Privacy policy
This policy explains how Indira Women’s Clinic handles personal data collected on this website, including appointment requests and contact messages.
What we collect
We collect your name, phone number, email address, preferred visit date and time window, preferred language, optional doctor, and free-text notes when you request an appointment or send a contact message. Your IP address is sent to Cloudflare Turnstile for its spam check. We do not keep your IP address in our own records: our database stores only a keyed hash of it (HMAC-SHA256 with a secret held on our server), used solely to limit how many forms one visitor can submit.
Why we collect it
We use this information to book and remind you of visits, and to respond to messages you send us.
Who can see it
Reception and administrators handle appointment and contact inboxes. Doctors use the staff area to write insights, not to open the appointment inbox. Staff sign-in uses Clerk cookies on /admin; public pages do not load the staff login widget.
WhatsApp and email processors
We send messages through WhatsApp and email processors (currently Gupshup for WhatsApp and Resend for email) acting on our instructions. The site is hosted on Vercel, appointment and contact records are stored in Neon Postgres, images in Vercel Blob, staff login is Clerk, and Cloudflare Turnstile helps block automated form spam.
Spam prevention and IP addresses
When you submit the booking or contact form, we record it in a spam-prevention log so that one visitor cannot submit the form more than five times in ten minutes. That log is separate from your appointment or contact record. It does not hold your IP address: it holds only a keyed hash of it (HMAC-SHA256 with a secret held on our server, which cannot be reversed back to the address) and the time. Those entries are deleted once they are more than ten minutes old. We do not use the log to identify you and we do not join it to your appointment. Cloudflare Turnstile separately receives your IP address as part of checking that the submission is not from an automated script.
How long we keep it
We keep appointment and contact-form personal details for 24 months after the request (or last appointment status change), then anonymise them. The hashed-IP spam-prevention entries are kept only for the 10-minute rate-limit window and are then deleted. We do not store medical records, prescriptions, or scan files on this site.
Consent and how to withdraw it
You give consent by ticking the box on the booking or contact form, and we record the date and time of that consent alongside your request. You can withdraw it at any time by calling or messaging the clinic on the phone or WhatsApp number published on this site — the same channels you can already reach us on, and no harder than giving consent was. Once you withdraw, we stop using your details to send appointment reminders and follow-up messages, and we delete or anonymise them unless we are required to keep them. Withdrawing consent does not undo what we lawfully did with your details beforehand, and if you withdraw before a visit we may no longer be able to confirm or remind you about that appointment.
How to correct your details
If your name, phone number, email address, or the details of a requested visit are wrong, incomplete, or out of date, call or WhatsApp the clinic and tell us what the correct value is. We will update our records. Corrections apply to what we hold going forward; a WhatsApp or email message that has already been sent cannot be recalled.
How to ask for deletion
Deletion is by calling the clinic. You may also WhatsApp or email us and ask us to delete your personal data. We do not offer a self-serve deletion form.
Nominating someone to act for you
You can nominate another person — for example a family member — to exercise these rights on your behalf if you die or become unable to act for yourself. Tell reception whom you wish to nominate and we will record it against your details. You can change or cancel a nomination at any time by telling us.
Grievance officer and how to complain
If you are unhappy with how we have handled your personal data, or with our answer to a request to correct, delete, or stop using it, contact the clinic manager, who acts as our grievance officer, on the clinic phone or WhatsApp number published on this site, or through the contact form. Please say that your message is a data-protection grievance so that reception routes it to the right person. We aim to respond within 30 days of receiving it. If our response does not resolve the matter, you may complain to the Data Protection Board of India.
Notes on the booking form
Free-text notes on the booking form are operational only. Do not include detailed medical history.