SCOD Clinic

Effective Date: October 2026 DPDP Act 2023 Compliant

1. Data Fiduciary Identification & Scope

This Privacy Notice is issued by SCOD Medical Center / Surgical Center for Obesity and Diabetes ("SCOD Clinic", "we", "our", or "us"), acting as a Data Fiduciary under Section 2(i) of India's Digital Personal Data Protection Act, 2023 (DPDP Act).

This policy outlines our statutory obligations when processing the digital personal data of prospective, current, and former patients, website visitors, and caregivers (referred to as "Data Principals") residing within India or accessing our services globally.

2. Notice Under Section 5: Personal Data We Collect

In accordance with Section 5 of the DPDP Act, 2023, we inform you that we collect only the minimum digital personal data necessary to evaluate medical inquiries and coordinate surgical consultations:

A. Directly Provided Contact Data

Full name, mobile telephone number, email address, city/locality, and preferred appointment dates submitted through our inquiry and appointment booking forms.

B. Preliminary Health Inquiry Information

Subject of medical interest (e.g., bariatric surgery, laparoscopic hernia repair, gallbladder surgery), symptoms described voluntarily in query fields, and previous medical history shared to assess clinical suitability.

C. Technical & Diagnostic Metadata

IP address, browser type, device identifiers, and anonymized aggregate browsing metrics collected via Google Analytics 4 to optimize website performance and accessibility.

3. Lawful Grounds & Specific Purposes of Processing

Under Sections 4 and 6 of the DPDP Act, 2023, your personal data is processed exclusively on the basis of your free, specific, informed, unconditional, and unambiguous consent signified by an affirmative action (such as clicking the consent checkbox on our forms). We process data solely for the following specified purposes:

Responding to clinical inquiries and scheduling in-person or telemedicine consultations.
Verifying patient identity and preliminary clinical suitability for laparoscopic or bariatric surgery.
Transmitting administrative appointment confirmations, directions, and pre-consultation guidelines.
Fulfilling mandatory statutory obligations under National Medical Commission (NMC) regulations and applicable Indian healthcare laws.

* We do not engage in automated profiling, third-party behavioral advertising, or commercial monetization of your healthcare inquiries.

4. Your Statutory Rights Under the DPDP Act, 2023

As a Data Principal, the DPDP Act guarantees you the following enforceable rights:

Right to Access (Sec 11)

You have the right to obtain a summary of your personal data processed by SCOD Clinic and the identities of any third-party processors with whom it has been shared.

Right to Correction & Erasure (Sec 12)

You may request the correction of inaccurate data, completion of incomplete records, or permanent erasure of your inquiry data when the purpose has been fulfilled.

Right to Withdraw Consent (Sec 6(4))

You may withdraw your consent at any time as easily as it was given by emailing our Grievance Officer. Processing will cease within a reasonable statutory timeframe.

Right to Nominate (Sec 14)

You have the right to nominate another individual who shall exercise your data rights in the event of death or medical incapacity.

5. Data Retention & Deletion Schedule (Section 8(7))

Under Section 8(7) of the DPDP Act, personal data is retained only for the duration necessary to satisfy the purpose for which it was collected or to comply with applicable statutory retention requirements:

Website Inquiries & Contact Forms: Data from inquiries that do not result in clinical admission is securely erased after 180 days.
Clinical Patient Records: Inpatient and outpatient medical records for patients who undergo clinical evaluation or surgery are preserved in compliance with NMC Code of Medical Ethics Regulations (mandating minimum 3 years retention for medical case histories).
Consent Records: Audit trails of digital consent are archived securely to prove compliance with Section 6.

6. Third-Party Processors & Security Safeguards

SCOD Clinic enforces technical, physical, and organizational safeguards (including 256-bit TLS transport encryption, role-based database access, and restricted administrative privileges) in compliance with Section 8(5) of the DPDP Act.

We utilize selected third-party service providers acting strictly as Data Processors under binding data protection commitments:

Formester: Secure API processor for transmission of contact and appointment form inquiries.
Google Analytics (GA4): Anonymized diagnostic web telemetry to measure aggregated site usage.

7. Grievance Redressal & Right to Complain (Sections 13 & 18)

If you have any questions, wish to exercise your rights of access, correction, or erasure, or have concerns regarding the processing of your personal data, you may contact our designated Grievance Redressal Officer:

Designation: Data Protection & Grievance Redressal Officer

Entity: SCOD Medical Center (Surgical Center for Obesity and Diabetes)

Registered Address: 87, Paschimi Marg, Block D, Vasant Vihar, New Delhi, 110057, India

Email: info@scodclinic.com / privacy@scodclinic.com

Telephone: +91 8130130489

Response Timeline: Acknowledged within 48 hours; resolved within 30 days as prescribed by law.

Right of Appeal to Data Protection Board of India (DPBI): If your grievance is not resolved to your satisfaction by our Grievance Officer within 30 calendar days, you have the statutory right under Section 18 of the DPDP Act, 2023 to submit a formal complaint to the Data Protection Board of India.

Privacy Notice & Policy