Privacy Policy
Last updated 1 August 2026 · Effective 1 August 2026
This policy explains what personal data Sri Chakra Eye Clinic collects through this website and in the course of providing eye care, why we collect it, who we share it with, and the rights you have over it.
Please have this reviewed. This policy was drafted to reflect how this website actually behaves, and it names the specific obligations that apply to a healthcare provider in India. It is not legal advice. Because the Clinic handles health data — which is treated as sensitive under both Indian and EU law — a qualified data-protection practitioner should review it before you rely on it.
1. Who we are
Sri Chakra Eye Clinic is an ophthalmology clinic in Anantapur, Andhra Pradesh, India. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary; under the EU General Data Protection Regulation we are the Controller. This means we decide why and how your personal data is used, and we are accountable for it.
Sri Chakra Eye Clinic (the “Clinic”, “we”, “us”)
Near Riya Hospital, Sapthagiri Circle, Anantapur, Andhra Pradesh 515001, India
Phone: +91 75690 46893
Email: srichakraeye@gmail.com
2. Which laws apply
We handle personal data in line with:
- The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. This is the primary law that applies to us, because we operate in India and serve patients in India.
- The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which treat medical records and health condition as sensitive personal data.
- The EU General Data Protection Regulation (GDPR), but only where it actually applies to us — that is, in relation to visitors in the EU or EEA whose personal data we process through this website. We do not target or market to people in the EU, and we do not monitor their behaviour beyond the optional website analytics described below.
- Applicable medical-record and clinical-establishment requirements governing how long patient records must be retained and who may access them.
3. What we collect
a. If you only browse this website
- Nothing that identifies you, unless you allow it. With no action from you, we store a single record of your cookie choice on your own device. We do not run analytics, advertising, profiling or behavioural tracking without your consent.
- If you allow Analytics: Google Analytics collects your approximate location (derived from a shortened IP address), device and browser type, the pages you view, and how you arrived at the site. We have enabled IP anonymisation. We do not attempt to identify you from this, and it is never combined with any medical record.
- If you allow Embedded media: Google Maps and YouTube receive your IP address and may set their own cookies when their content loads. We use YouTube’s privacy-enhanced (
youtube-nocookie.com) domain to limit this. - Server logs. Our hosting provider records standard request logs, including IP address, for security and abuse prevention. This is necessary to operate the site safely and does not depend on your cookie choice.
b. If you contact us or book an appointment
- Your name, phone number, email address, and anything you choose to tell us about your symptoms or reason for visiting.
- Appointment bookings made through the online booking link are handled by Google Calendar Appointment Scheduling. What you enter there is submitted to Google as well as to us.
- Messages you send by WhatsApp are delivered through WhatsApp (Meta). We can read the message content; WhatsApp handles the transmission. Please do not send detailed medical information or images of reports over WhatsApp.
c. If you become a patient
- Identity and contact details, age and sex, and where relevant an identity or insurance reference.
- Clinical information: history, examination findings, refraction and vision measurements, intraocular pressure, imaging and scans, diagnoses, prescriptions, surgical and procedure notes, and follow-up records.
- Payment and billing records.
Clinical records are created and stored as part of providing care. They are not collected through this website and are not linked to website analytics in any way.
4. Why we use it, and our legal basis
| Purpose | Basis under the DPDP Act | Basis under the GDPR |
|---|---|---|
| Providing eye examinations, diagnosis, treatment and surgery | Consent, and the legitimate use of providing a service you have requested | Art. 6(1)(b) contract; Art. 9(2)(h) provision of health care |
| Keeping medical records as required of a clinical establishment | Legitimate use — compliance with law | Art. 6(1)(c) legal obligation; Art. 9(2)(h) |
| Responding to your calls, emails and WhatsApp messages | Consent | Art. 6(1)(a) consent / Art. 6(1)(b) |
| Appointment booking and reminders | Consent | Art. 6(1)(b) contract |
| Website analytics | Consent — you may refuse and withdraw at any time | Art. 6(1)(a) consent |
| Loading maps and videos on this site | Consent | Art. 6(1)(a) consent |
| Site security, fraud and abuse prevention | Legitimate use | Art. 6(1)(f) legitimate interests |
| Billing, accounting and tax | Legitimate use — compliance with law | Art. 6(1)(c) legal obligation |
We do not sell personal data. We do not run advertising, remarketing or audience targeting, and we do not use your data to build a commercial profile of you.
