Privacy policy

1. Who this notice is from

Apex Multispecialty Clinic is a multispecialty clinic in Bengaluru, Karnataka, India. This website is operated by the clinic.

Under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), the clinic is the Data Fiduciary for the personal data described here — that is, we decide why and how it is processed. You are the Data Principal. Health information is also “sensitive personal data or information” under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which continue to apply to it.

You can reach us at info@apexmultispecialtyclinic.com, or by post at Apex Multispecialty Clinic, No. 1799, First Floor, 8th Main Road, Judicial Layout, Yelahanka, Bengaluru 560064, Karnataka, India.

2. Two different sets of information

The most important thing to understand about this policy is that we hold two kinds of information about people, and they are handled very differently.

• Website information. What you type into the enquiry form, and anonymous statistics about how the site is used. This is what most of this policy is about. It is small, it is kept for a limited time, and you can ask us to delete it.
• Clinical records. Your history, examination findings, test results, prescriptions and bills. These are created when you are seen at the clinic, in person. They are not created on this website and they are not stored on it. They are kept under medical record-keeping duties, which means we cannot simply delete them on request — see section 9.

Nothing you enter on this website becomes part of your clinical record unless you go on to be treated at the clinic and a doctor decides it is clinically relevant.

3. What the website collects

3.1 The enquiry form

When you submit an enquiry, we receive exactly these fields:

• your name;
• your phone number;
• your email address;
• the speciality you would like to see, if you choose one;
• your free-text message.

3.2 Usage statistics

If — and only if — you accept analytics on the cookie banner, we collect anonymous information about how the site is used: cookie identifiers, your IP address, your device and browser type, which pages you viewed, how long you stayed, and which site or advertisement sent you here. This tells us which pages people actually read. It does not tell us who you are, and we never link it to an enquiry or to a patient record.

Full detail of every item set on your device is in our cookie notice.

3.3 What the website does not collect

• No payments are taken on this site, so we hold no card or bank details from it.
• There is no patient login and no facility to upload reports or images.
• We do not ask for your government ID number on this website.
• No part of your clinical record is accessible through this website.

4. What we collect at the clinic

This is separate from the website, but you should know what it covers. When you attend the clinic we record: your identity and contact details, your medical and family history, your current medicines and allergies, examination findings, the results of investigations carried out on site (for example ECG, echocardiography, treadmill testing or Holter monitoring), diagnoses, prescriptions, referral letters, and billing and insurance details where they apply.

We collect this because we cannot treat you safely without it. It is used to care for you, to follow up, to prepare your reports, to bill you, and to meet the record-keeping and reporting duties that apply to a clinical establishment.

5. Why we use each item

• Name, phone and email from the form — so that we can reply to your enquiry, offer an appointment slot, and confirm or reschedule it.
• Preferred speciality — so the enquiry reaches the right doctor’s list rather than a general queue.
• Your message — so that we understand what you are asking for before we call you back.
• Usage statistics — to see which pages are read and which are ignored, to find broken or slow pages, and to judge whether an advertisement was worth running.
• Clinical information — to diagnose and treat you, to keep your record accurate over time, to issue your reports and prescriptions, to bill you, and to comply with law.

We do not use any of it to build a profile of you, and we do not sell it. We will not send you marketing messages you did not ask for.

6. Our legal basis

For everything collected through this website, our basis is your consent under the DPDP Act. You give it by submitting the enquiry form, and separately by choosing “Accept” on the cookie banner. Consent has to be free, specific, informed and unambiguous, and you can withdraw it as easily as you gave it.

For the care we provide at the clinic, we also rely on the legitimate uses the DPDP Act recognises, including the provision of medical treatment and the handling of a medical emergency, and on the record-keeping obligations that apply to registered medical practitioners and clinical establishments. Withdrawing consent does not require us to delete a clinical record we are obliged to keep.

Because health information is sensitive personal data under the 2011 Rules, we treat it to that higher standard as well: collected only for a lawful purpose connected with our function, retained no longer than needed, and not disclosed to a third party without your permission unless the law requires it.

7. Who else can see it

We use a small number of service providers to run the website and to reach you. They process data on our instructions and for no purpose of their own. We do not name individual employees; these are the categories and the companies behind them:

• Website hosting — Vercel. Serves the pages you are reading and keeps short-lived server logs.
• Database — Supabase, Mumbai region. Where an enquiry is stored once you submit it. The region is chosen deliberately: the data sits in India.
• Analytics — Google. Google Tag Manager, and the measurement tags configured inside it. Usage statistics only, and only after you accept.
• Transactional email — Resend. Delivers the notification of your enquiry to the clinic and any confirmation we send back to you.
• Messaging — WhatsApp (Meta). Only if you choose to message us there. A WhatsApp conversation is delivered through Meta’s service, on their terms, not ours.
• The clinic’s email provider, which carries mail sent to our Bengaluru mailboxes.

