Privacy Policy
Last updated: 13 September 2026
This Privacy Policy explains how Bhadoo Surgical & Wellness Centre (“we”, “us”, “our”) collects, uses, and protects the personal information of visitors to https://bhadoosurgical.com (“the website”) and of users of our mobile applications, Arogyam Health (for patients) and Arogyam Business (for clinic staff) — together, “the apps” (see §12). We are committed to handling your information transparently and in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made thereunder.
1. Who we are
| Clinic name | Bhadoo Surgical & Wellness Centre |
| Address | NH-4, Near Rehdi Market, Sector 17, Panchkula, Haryana 134109 |
| Lead doctor & Data Fiduciary | Dr Vivek Bhadoo, MBBS, MS (General Surgery), Haryana Medical Council Reg. No. HN 19870 |
| Grievance contact | help@bhadoosurgical.com · +91 90560 75777 |
Under the DPDP Act, the clinic acts as a Data Fiduciary when we collect your personal information through this website.
2. What we collect — and when
We collect personal information only when you choose to share it with us by submitting the “Request Callback” form. We do not collect any medical or health information through this website.
| What | Where | Why |
|---|---|---|
| Full name | Callback form | So we can address you when we call back |
| Phone number | Callback form | So we can call or message you back |
| Email address (optional) | Callback form | Alternative contact channel, only if you provide it |
| Reason for visit (optional) | Callback form | So the right person can prepare for your call |
| Free-text message (optional) | Callback form | Same as above |
We do not collect through this website: medical history, diagnoses, prescriptions, or any clinical information; Aadhaar, PAN, or other government-issued ID numbers; payment information; precise location data; or information from children (see §10).
If you contact us on WhatsApp or by phone using the buttons on the website, you are communicating with us directly through those services; the website itself does not collect or store anything about those interactions.
3. Why we use your information
- Returning your enquiry — calling, messaging, or emailing you back.
- Scheduling an appointment, if you ask us to.
- Internal record-keeping, so we can refer back to your enquiry if you contact us again.
We do not use your information for advertising or marketing without your separate, explicit consent; we do not profile you or use automated decision-making; and we never sell, rent, or trade your information.
4. Legal basis
We process your personal data on the basis of your consent, which you give by ticking the consent checkbox when submitting the form. The checkbox is never pre-ticked. You may withdraw consent at any time (see §7); withdrawal does not affect processing already lawfully carried out.
5. How long we keep your data
| Data | Retention |
|---|---|
| Enquiries where you became a patient | Kept as part of your patient record — minimum 3 years from last visit, per the Indian Medical Council (Professional Conduct) Regulations, 2002 |
| Enquiries where you did not become a patient | Up to 24 months from submission, then deleted |
You can ask us to delete your information sooner (see §7), subject to legal record-keeping requirements.
6. Who we share your information with
- Our own clinical and administrative staff, who need it to respond to your enquiry.
- Infrastructure providers strictly necessary to operate the website: Google Cloud Platform — our servers and database run in Google’s Mumbai (asia-south1) region, India, with Google’s global content delivery network in front of them.
- Authorities, only where required by law (e.g. a valid court order).
We do not share your information with marketers, advertisers, data brokers, or any other third party.
7. Your rights as a Data Principal
- Information about what personal data we hold about you.
- Correction of inaccurate or outdated data.
- Erasure — deletion of your data, subject to §5’s legal retention.
- Withdrawal of consent at any time.
- Grievance redressal if you believe we have mishandled your data.
- Nomination of another person to exercise these rights on your behalf in case of incapacity or death.
To exercise any of these, contact us using §11. We respond within 30 days.
8. Cookies, analytics & tracking
This website sets no cookies, runs no analytics or advertising trackers, and stores nothing in your browser. Your language choice (English/हिंदी) is reflected in the page address, not stored on your device.
9. Security
- All traffic between your browser and our servers uses HTTPS (TLS).
- Form submissions are stored in an access-controlled database in India (Mumbai region), readable only by authorised staff.
- In the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India in accordance with the DPDP Act and the rules made thereunder.
10. Children's data
This website is intended for adults. We do not knowingly collect personal information from individuals under 18. If you believe a child has submitted information through the website, contact us via §11 and we will delete it.
11. How to contact us
| Grievance Officer | Dr Vivek Bhadoo |
| help@bhadoosurgical.com | |
| Phone | +91 90560 75777 |
| Postal address | Bhadoo Surgical & Wellness Centre, NH-4, Near Rehdi Market, Sector 17, Panchkula, Haryana 134109 |
If you are not satisfied with our response, you may escalate to the Data Protection Board of India under the DPDP Act.
12. Our mobile apps — Arogyam Health & Arogyam Business
The apps exist to run your visit: booking, check-in, the live queue, and your prescription record. Unlike the website, the apps do handle medical information, because that is their purpose. Everything below is in addition to the sections above; your rights (§7), our security practices (§9), and the contact route (§11) apply to the apps exactly as they do to the website.
What Arogyam Health (the patient app) collects
| What | When | Why |
|---|---|---|
| Mobile number | Sign-in (one-time password via Firebase Authentication) | Your account identity and appointment communication |
| Name | Required at first sign-in | Identifying you to clinic staff; your medical record |
| Family member profiles (name, sex, year of birth, relation) | Only if you add them | Booking visits for dependents |
| Appointments, check-ins, queue tokens | When you book or attend | Running your visit |
| Prescriptions (photographs and/or typed medicine lists) | Created by your doctor during or after a consultation | Your medical record, retrievable in your visit history |
| Push notification token | If you allow notifications | Queue position and delay alerts — notifications carry token numbers, never diagnoses |
What Arogyam Business (the staff app) additionally collects — staff accounts only
| What | When | Why |
|---|---|---|
| Clock-in and clock-out times | Non-doctor staff attendance | Shift records |
| Location at clock-in and periodic shift updates | Only with explicit in-app consent; discarded server-side without it | Verifying on-premises attendance |
| Actions on patient records (searches, record views) | Always | A security audit trail — every access to patient data is logged |
Storage and processing
- All app data is stored in Google Cloud, Mumbai (asia-south1), India — the same infrastructure and region as the website (§6). Prescription photographs live in a private storage bucket accessible only through time-limited signed links issued to authorised users.
- Sign-in is handled by Google Firebase Authentication (phone OTP); push notifications are delivered via the Expo push service and Firebase Cloud Messaging using device tokens only.
- The apps contain no advertising, no third-party analytics, and no sale or trade of your data — the §3 and §8 commitments apply.
- No AI processing of patient data. Any future AI-assisted feature will be introduced only with a revision of this policy and its own consent step.
- Every prescription change is preserved in an unalterable clinical history — records cannot be silently rewritten.
Retention and account deletion
- Delete your account in the app (Profile → Delete account) or as described at bhadoosurgical.com/account-deletion. Your sign-in identity, phone linkage, profile details, and family profiles are removed immediately.
- Clinical records of visits that already took place (appointments, consultations, prescriptions) are retained per the medical-records retention rules in §5, no longer linked to a usable sign-in identity.
- Security and audit logs are retained per §5’s accountability periods.
13. Updates to this policy
We may update this policy from time to time. The “Last updated” date above will reflect any change, and material changes will be highlighted on this page.