Privacy Policy

1. Information we collect

We collect information in the following ways:

a) Information you provide directly

• Contact details: name, email address, phone number.
• Consultation request details: the treatment(s) you're interested in, a description of your skin concern, preferred appointment times, and any other details you choose to include in the booking form or in free-text fields.
• Sensitive Personal Data or Information (SPDI): if you describe symptoms, upload photos, or mention medical history in the booking form or in correspondence with us, this constitutes "Sensitive Personal Data or Information" under the SPDI Rules. We collect this only if you voluntarily provide it, only with your explicit consent, and only for the purpose of allowing our clinical staff to prepare for and provide your consultation.
• Communications: records of emails, messages, or calls between you and us, if you contact us directly.

b) Information collected automatically

• IP address, browser type and version, device type, and operating system.
• Pages visited, time spent on pages, referring/exit pages, and click activity.
• Approximate location derived from your IP address.
• Information collected via cookies and similar technologies (see Section 6).

c) Information from third parties

If you book a consultation through a third-party scheduling tool or payment gateway, or if you contact us via a linked social media page, we may receive information from that provider as permitted by their own privacy policy and your settings with them.

2. The consultation booking form

When you submit our "Book a Consultation" form, we ask for information such as your name, contact details, treatment interest, and a description of your concern so that our team can respond to your request, check availability, and prepare for your appointment. Fields marked as required must be completed to submit the form; optional fields (such as a detailed message) are provided at your discretion.

Submitting the form does not guarantee an appointment. A member of our team will contact you using the details provided to confirm scheduling.

Please do not include full medical records, Aadhaar or other government ID numbers, insurance details, or payment information in the free-text fields of the form. We will request any additional information we need through a secure, appropriate channel.

3. How we use your information

We use the information we collect to:

• Respond to consultation requests and schedule appointments;
• Communicate with you about your inquiry, appointment, or our services;
• Provide, maintain, and improve the Site and its content;
• Understand how visitors use the Site (analytics) so we can improve it;
• Send you information you've requested, such as appointment reminders or, where you've opted in, marketing communications;
• Maintain clinical and business records as required under applicable Indian law and professional/medical council guidelines;
• Detect, prevent, and address fraud, abuse, or security issues; and
• Comply with applicable law, or respond to a lawful request from a government or regulatory authority.

We do not use sensitive personal data or information you submit for advertising purposes, and we do not sell or trade it.

4. Consent, including for sensitive personal data

Under the SPDI Rules, collection of Sensitive Personal Data or Information (which includes physical, physiological and mental health condition, and medical records or history) requires your explicit consent. By voluntarily entering such information into the booking form, or otherwise sharing it with us, you provide this consent.

Under the DPDP Act, we act as a "Data Fiduciary" and you are the "Data Principal." We process your personal data on the basis of your consent, which you may give, refuse, or withdraw at any time (see Section 9), and, where applicable, for other purposes permitted under the DPDP Act without consent (such as compliance with law or a medical emergency involving you or another individual).

You have the right to decline to provide any information; where information is required to process your consultation request, declining may mean we are unable to respond to it.

5. Who we share information with

We do not sell your personal information. We may share it with:

• Clinical staff and providers involved in evaluating your consultation request and delivering treatment;
• Service providers who perform functions on our behalf, such as website hosting, appointment scheduling, email delivery, analytics, and payment processing — under contractual obligations to protect your information and use it only for the purposes we specify;
• Professional advisors, such as accountants, auditors, or lawyers, where necessary;
• Government or regulatory authorities, courts, or law enforcement, where required under applicable Indian law, or to establish, exercise, or defend legal claims; and
• A successor entity, in connection with a merger, acquisition, or sale of assets, subject to confidentiality arrangements consistent with this policy.

Sensitive personal data or information is not published or disclosed to any third party without your consent, except where disclosure is necessary for compliance with a legal obligation, or has been agreed to in a contract between us and a third party, in accordance with the SPDI Rules.

6. Cookies and tracking technologies

We use cookies and similar technologies to:

• Essential cookies: required for the Site to function (e.g., form submission, security).
• Performance/analytics cookies: help us understand how visitors use the Site, such as via Google Analytics.
• Functionality cookies: remember preferences to improve your experience.
• Marketing cookies (if applicable): used to deliver relevant ads and measure their performance, only with your consent where we provide a cookie banner offering that choice.

You can control cookies through your browser settings and, where we provide one, our cookie consent banner. Disabling certain cookies may affect Site functionality, such as the booking form.

7. Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, including responding to your consultation request, maintaining appropriate clinical and business records, and complying with legal, tax, or regulatory retention requirements applicable in India. Health-related records may be subject to longer, professionally or legally mandated retention periods. When information is no longer needed for these purposes, we delete or anonymize it, unless a longer retention period is required or permitted by law.

8. How we protect your information

In accordance with the "reasonable security practices and procedures" standard under the SPDI Rules, we use administrative, technical, and physical safeguards designed to protect your information, including encrypted transmission (HTTPS), access controls limiting who can view submitted consultation requests, and secure storage with our hosting and form providers. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights as a data principal

Under the DPDP Act and the SPDI Rules, you have the right to:

• Access — request confirmation of whether we process your personal data, and obtain a summary of the data and processing activities;
• Correction and updating — request that we correct inaccurate or incomplete information, or update information that has changed;
• Erasure — request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations;
• Withdraw consent — withdraw consent to processing at any time, with effect for future processing (withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer respond to your consultation request);
• Grievance redressal — raise a complaint with our Grievance Officer (see Section 13), and, if unresolved, escalate to the Data Protection Board of India once it is operational; and
• Nominate — nominate another individual to exercise these rights on your behalf in the event of death or incapacity, in the manner prescribed under the DPDP Act.

To exercise any of these rights, contact us using the details in Section 16. We may need to verify your identity before fulfilling certain requests, and may take a reasonable time to respond as permitted under applicable law.

10. Children's privacy

Under the DPDP Act, anyone under 18 years of age is considered a child. We do not knowingly collect personal data from children without verifiable consent of a parent or lawful guardian. If a consultation involves a minor, the booking form and any correspondence should be submitted by a parent or guardian on the minor's behalf. If we learn that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

11. Cross-border data transfer

Your information is primarily stored and processed in India. Where we use service providers (such as hosting, email, or analytics platforms) that store or process data outside India, we take steps to ensure such transfers comply with the DPDP Act and any restrictions on transfer to specific countries that the Central Government may notify from time to time. Where required, we rely on contractual safeguards with such providers.

12. Third-party links

The Site may contain links to third-party websites (such as social media pages or review platforms). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing information to them.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the DPDP Act, the name and contact details of the Grievance Officer are provided below. If you have any grievance regarding the processing of your information, you may contact:

Grievance Officer: Dr. Ranjan Upadhyay
Desmoderm
LGF, Local Shopping Complex Sector B1, Jal Board Road, Near HDFC Bank, Pocket 1, Sector B, Vasant Kunj, New Delhi 110070
Email: hello@desmoderm.com
Phone: +91 99997 54533

We will acknowledge and address grievances within the timelines prescribed under applicable Indian law.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated policy on this page with a revised "Last updated" date, and where changes are material, we will provide additional notice as appropriate.

15. Governing law and jurisdiction

This Privacy Policy is governed by the laws of India. Subject to applicable law, the courts at Delhi shall have exclusive jurisdiction over any disputes arising out of or in connection with this policy.