Overview & Who We Are
This Privacy Policy explains how Immunodoc (operated at immunodoc.in) collects, uses, stores, and protects personal data belonging to users of this website and associated digital services. By using Immunodoc, you consent to the practices described in this policy.
Under India's Digital Personal Data Protection Act, 2023 (DPDPA), Immunodoc operates as a Data Fiduciary — an entity that determines the purpose and means of processing personal data.
- Data Fiduciary (Medical): Dr. Keerthi Vardhan, MD DM — Consultant Rheumatologist & Clinical Immunologist, NMC Reg. No.: [Registration Number], NIMS Hospital, Punjagutta, Hyderabad – 500082, Telangana
- Data Fiduciary (Technical): Mr. Kedar Setty — Technical Partner, Immunodoc | [email protected]
- Contact for privacy matters: [email protected]
Data We Collect
Immunodoc collects different categories of personal data depending on how you interact with the platform:
| Category | Data Elements | When Collected |
|---|---|---|
| Identity Data | Full name, age, gender | Newsletter signup, consultation booking, contact form |
| Contact Data | Email address, phone number, WhatsApp number, city/state | Newsletter signup, consultation booking, contact form |
| Health & Medical Data | Medical history, symptoms, diagnoses, medications, investigations, consultation notes | Teleconsultation sessions only — with explicit consent |
| Payment Data | Transaction ID, payment amount, payment method (card/UPI type — not card number) | Teleconsultation fee payment via Razorpay |
| Technical / Usage Data | IP address, browser type, device type, pages visited, session duration, referral source | Automatically collected by Google Analytics 4 and server logs |
| Communication Data | Email correspondence, WhatsApp messages, contact form submissions | When you contact us or respond to newsletters |
| Preferences Data | Newsletter preferences, dark/light mode preference (stored locally only) | User-selected preferences on the website |
Health and medical data is classified as Sensitive Personal Data under DPDPA 2023. Immunodoc collects this data only with your explicit consent, solely for the purpose of providing teleconsultation services, and stores it with enhanced security measures as described in Section 7.
How We Use Your Data
Immunodoc uses your personal data only for the purposes for which it was collected. We do not use data for automated decision-making, profiling, or any purpose incompatible with the original purpose of collection.
- Providing teleconsultations: To conduct video consultations, issue prescriptions, and maintain medical records as required by law
- Communication: To respond to your queries, confirm appointments, and send appointment reminders
- Newsletter & educational content: To send health tips, condition guides, and clinical updates to subscribers who have given consent (opt-in only)
- Website improvement: To analyse usage patterns and improve content through aggregated, anonymised analytics data
- Legal compliance: To fulfil obligations under the Telemedicine Practice Guidelines 2020, DPDPA 2023, and other applicable laws
- Payment processing: To facilitate and confirm transactions through Razorpay; full payment card data is handled only by Razorpay and is never stored on Immunodoc servers
Legal Basis for Processing
Under DPDPA 2023, Immunodoc relies on the following legal bases for processing personal data:
- Consent: For newsletter subscriptions, marketing communications, and collection of health/medical data during consultations. You can withdraw consent at any time.
- Contract performance: For processing data necessary to deliver a teleconsultation service you have booked and paid for
- Legal obligation: For retaining medical records and consultation data as required by the Telemedicine Practice Guidelines 2020 and applicable medical laws
- Legitimate interests: For website security, fraud prevention, and aggregated analytics to improve the platform
Data Sharing & Disclosure
Immunodoc does not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:
- Payment processor: Razorpay (PCI-DSS compliant) for transaction processing — only transaction-related data is shared, not your health data
- Email service provider: Zoho Campaigns — for sending newsletters to subscribers; only name and email address are shared
- Analytics: Google Analytics 4 — anonymised usage data; IP addresses are anonymised before transmission
- Legal authorities: If required by law, court order, or government authority under applicable Indian law
- Referral doctors: With your explicit consent, a consultation summary may be shared with another doctor you request a referral to
No health or medical data is ever shared with pharmaceutical companies, advertisers, or any commercial third party. Immunodoc products are ad-free and do not involve advertiser access to your data.
Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Medical / consultation records | Minimum 3 years from last consultation | Telemedicine Practice Guidelines 2020 |
| Prescription records | 3 years | Drugs & Cosmetics Act, 1940 |
| Email newsletter subscription | Until you unsubscribe + 6 months | Consent-based |
| Contact form submissions | 12 months | Legitimate interests |
| Payment records | 7 years | Income Tax Act / GST requirements |
| Website analytics (anonymised) | 26 months (GA4 default) | Legitimate interests |
After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you.
Security Safeguards
Immunodoc implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, or misuse. These measures include:
- SSL/TLS encryption: All data transmitted between your browser and immunodoc.in is encrypted via HTTPS
- Secure hosting: Website hosted on Hostinger with server-side security, regular backups, and access controls managed by Mr. Kedar Setty (Technical Partner)
- Access restriction: Health and consultation data is accessible only to Dr. Keerthi Vardhan and authorised staff on a need-to-know basis
- Payment security: No payment card details are stored on Immunodoc servers. All payments are processed via Razorpay's PCI-DSS compliant gateway
- WhatsApp encryption: Clinical communications via WhatsApp benefit from end-to-end encryption; however, patients are advised not to share highly sensitive diagnostic images over WhatsApp without understanding its limitations
In the event of a personal data breach that is likely to result in a risk to your rights, Immunodoc will notify the Data Protection Board (once established under DPDPA 2023) and affected individuals as required by law.
Your Rights Under DPDPA 2023
As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal data processed by Immunodoc:
Request a summary of the personal data Immunodoc holds about you and the purposes for which it is being processed.
Request correction of inaccurate or incomplete personal data held by Immunodoc. This includes updating contact details or correcting medical history errors.
Request deletion of your personal data, subject to legal retention obligations (e.g., medical records must be retained for 3 years per Telemedicine Guidelines).
Receive a copy of your personal data in a structured, commonly used, machine-readable format to transfer to another healthcare provider.
Withdraw consent for data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Lodge a grievance with the Immunodoc Grievance Officer (Mr. Kedar Setty). If unresolved, escalate to the Data Protection Board of India once constituted.
To exercise any of these rights, email [email protected]. We will respond within 30 days of receiving your request.
Cookies & Analytics
Immunodoc uses the following cookies and tracking technologies:
| Cookie / Technology | Purpose | Type | Duration |
|---|---|---|---|
| imm-theme | Stores your dark/light mode preference | Functional (localStorage) | Persistent (until cleared) |
| Google Analytics 4 (_ga, _ga_*) | Aggregated usage analytics — pages visited, session duration, device type; IP anonymised | Analytics | 2 years |
| Razorpay | Payment session and fraud prevention | Essential | Session |
| Zoho Campaigns | Email open/click tracking for newsletter subscribers | Analytics (opt-in) | 1 year |
You may disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the website but will prevent Immunodoc from improving content based on usage patterns.
Children's Privacy
Immunodoc does not knowingly collect personal data from children under the age of 18 without verifiable parental or guardian consent. Content on this website is designed for adults; however, paediatric rheumatology and immunology conditions (such as Juvenile Idiopathic Arthritis) are discussed for informational purposes and are intended to be read by parents, caregivers, and healthcare professionals.
If a teleconsultation is requested for a minor, explicit consent from the child's parent or legal guardian is required before the consultation proceeds. The parent/guardian must be present for the duration of the video consultation.
If you believe a child has provided personal data to Immunodoc without parental consent, please contact [email protected] immediately so the data can be deleted.
Telemedicine Data
Teleconsultation sessions conducted via Immunodoc are governed by the Telemedicine Practice Guidelines 2020 and the DPDPA 2023. The following specific provisions apply to health data collected during consultations:
- Audio/video recording: Consultations are not recorded by default. If Dr. Keerthi Vardhan requires a recording for clinical or teaching purposes, explicit, separate written consent will be obtained from the patient before recording commences
- Prescription storage: Digital prescriptions are generated and stored securely; copies are sent to the patient via email or WhatsApp
- Third-party video platforms: Video consultations may be conducted via WhatsApp Video or other secure video platforms. The privacy policies of these platforms apply to their respective features; Immunodoc selects platforms that offer end-to-end encryption
- Consultation notes: Clinical notes from each session are stored securely for a minimum of 3 years in accordance with the Telemedicine Practice Guidelines 2020
Changes to This Policy
Immunodoc may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will:
- Update the "Effective" date at the top of this page
- Notify newsletter subscribers via email of material changes
- Post a prominent notice on the Immunodoc homepage for 30 days following a significant update
We encourage you to review this policy periodically. Your continued use of Immunodoc after the effective date of any changes constitutes your acceptance of the updated policy.
Alt: [email protected]
Technical Partner, Immunodoc
Hyderabad, Telangana, India
Department of Rheumatology
NIMS Hospital, Punjagutta
Hyderabad – 500082, Telangana
Immunodoc is committed to transparent, ethical data practices. We never sell your data, never target you with ads, and never share your health information without your consent. If you have any concern about how your data is handled, please reach out — we are committed to resolving it promptly.