Make a data request

What you can ask for

Five things, matching the list in our privacy policy. Choose the one closest to what you want; if it is none of them, choose the last and say so.

• Tell me what you hold about me. A summary of the personal data the clinic is processing about you, what it is being used for, and who it has been shared with.
• Correct or complete something. A wrong spelling, a wrong date of birth, an out-of-date phone number, a missing allergy. In a clinic a wrong record is a safety problem, not a clerical one.
• Erase what you hold about me. We will erase what we no longer need for the purpose you gave it for. Some clinical records we are required to keep — where that applies we will say so, and say for how long.
• Nominate someone to act for me. Name a person who may exercise these rights on your behalf if you die or become unable to act for yourself.
• Raise a complaint about how my data was handled. A complaint to the clinic's Grievance Officer. You do not have to exhaust this route before going to the Data Protection Board of India, but it is usually the fastest way to get something fixed.

Two things this form is not for. A copy of your own clinical record is faster asked for at the clinic — documents are issued within 72 hours, as set out under patient rights. And a complaint about clinical care rather than about data follows a different route entirely, on the same page.

Why we cannot just show you

Anyone can type anyone else’s name and mobile number into a form. If this page answered with a summary of what we hold, it would hand a stranger the answer to “is this person a patient at a cardiology clinic, and when did they last come in?” — on demand, to the whole internet, with no way for us to know it had happened. That is a data breach wearing the costume of compliance, and it would be worse than having no form at all.

We are not being obstructive, and we will not make the verification harder than it needs to be. Handing a medical record to the wrong person is the worst thing we could do.

The request form

We ask for four things and nothing else: which right you are exercising, your name, one way to reach you, and anything we need to know to act. No date of birth, no ID number, no address — if we need more to verify you, we will ask when we call, and we would rather not hold it until then.

What happens next

• Acknowledgement within three working days. A short note saying we have it, on the detail you gave.
• We check who you are. Usually a phone call with a question or two. Sometimes, for anything that would disclose a clinical record, we will ask you to come to the clinic with identification. This step is not optional and it is not negotiable.
• A substantive reply within 30 days of receiving the request — the window this clinic commits to and publishes, in the privacy policy and on the patient rights page. If we are going to need longer, we will tell you before that runs out, and why.
• If we say no, we say why. An erasure request against a record we are legally required to keep is the usual reason. You will be told which record, and for how long we must keep it.

If our answer does not satisfy you

You may complain to the Data Protection Board of India, the statutory body established under the Digital Personal Data Protection Act, 2023, which accepts complaints digitally. You may do that if our reply does not satisfy you, or if we do not reply within the window above. You do not need our permission, our agreement, or to have exhausted anything here first — though giving us the chance is usually faster.

The full ladder, including the routes for a complaint about clinical care or about the clinic as an establishment, is on the patient rights and grievance redressal page.

If you would rather not use this form

Nothing here obliges you to use it. A request made any other way carries exactly the same weight and the same response times.

You can also simply ask at the front desk on your next visit. Say what you want and who to contact you on; the request is written down and enters the same process.

A note on the state of the law

The Digital Personal Data Protection Rules were notified on 14 November 2025 with a phased commencement, and the substantive obligations — Data Principal rights among them — take effect from 14 May 2027. We are not waiting for the deadline: this page works now, and the response times above apply now. The longer version of that explanation is at the foot of the privacy policy.