Privacy Policy

1. Data Fiduciary & Scope

Avani Physio Care ("we", "our", "us"), founded and operated by Dr. Kruttika Suryavanshi (Reg. No: 2025/08/PT/014516), acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act).

This policy describes how we collect, process, protect, store, and dispose of your digital personal data when you visit our website (avaniphysiocare.in), book home-visit physiotherapy sessions across Thane, Mulund, and Powai, or interact with our clinical coordination channels.

2. Categories of Personal Data We Collect

In accordance with Section 5 of the DPDP Act, we only collect digital personal data that is strictly necessary for specified healthcare and administrative purposes:

• Identity & Contact Data: Patient full name, contact telephone/WhatsApp number, and email address.
• Residential Location Data: Exact residential address, apartment details, and landmark for administering home-visit clinical care.
• Clinical & Health Rehabilitation Data: Medical condition, prior surgeries, symptoms, pain severity, referring physician recommendations, and rehabilitation progress logs.
• Technical & Analytical Data: IP address, browser type, device identifiers, and aggregated session performance indicators collected subject to your cookie preferences.

3. Specified Purpose of Processing

Your personal data is processed solely under the lawful basis of your explicit consent (Section 6) for the following specified purposes:

• Scheduling, dispatching, and administering at-home clinical physiotherapy treatments and evaluations.
• Maintaining professional clinical treatment records in compliance with Indian healthcare regulations.
• Sending automated booking confirmations, calendar reminders, clinical exercise guides, and receipt invoices.
• Dispatching secure real-time visit notifications to the attending physiotherapist (Dr. Kruttika Suryavanshi) for punctual route planning.

4. Processing of Children's Personal Data (Section 9)

Avani Physio Care provides specialized pediatric rehabilitation. In strict compliance with Section 9 of the DPDP Act, 2023:

• We do not process the personal data of any individual under 18 years of age without verifiable consent from their parent or lawful guardian.
• We never track, profile, or direct behavioral targeted advertisements to children.
• A parent or lawful guardian must be physically present at the patient's residence during every pediatric treatment session.

5. Data Processors & Third-Party Disclosure

We do not sell, rent, or trade your personal or health data. To deliver reliable digital services, we engage trusted Data Processors bound by confidentiality:

• Database & Storage: Supabase Inc. (PostgreSQL database with Row Level Security and encrypted at rest).
• Hosting & Edge Infrastructure: Vercel Inc. (TLS 1.3 encrypted data transit).
• Transactional Email: Resend Inc. (Delivering booking confirmation and rescheduling notices).
• Real-Time Clinician Dispatch: Telegram Bot API (Automated real-time notification dispatch directly to Dr. Kruttika Suryavanshi for immediate visit dispatch and routing).
• Legal & Regulatory Authorities: Only when strictly mandated by Indian law or judicial court orders.

6. Technical & Security Safeguards (Section 8)

We implement reasonable technical and organizational security safeguards to prevent personal data breaches:

• Strict Row-Level Security (RLS) policies preventing public querying of patient records.
• Zero-PII server-side calendar availability checks ensuring no patient names or addresses are ever transmitted to browser clients during scheduling.
• HTTPS/TLS 1.3 encryption across all website communications and form submissions.
• Role-based administrative authentication for accessing clinical booking archives.

7. Rights of the Data Principal (Sections 11–14)

As a Data Principal under the DPDP Act, 2023, you have the following enforceable rights:

• Right to Access (Section 11): Request a summary of the personal data we hold about you and the identities of all data processors with whom it has been shared.
• Right to Correction & Erasure (Section 12): Request correction of inaccurate data, completion of incomplete data, or erasure of personal data that is no longer necessary for treatment purposes.
• Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time as easily as it was given, by emailing us at hello@avaniphysiocare.in.
• Right to Nominate (Section 14): You have the right to nominate any individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.

8. Grievance Redressal Officer & Escalation (Section 8(9) & 13)

In accordance with Section 8(9) of the DPDP Act, Avani Physio Care has designated a Grievance Redressal Officer to address your questions, requests, or privacy complaints:

Escalation to the Data Protection Board of India (DPBI): If your grievance is not redressed by our Grievance Officer within 30 days, or if you are unsatisfied with the resolution, you have the statutory right under Section 13(3) of the DPDP Act, 2023 to file a complaint directly with the Data Protection Board of India.