5. Cookies and similar technologies
This site sets no analytics or media storage until you choose. The full inventory — what is stored, by whom, for how long — is in our Cookie Policy.
6. Who we share data with
We share personal data only where it is necessary, and only with:
- Google LLC — Analytics (only with your consent), Maps and YouTube (only with your consent), and Google Calendar for appointment booking.
- Meta Platforms — only if you choose to message us on WhatsApp.
- Our hosting provider, which serves this website and keeps security logs.
- Doctors, hospitals, laboratories or imaging centres to whom we refer you, or from whom we receive a referral, where this is needed for your care.
- Courts, regulators, or public authorities where we are legally required to disclose.
We do not give your medical information to insurers, employers, marketers or data brokers without your explicit instruction.
7. Where your data goes
Clinical records are held in India. Some website service providers listed above are based outside India and may process data on servers in other countries, including the United States. Where the GDPR applies to a transfer out of the EEA, that transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision. Under the DPDP Act, transfers are made only to countries not restricted by the Central Government.
8. How long we keep it
| Data | Retention |
|---|---|
| Your cookie choice | 12 months, then we ask again |
| Google Analytics data | As configured in Google Analytics, and only if you consented |
| Enquiries by email or WhatsApp | Up to 2 years, unless it becomes part of a medical record |
| Medical records | For the minimum period required of a clinical establishment, and longer where a case is ongoing, disputed, or subject to legal proceedings |
| Billing and tax records | As required by Indian tax law |
| Server security logs | Short-term, as set by our hosting provider |
When a retention period ends, we delete the data or irreversibly anonymise it.
9. How we protect it
This website is served over HTTPS. Access to clinical records is limited to the treating doctor and authorised clinic staff, each with their own credentials. We apply reasonable security safeguards as required by the DPDP Act and the SPDI Rules. No system is perfectly secure; if a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.
10. Your rights
As a Data Principal under the DPDP Act, 2023
- Access — a summary of the personal data we hold about you and how it is being processed.
- Correction, completion and updating — to have inaccurate or incomplete data put right.
- Erasure — to have your data deleted, except where we must keep it to comply with the law. Medical records generally cannot be erased on request during their mandatory retention period.
- Withdraw consent — as easily as you gave it. Withdrawal does not affect processing already carried out.
- Nominate — to appoint another person to exercise your rights on your behalf in the event of your death or incapacity.
- Grievance redressal — to complain to us first, and then to the Data Protection Board of India if you are not satisfied.
Additionally, if the GDPR applies to you
- Access, rectification, and erasure.
- Restriction of processing, and objection to processing based on legitimate interests.
- Data portability, for data you gave us that we process by consent or contract.
- To lodge a complaint with your national supervisory authority.
To exercise any of these, contact us using the details above. We will verify your identity before acting — this matters especially for medical records — and will respond within the time the applicable law allows. There is no charge unless a request is manifestly excessive or repetitive.
11. Children’s data
We provide pediatric eye care, so we handle children’s data with particular care.
- For a patient under 18, we obtain verifiable consent from a parent or lawful guardian before processing their personal data, as the DPDP Act requires.
- We do not carry out behavioural tracking or targeted advertising directed at children, and we do not run advertising at all.
- We do not knowingly collect data from a child through this website. If you believe a child has given us personal data without parental consent, contact us and we will delete it.
12. Grievance redressal and complaints
If you have a concern about how we handle your personal data, please raise it with our Grievance Officer first. We take every complaint seriously and will respond within the period prescribed under the DPDP Act.
Grievance Officer
Name: Dr. Eswar Sakare, MBBS, DNB (Ophthalmology) — Consultant Ophthalmologist and proprietor of Sri Chakra Eye Clinic
Email: srichakraeye@gmail.com
Phone: +91 75690 46893
Post: Sri Chakra Eye Clinic, Near Riya Hospital, Sapthagiri Circle, Anantapur, Andhra Pradesh 515001
If we do not resolve your grievance to your satisfaction, you may complain to the Data Protection Board of India. If the GDPR applies to you, you may instead complain to the supervisory authority in your country.
13. Changes to this policy
If we change how we use personal data, we will update this page and change the “last updated” date. Where a change affects what you previously consented to, we will ask you again rather than assume your earlier choice still stands.