Privacy Policy

This policy explains how Hem Homoeopathic Clinic — operating from 7/ Gayatri Complex, Station Road, Nr. Patel Medical, Bardoli 394601, India — handles personal information collected through this website (Hem Homoeopathic Clinic) and through the course of treatment at the clinic. In the language of India's Digital Personal Data Protection Act, 2023, the clinic is the Data Fiduciary for this information and you are the Data Principal.

Hem Homoeopathic Clinic respects patient medical confidentiality. All patient diagnostic records, case histories, and prescriptions are stored securely and never disclosed to third parties without explicit written consent.

We collect only what is needed to treat you and to reply to you:

• Appointment requests — name, phone number, email address (optional), preferred date, the doctor you asked for, and the health concern you describe in your own words.
• Enquiries — name, phone, email, subject and message submitted through the contact form.
• Clinical records — case history, symptoms, constitutional assessment, prescriptions, follow-up notes and any reports you share with us during consultation. This is sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is treated accordingly.
• Browser notification subscriptions — if you accept the notification prompt, your browser gives us an anonymous push endpoint and encryption keys. It contains no name, phone or email.
• Server logs — standard web-server records (IP address, page requested, timestamp, browser user-agent) kept for security, abuse prevention and rate limiting.

We do not ask for, and you should never send us, payment card numbers, UPI PINs, passwords or Aadhaar details through the website forms, email or WhatsApp.

• To schedule, confirm, reschedule and remind you of appointments.
• To take your case, prescribe, and track how you respond over the course of treatment — homoeopathic prescribing depends on a longitudinal record, so history matters more here than in a one-off transaction.
• To answer enquiries you send us by form, phone or WhatsApp.
• To send appointment-related messages by email, WhatsApp or browser notification where you have opted in.
• To keep the site secure — detecting spam submissions and blocking abusive traffic.

We do not sell your data, we do not rent our patient list, and we do not use your health information for advertising or profiling.

We process your information on the basis of your consent — given when you submit a form, book an appointment or attend a consultation — and, where applicable, for the legitimate uses permitted under the Digital Personal Data Protection Act, 2023, including providing the medical treatment you have asked for and complying with record-keeping obligations that apply to clinical establishments.

You can withdraw consent at any time by writing to us. Withdrawing consent does not affect processing already carried out, and it may mean we can no longer offer continuity of treatment, since prescribing without access to your case history is not clinically safe.

Case records are accessible only to the treating physicians and to clinic staff who need them to run appointments and dispensing. Staff accounts on our admin system are individually credentialed and role-limited; there are no shared logins.

We retain clinical records for at least three years from your last consultation, in keeping with standard clinical record-keeping practice for establishments in India, and usually longer where a chronic case may be reopened. Website enquiries and appointment requests that do not lead to treatment are retained only as long as needed to follow up, and are then deleted or anonymised.

We will disclose records without your consent only where the law compels it — for example, a court order, a statutory notice, or a legally mandated public-health report.

The clinic runs its own website and database. A small number of outside services are involved, and each one is listed here:

• Web hosting and email delivery — our hosting provider stores the site and database, and an SMTP mail service delivers appointment and enquiry notifications.
• WhatsApp (Meta)— when you tap a WhatsApp button we open a conversation with the clinic's business number. Everything you send there is also handled under WhatsApp's own privacy terms.
• Google Maps — the map on our contact page is embedded from Google and loads only when that page is opened. Google may set its own cookies through that embed.
• Google Calendar links— “add to calendar” links simply pre-fill an event in your own Google account. We do not read your calendar.
• Instagram— clinic posts shown on the site are fetched from Instagram and the images are served from Meta's content network.

We do not run advertising pixels, remarketing tags or third-party analytics trackers on this website.

The public pages of this site set no advertising or analytics cookies. The only storage we use in your browser is:

• a small local flag remembering that you dismissed the app-install or notification prompt, so we do not nag you again;
• a session cookie for clinic staff who log into the administration panel — it is never set for ordinary visitors.

Third-party embeds described above (Google Maps, Instagram media) may set their own cookies when those elements load. Clearing your browser data removes all of this.

Browser notifications are strictly opt-in. If you accept, we store the push endpoint your browser generates so we can send clinic updates and appointment reminders. You can revoke this at any time from your browser's site settings, or by using the notification toggle on the site; the stored endpoint is deleted when you do, and endpoints that stop working are pruned automatically.

WhatsApp and SMS messages we send relate to your appointment or your enquiry. Tell us if you would rather be contacted only by phone call and we will note that on your record.

Data is transmitted over encrypted HTTPS connections. Administrative access requires a password meeting enforced strength rules, plus per-account session control; passwords are stored only as salted hashes and are never recoverable in plain text. Password-reset links are single-use and short-lived. Uploads are validated by file type and size, and the forms are rate limited to blunt automated abuse.

No system is perfectly secure. If a breach ever affects your personal data we will notify you and the Data Protection Board of India as required under the DPDP Act, 2023.

Under the DPDP Act, 2023 you may ask us to:

• confirm what personal data of yours we hold, and why;
• correct anything inaccurate, incomplete or out of date;
• erase data that is no longer needed — subject to the record-keeping periods described above, which we cannot waive;
• nominate someone to exercise these rights on your behalf if you are unable to;
• raise a grievance about how we have handled your data.

Write to the Grievance Officer at care@hemclinic.com or at the clinic address. Please include enough detail for us to identify your records. We will acknowledge your request and respond within a reasonable period; identity verification may be required before we release medical records.

We treat children and adolescents at the clinic. Information about a patient under 18 is provided by, and shared with, a parent or legal guardian, and is used only to deliver care. We do not knowingly collect data from a child through the website without a guardian acting on their behalf, and we do not use children's data for any form of tracking or targeted messaging.

We may revise this policy as our services or the law change. The revision date at the top of this page always reflects the current version. Material changes affecting how we use patient data will be highlighted on the website.