Patient Data Privacy Policy

At Ortho Care India, under the clinical leadership of Dr. Brejesh Kumar Prasad (MS Ortho, ISAKOS Sports Injury Fellow, Haryana Medical Council Reg. No. HN 23622), we hold patient trust and medical confidentiality as fundamental ethical responsibilities. This Privacy Policy details how we collect, handle, safeguard, and utilize your personal and health-related information when you consult with our clinic or utilize our website (https://orthocareindia.in).

1. Information We Collect

When you book an appointment, submit an inquiry, or interact with our digital patient services, we may collect the following details:

• Identity & Demographics: Patient Full Name, Age (in years), and Sex / Gender.
• Contact Information: Active 10-digit Mobile Number (for SMS & WhatsApp communication) and Email Address.
• Consultation Preferences: Preferred consultation mode (In-Clinic Visit at N.I.T. Faridabad or Online Video Consultation), preferred appointment date, and time slot.
• Clinical Summary & Symptoms: Nature of joint pain, sports injury history, symptom duration, or previous treatments shared voluntarily in inquiry notes.
• Technical Diagnostics: Browser type, timestamp, and network security headers utilized strictly to prevent automated spam and protect website integrity.

2. Purpose of Information Processing

Your information is processed strictly for legitimate clinical, administrative, and patient communication purposes:

• To evaluate, schedule, and confirm your orthopaedic consultation with Dr. Brejesh Kumar Prasad.
• To dispatch automated appointment confirmations, slot reminders, and clinic directions to your phone via WhatsApp or SMS.
• To allow Dr. Brejesh Kumar Prasad to conduct preliminary clinical triage prior to your consultation.
• To maintain accurate clinic registers and appointment history in compliance with National Medical Commission (NMC) and Indian medical record standards.

3. Data Security & Storage Architecture

We deploy robust organizational, administrative, and technological security controls to shield your data from unauthorized access:

• Transport Layer Security: All data transmitted between your browser and our booking gateway is encrypted with end-to-end 256-bit SSL/TLS encryption.
• Restricted Internal Gateway: Local appointment backups stored on our Linux hosting server are isolated in directories guarded by strict Apache access controls (Deny from all), preventing public URL access.
• Encrypted Operational Synching: Real-time spreadsheet updates utilize secure Google Cloud enterprise infrastructure protected by Google 2-Step Verification and granular access permissions.
• Staff Access Controls: Only Dr. Brejesh Kumar Prasad and authorized clinic administrative personnel have access to appointment rosters.

4. Compliance with Indian Healthcare & Privacy Laws

Our privacy framework operates in rigorous adherence to applicable Indian regulatory statutes, including:

• Digital Personal Data Protection (DPDP) Act, 2023: Ensuring patient consent, data minimization, purpose limitation, and storage transparency.
• Information Technology Act, 2000 & IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002: Upholding physician-patient privilege and absolute clinical confidentiality.

5. Patient Rights & Access Controls

As a patient or visitor, you retain full sovereignty over your personal data:

• Right of Access & Correction: You may request an update or correction of your registered mobile number, email, or name at any time.
• Right to Withdraw Consent: You may request cessation of non-essential clinic reminders by replying "STOP" on WhatsApp or sending an email.
• Right to Deletion: You may request the deletion of digital appointment records, subject to mandatory statutory medical record retention timelines prescribed by healthcare regulations.

6. Grievance Officer & Official Contact

For questions regarding this policy, to request data review, or to exercise your privacy rights, please contact our designated clinic data administration team: