Patient Data Protection Policy

This Patient Data Protection Policy explains how Vyara Wellness Pvt. Ltd., a company incorporated under the Companies Act, 2013 having its place of business at 811, Harnoor House, 1st Floor, Sector-42, Gurgaon-122002, Haryana, operating under the name ‘Institute of Precision Hormonal and Metabolic Health’ (“the Institute”, “we”, “us”, “our”), collects, processes, protects and shares your personal data, with particular care for your medical and health data, in the course of providing healthcare services.

This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it. For the purposes of the DPDP Act, the Institute is the Data Fiduciary and you, the individual whose data we process, are the Data Principal.

This Policy applies to all personal data we process when providing healthcare services, including:

General data collected through our public website is covered by the separate website Privacy Policy.

Personal data means any data about an individual who is identifiable by or in relation to such data.

Health data means data relating to your physical or mental health, including medical and family history, symptoms, diagnoses, hormonal and metabolic test results, prescriptions, treatment plans, and lifestyle information relevant to your care. We treat health data as a particularly sensitive category requiring heightened protection.

Processing means any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure or erasure.

Data Processor means any person who processes personal data on our behalf and on our documented instructions.

Identity and contact data: name, age, date of birth, gender, address, email address, telephone number, and government-issued identification where required to verify identity for telemedicine or treatment.

Health data: medical and family history, presenting symptoms, clinical findings, diagnoses, hormonal and metabolic assessments, laboratory and diagnostic test results, prescriptions, compounded-formulation details, treatment plans, progress notes, and lifestyle, diet and wellness information you share with us.

Consultation records: notes and records and, where applicable and with prior notice to you, recordings of telemedicine consultations, and correspondence relating to your care.

Account data: your patient portal profile and activity.

Payment data: details necessary to process payment for services. Where payment is taken online, card and banking details are handled by Razorpay and are not stored by us except for transaction records.

We collect this data directly from you, from diagnostic laboratories Mahajan Labs that perform tests ordered for you, and from our compounding pharmacy partner Zenovira Health LLP in relation to formulations prescribed for you.

We process your personal data, including health data, on the basis of your consent, obtained at or before the point of collection through a clear notice describing the data sought, the purposes, and how to withdraw consent and exercise your rights.

Where the DPDP Act permits processing for certain legitimate uses without separate consent (for example, to comply with a legal obligation, or to respond to a medical emergency threatening life or health), we may rely on those grounds to the extent permitted.

We process your personal data to:

Because your health data is highly sensitive:

We may use your personal data, including health data, for clinical research, teaching, clinical audit and the improvement of treatment protocols. Wherever the purpose can be achieved without identifying you, we use de-identified or anonymised data.

We will not publish any case report, photograph, image, video, pedigree or clinical description that identifies you, or from which you could be identified, whether directly or indirectly, and whether by combination of distinctive physical, clinical, demographic or locational features that may be recognisable to your family, friends, community or locality, except with your separate, specific and written consent for that publication. Removing your name or other direct identifiers alone is not treated by us as making you unidentifiable.

Before seeking such consent we will, so far as practicable, show you the material proposed to be published. You may decline, or withdraw your consent before publication, without any effect on your care.

Any processing for research, archiving or statistical purposes is carried out in accordance with the Digital Personal Data Protection Act, 2023 and applicable medical-research ethics guidelines (including the ICMR National Ethical Guidelines), with safeguards so that your identity cannot be inferred and so that no decision specific to you is made on the basis of that processing.

We share personal data only as necessary for your care and the lawful operation of the Institute, with:

Every Data Processor is bound by a written agreement requiring confidentiality, security, processing only on our instructions, and compliance with applicable data-protection law. We remain accountable for personal data processed on our behalf.

The Institute serves patients in India and also foreign nationals and non-resident Indians, including by telemedicine. Your personal data, including health data, is stored on infrastructure located in India and processed primarily in India under the DPDP Act.

By using our services from outside India, you understand and consent that your personal data will be transferred to, stored in and processed in India for the purposes in this Policy. Any transfer of personal data outside India will be made only in accordance with the DPDP Act and applicable law.

We implement reasonable technical and organisational security safeguards to protect personal data against unauthorised access, disclosure, alteration and loss, including access controls, encryption in transit, role-based access to health data, audit logging where appropriate, and binding confidentiality obligations on personnel and processors.

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and the rules made under it.

Subject to the DPDP Act, you have the right to:

To exercise any right, contact us using the details in Clause 16. We may verify your identity before acting on a request, and will respond within the timelines prescribed under the DPDP Act.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.