Privacy
Policy

Last updated: 15 October 2026  ·  Effective: 15 October 2026

1. Scope of this Policy

This Policy applies to personal data we process when you:

• visit or use the ANAVA Clinics website at anavaclinics.com;
• submit an enquiry, register your interest in a clinic, or request a consultation;
• contact us by email, telephone or any other channel;
• receive, or make enquiries about receiving, care or services from ANAVA Clinics; or
• are a record in the software platform operated by ANAVA Clinics.

This Policy does not apply to the independent practices of the specialists in our affiliated network, who are separate data fiduciaries in respect of records they hold in their own right. Where a specialist holds your records independently of us, their own privacy notice governs those records.

2. Personal data we collect

2.1 Data you give us directly

• Identity and contact data — your name, email address, telephone number, and city or preferred location.
• Enquiry data — the condition or concern you select, the free-text description of your situation, and any other information you choose to include in a message to us.
• Consent records — the fact, date, time and scope of any consent you give, and of any withdrawal of it.

2.2 Data we generate about you

• Correspondence records — notes of calls, emails and other communications with you.
• Clinical and treatment records — where you receive care from us, records of assessment, treatment protocol, session parameters, safety checks and follow-up, created through our software platform.

2.3 Data collected automatically

• Technical data — IP address, browser type and version, device type, operating system, referring page, and the pages you view on our site, together with the date and time of access.

We do not purchase personal data from data brokers, and we do not build advertising profiles about you.

3. Health data and why it is treated differently

Information about your physical or mental health — including the condition you tell us about, your treatment history, and any clinical records we create — is sensitive information. We treat it with a higher standard of care than other personal data:

• it is collected only where it is necessary for the purpose you approached us for;
• access is restricted to the smallest number of people who need it to do their work;
• it is encrypted in transit and at rest;
• it is never used for marketing, and never sold, rented or traded;
• every access to a clinical record in our software platform is logged.

Please share only what is necessary in a website form. If you need to discuss detailed clinical history, we will arrange a secure channel or a consultation.

4. Why we process your data

We process your personal data for the following purposes, and no others without your further consent:

• To respond to your enquiry — to contact you, answer your questions, and assess whether our services are appropriate for you.
• To book and manage appointments — scheduling, reminders, rescheduling, cancellations, payments and refunds.
• To provide care and services — to assess, plan, deliver, record and follow up treatment, and to coordinate with a treating clinician.
• To operate and secure our software platform — authentication, access control, audit logging, backup, and incident investigation.
• To meet legal and regulatory obligations — including record-keeping, tax, and responding to lawful requests from authorities.
• To improve our website and services — using aggregated or de-identified information wherever it will serve the purpose.

5. Consent and its withdrawal

Where we rely on your consent, we ask for it clearly and separately, we tell you what it covers, and we keep a record of it. You can withdraw your consent at any time by writing to contact@anavaclinics.com, marked for the attention of the Grievance Officer named in section 14.

Withdrawing consent is as easy as giving it. When you withdraw consent, we stop the processing that relied on it and delete or anonymise the data, unless we are required by law to retain it or it is needed for the establishment or defence of a legal claim — in which case we will tell you which of these applies. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Who we share data with

We do not sell, rent or trade your personal data. We share it only in the following circumstances:

• Treating clinicians and affiliated specialists — where it is necessary for your care, and with your knowledge.
• Data processors acting on our instructions — cloud hosting, email delivery, payment processing, and similar service providers, each bound by a written agreement that limits them to processing on our instructions, requires appropriate security, and prohibits use of your data for their own purposes.
• Professional advisers — auditors, lawyers and insurers, where relevant and under a duty of confidence.
• Authorities — where disclosure is required by law, by an order of a court, or by a competent authority acting under statutory powers.
• In a corporate transaction — if our business is reorganised, merged or acquired, subject to the acquirer being bound to this Policy or a policy no less protective; we will notify you of any material change.

7. Our software platform and hosting

ANAVA Clinics designs and builds its clinical software platform in-house, with our technology team in Pune. The platform records intake, treatment protocols, session parameters and follow-up so that care is traceable and nothing depends on paper or memory.

