Privacy Policy

1. Who we are

Diabetica Care (“Diabetica”, “we”, “us”) operates the website diabetica.care and a diabetes care and reversal centre at LG 245, Artha Mart, Greater Noida W Rd, Tech Zone IV, Uttar Pradesh 201318, India.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Diabetica Care is the Data Fiduciary for the personal data described in this notice. This policy is also our published privacy policy under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

2. What this policy covers

This policy covers the data we collect through this website and through the contact and booking routes it links to. Care delivered inside the clinic is also governed by the consent forms and record-keeping notices you are given at the point of care; where those and this policy differ, the document you signed at the clinic governs your clinical records.

3. What we collect

The website itself does not ask you to fill in any form. We collect data in three ways:

a. Information you send us directly

• Your name, phone number and email address when you contact us by WhatsApp, phone or email.
• Whatever you choose to tell us in that message — which may include information about your health, since that is usually why people get in touch.

b. Information you give our booking partner

• When you click “Book an appointment”, you leave this website and go to Eka Care, our booking and health-records partner. The information you enter there — name, contact details, appointment details and any health information — is collected by Eka Care and shared with us so we can provide care.

c. Information collected automatically

• Analytics, only if you agree. If you accept analytics cookies, Google Analytics 4 records which pages you view, roughly where you are (city level), what device and browser you use, and how you arrived at the site. We use this to understand which parts of the site are useful. If you decline, no analytics cookies are set and no analytics data is sent.
• Server logs. Our hosting provider records IP addresses and requested URLs for security and troubleshooting. These are kept for a short period and are not used to build a profile of you.

4. Why we use it, and our legal basis

Purpose	Data used	Basis
Booking and delivering your care	Contact and health data	Your consent, given when you book
Replying to your enquiry	Contact data and your message	Your consent, given by contacting us
Keeping medical records	Clinical data	Legal obligation under clinical-establishment rules
Understanding site usage	Analytics data	Your consent — you may decline
Keeping the site secure	Server logs	Our legitimate need to operate the site safely

We do not use your data for advertising, we do not sell it, and we do not share it with data brokers.

5. Who we share it with

We share personal data only with the following organisations, only for the purposes listed, and only to the extent needed:

Who	What they receive	Why
Eka Care Orbi Health Pvt. Ltd., India	Your booking and health-record data	Appointment booking and patient records
Meta / WhatsApp Meta Platforms, Inc.	Your phone number and message content	Only if you choose to contact us on WhatsApp
Google Google LLC / Google India	Analytics data, if you consent; your IP address if you choose to load the map	Website analytics and directions
Our hosting provider	Server log data	Serving and securing the website

We may also disclose information where the law requires it, or where it is necessary to protect someone’s life or safety in an emergency.

6. Cookies and the map

This website sets no cookies of its own. Two things can set cookies, and both are under your control:

• Analytics. Google Analytics sets cookies only after you accept them in the banner. You can change your mind at any time using the cookie settings link, which also appears in the footer of every page.
• The map. Our location map does not load until you click “Load map”. Until you do, nothing is requested from Google and no cookies are set. Once you load it, Google may set cookies and will receive your IP address.

7. Children’s data

We provide paediatric diabetes care, so we do handle data about children.

• Where a patient is under 18, we obtain and rely on the consent of a parent or lawful guardian, verified at the clinic.
• In line with section 9 of the DPDP Act, we do not track children, monitor their behaviour, or direct advertising at them. Analytics is disabled entirely on our paediatric pages, whatever your cookie choice.

8. How long we keep it

Data	Kept for
Medical records	At least 3 years from the last entry, per clinical-establishment requirements
Enquiries that do not become appointments	12 months
WhatsApp conversations	12 months, then deleted from clinic devices
Analytics data	14 months
Server logs	30 days

Once a purpose is served and no legal obligation requires us to keep the data, we erase it.

9. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and who we have shared it with.
• Correct or complete data that is wrong or out of date.
• Erase data where we no longer need it for the purpose it was collected for, and no law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it. Withdrawing consent does not undo processing already carried out.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and then to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these, contact our Grievance Officer below. We will respond within 30 days.

10. How we protect it

• The whole site is served over HTTPS and enforces HSTS.
• Access to patient records is restricted to clinical and administrative staff who need it, under individual logins.
• Staff are trained on handling health data and are bound by confidentiality obligations.
• We review our security practices, and those of our partners, periodically.

No system is perfectly secure. If a personal-data breach occurs, we will notify the Data Protection Board of India and every affected person, as the DPDP Act requires.

11. Grievance Officer and contact

12. Changes to this policy

If we change how we use your data we will update this page and change the “last updated” date above. Where a change is significant, we will ask for your consent again rather than relying on the old one.

Back to home