Beyond that, we share information only with a doctor or laboratory we are referring you to, with your insurer or employer when you ask us to, and with a public authority when the law obliges us — for example a notifiable disease report or a court order. We will tell you when that happens unless we are barred from doing so.

8. Where it is stored

Enquiries are stored in India. The database sits in the Mumbai region, and the clinical records themselves are held at the clinic in Bengaluru.

We should be straightforward about one exception. Anonymous usage statistics are processed by Google on its own global infrastructure, which is partly outside India. That data carries no health information, no name, no phone number and no email address. If you would rather it never left the country, decline analytics on the banner — the site works exactly the same way.

9. How long we keep it

• Enquiries: 24 months from your last contact with us, then deleted. If you become a patient, the clinically relevant part is copied into your record and the rest is still deleted on that schedule.
• Usage statistics: retained by our analytics provider for up to 14 months, then aggregated or removed.
• Your consent preference: stored on your own device until you clear it.
• Clinical records: kept for at least three years from the date treatment commenced, as medical record-keeping requirements demand, and in practice longer where a condition is being followed over years or where a claim, insurance matter or statutory requirement makes it necessary.

This is the point where the two sets of information really diverge. You can ask us to erase an enquiry and we will. You can ask us to erase a clinical record and, in most cases, we will have to say no and explain why.

10. Your rights

As a Data Principal under the DPDP Act, you have the right to:

• Know what we hold. Ask for a summary of the personal data we are processing about you, what we are doing with it, and who we have shared it with.
• Have it corrected or completed. If a phone number, a spelling or a date is wrong, tell us and we will fix it. This matters more in a clinic than anywhere else.
• Have it erased, where we no longer need it for the purpose you gave it for and no law requires us to keep it.
• Raise a grievance with us about how we have handled your data, and to escalate to the Data Protection Board of India if our answer does not satisfy you.
• Nominate someone to exercise these rights on your behalf if you die or become unable to act for yourself.
• Withdraw your consent at any time, as easily as you gave it. Withdrawal works from that moment on; it does not undo processing that already happened lawfully.

How to exercise them

Email grievance@apexmultispecialtyclinic.com and say what you want. We may ask you a question or two to satisfy ourselves that you are who you say you are — we are not being obstructive; handing a medical record to the wrong person is the worst thing we could do. We will respond within 30 days.

Asking for a copy of your own clinical record is simpler and faster: ask at the clinic, and the documents are issued within 72 hours of the request, in line with the record-keeping duty that applies to registered medical practitioners. See patient rights and grievance redressal.

11. Children

This website is not aimed at children and the enquiry form is meant to be filled in by an adult. If you are under 18, please ask a parent or guardian to contact us on your behalf.

Children are of course treated at the clinic. Where a child is a patient, we take consent from the parent or guardian, we collect only what the child’s care requires, and we do not use a child’s data for any form of tracking or advertising. If you believe a child has submitted an enquiry through this site, write to us and we will delete it.

12. How we protect it

• The whole site is served over HTTPS, so what you type in the form is encrypted in transit.
• Enquiries go to a database with access controls; only staff who need to answer enquiries can read them.
• Clinical records are kept separately from anything the website can reach. The website has no route into them.
• Access is given by role and removed when a person leaves.
• Staff are instructed never to discuss a patient, or post about one, on social media or in a WhatsApp group.
• Our service providers are bound by contract to protect what they process for us.

No system is perfect, and we will not pretend otherwise. If a breach affects your personal data we will tell you without delay, in plain language, and explain what happened and what you should do. We will also report it to the Data Protection Board of India within the time the law allows.

13. Grievance Officer

Grievance Officer: to be appointed. The clinic will publish the officer’s name on this page as soon as the appointment is made. In the meantime, every request sent to the address below is handled by a senior member of the clinic team, within the same time limit.

Email: grievance@apexmultispecialtyclinic.com
We will respond within: 30 days of receiving your request.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India. Complaints about clinical care, rather than about data, follow a different route — set out on the patient rights page.

14. Changes to this policy

When we change how we handle data, we change this page and move the date at the top. If the change is a significant one — a new purpose, or a new category of recipient — we will say so prominently on the site rather than hoping you notice.

15. A note on the state of the law

The DPDP Act, 2023 was passed in August 2023, and the Digital Personal Data Protection Rules that operationalise it were notified on 14 November 2025 with a phased commencement: the Data Protection Board and the commencement provisions took effect immediately, the registration of Consent Managers from November 2026, and the substantive obligations — notice, consent, security safeguards, breach reporting, children’s data and Data Principal rights — from 14 May 2027. Section 43A of the Information Technology Act, 2000 stands repealed from the same date.

Until then the 2011 Sensitive Personal Data rules continue to govern health information, and both frameworks are reflected above. We are not waiting for a deadline: the clinic is applying these standards now. A Consent Manager — the registered intermediary through which the Act allows you to give, manage and withdraw consent from one place — is not something the clinic uses today. If we ever adopt one, this page will say so before it happens.