The platform and this website are hosted on infrastructure operated by reputable cloud service providers. We select providers that maintain recognised security certifications, and we configure our environments so that data is encrypted in transit and at rest, access is controlled and logged, and backups are taken regularly.

We aim to store and process personal data on infrastructure located in India. Where a service provider necessarily processes data outside India, we do so only where permitted by applicable law, only with providers who offer contractual safeguards for the protection of that data, and not to any country or territory to which transfer is restricted by the Government of India.

8. How we protect your data

We maintain technical and organisational security measures appropriate to the sensitivity of the data we hold, including:

• encryption of data in transit (TLS) and at rest;
• role-based access control, with access granted on a need-to-know basis and reviewed periodically;
• multi-factor authentication for administrative and clinical access;
• audit logging of access to clinical records;
• regular backups, with restoration tested periodically;
• confidentiality obligations binding our personnel and contractors;
• a documented process for identifying, containing and reporting security incidents.

No system can be guaranteed to be perfectly secure. If you believe your data or your access to our services has been compromised, please contact us immediately at privacy@anavaclinics.com.

9. How long we keep your data

• Enquiries that do not lead to care — retained for up to 24 months from your last contact with us, then deleted or anonymised.
• Registrations of interest — retained until we have followed up on your interest, or until you withdraw, whichever is earlier.
• Clinical and treatment records — retained for the period required by applicable medical record-keeping requirements and by the law of limitation, and no longer than necessary thereafter.
• Consent and withdrawal records — retained for as long as needed to evidence our compliance.
• Accounting and tax records — retained for the period required by law.

When a retention period ends, we delete the data or irreversibly anonymise it.

10. Your rights

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we process about you, and of the processing activities we undertake.
• Correction and completion — have inaccurate or misleading data corrected, and incomplete data completed or updated.
• Erasure — have your data deleted where it is no longer needed for the purpose it was collected for and we are not required to retain it.
• Withdraw consent — as described in section 5.
• Grievance redressal — a readily available means of raising a complaint with us, as described in section 14.
• Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, write to privacy@anavaclinics.com. We will verify your identity before acting, and we will respond within 30 days. There is no charge for exercising your rights.

Where a request concerns clinical records, we may need to involve your treating clinician, and there are limited circumstances in which access may be restricted — for example where disclosure would reveal information about another person. We will always tell you if we restrict a request, and why.

11. Children's data

We do not knowingly collect personal data of a child under the age of 18 through this website. Where care or services involve a person under 18, we process their data only with the verifiable consent of a parent or lawful guardian, we do not undertake tracking or behavioural advertising directed at them, and we do not process their data in any way likely to cause them detrimental effect. If you believe a child has provided us data without such consent, contact the Grievance Officer and we will delete it.

12. Cookies and website analytics

Our website uses only those cookies and similar technologies that are necessary for the site to function and to keep it secure. We do not use advertising or cross-site tracking cookies, and we do not sell website data.

Where we measure how the site is used, we do so in aggregate and do not use it to identify individual visitors. You can block or delete cookies through your browser settings; the site will continue to work, though some features may behave differently.

13. Breach notification

If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India in the manner and within the timeframes required by applicable law. Our notification will describe, so far as we know it, the nature of the breach, its likely consequences, the measures we have taken, and what you can do to protect yourself.

14. Grievance Officer and how to complain

In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address complaints about the processing of personal data.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

15. Changes to this Policy

We may update this Policy to reflect changes in our services, our technology, or the law. The "Last updated" date at the top of this page always shows the current version. Where a change materially affects how we process your data, we will take reasonable steps to notify you — by email where we hold your address, and by a notice on this website.

Contact us

For any question about this Policy or about how we handle your data:

ANAVA Clinics Private Limited
One North Apartment, H1601, Magarpatta,
Hadapsar I.E., Pune City, Pune 411013,
Maharashtra, India
CIN: U86904PN2026PTC260599
Email: contact@anavaclinics.com
Privacy and data protection: privacy@anavaclinics.com
Grievance redressal: grievance@anavaclinics.com
Telephone: +91 724-9310743

See also our Terms of Use and Medical Disclaimer.