | Legal Basis (DPDP Act) |
|---|---|
| Appointment booking | Consent (Section 6) |
| Patient communication | Legitimate use for medical services |
| Newsletter delivery | Consent (Section 6) |
| Analytics & improvement | Legitimate use |
| Legal compliance | Legal obligation |
We use the following cookies:
We do not use advertising cookies, retargeting pixels, or social-media trackers. No Meta/Facebook pixel and no session-recording tool runs on this website. You can decline analytics cookies via the cookie banner shown on your first visit.
Clinical records created during in-person consultations at Max Hospital or Holy Family Hospital are governed by the respective hospital's privacy policies and the Indian Medical Council regulations. This website does not store clinical records, prescriptions, or diagnostic reports. Any health information shared via WhatsApp or the contact form is used solely for appointment scheduling and preliminary assessment.
Contact form submissions and appointment requests are retained for 12 months from the date of submission. Newsletter subscriber data is retained until you unsubscribe. Analytics data is retained for 14 months as per GA4 default settings. You may request earlier deletion at any time.
Request a summary of personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data, subject to legal retention requirements.
Withdraw consent at any time by emailing the Grievance Officer with the word "WITHDRAW", or unsubscribing via any newsletter footer. Withdrawal is actioned within 7 days and does not affect prior lawful processing.
We implement industry-standard security measures including HTTPS/TLS encryption for all data in transit, secure hosting infrastructure, access controls limiting data access to authorised personnel only, and regular security reviews. Despite these measures, no method of electronic transmission is 100% secure, and we cannot guarantee absolute security.
Section 9 of the DPDP Act 2023 requires verifiable parental consent before processing the personal data of anyone under 18, and prohibits behavioural advertising and tracking directed at children.
Dr. Bhatt treats paediatric kidney disease, so parents and guardians do legitimately contact us about children. Where an appointment request concerns a patient under 18, the form must be completed by the parent or legal guardian, whose own name and contact details we record as the consenting adult. We do not accept appointment requests, newsletter sign-ups or chat enquiries submitted by a child directly.
We run no behavioural advertising or tracking of any kind, so the Section 9(3) prohibition is met by design. If you believe a child has submitted personal data to this website without a guardian, contact the Grievance Officer and it will be deleted.
In the event of a personal data breach, we will notify each affected person without delay, describing the nature of the breach, its likely consequences and the steps we are taking, and will report the breach to the Data Protection Board of India within the timelines set by the DPDP Rules 2025.
Appointment and contact form submissions are stored on servers located in India. We do not sell personal data, and we do not transfer it outside India except to the extent that the third-party services listed in Section 6 (Google, Tidio, Cloudflare) process technical data on their own global infrastructure under their own privacy policies.
Online consultations are conducted in line with the National Medical Commission's Telemedicine Practice Guidelines. Dr. Bhatt identifies himself and confirms your identity at the start of every consultation, records your explicit consent to consult remotely, and will decline to proceed by video and ask you to attend in person wherever a physical examination is necessary for safe care. Reports you share over WhatsApp for a teleconsultation are held in that chat and used solely for your clinical care.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of the website after changes constitutes acceptance of the revised policy.
For any privacy-related inquiries, data access requests, or to exercise your rights under the DPDP Act 2023, please contact us:
We will respond to all data requests within 30 days.