Privacy Policy

We are committed to handling your information with the utmost care, discretion, and in full compliance with applicable Indian laws including the Digital Personal Data Protection Act, 2023 (DPDPA) and the guidelines issued by the Medical Council of India (MCI).

By accessing this website or submitting your information through any of our channels, you consent to the practices described in this policy.

Data Controller: Dr. Aditya Sarin, Consultant Medical & Haemato-Oncologist

Practice Location: Sir Ganga Ram Hospital, Old Rajinder Nagar, New Delhi – 110060

Website: dradityasarin.com

Associated Entities: CAN HOPE TRUST · ONCURA HAVEN ONCOLOGY

For the purposes of this policy, "we," "us," or "our" refers to Dr. Aditya Sarin and the team managing the Delhi Cancer Centre digital presence. "You" refers to any visitor, patient, or prospective patient who interacts with our website or services.

We collect information in the following categories depending on how you interact with us:

Information you provide directly:

• Full name, phone number, and email address (submitted via our appointment booking chatbot or contact forms)
• Appointment type, preferred date and time
• Medical history, diagnosis details, or reports you voluntarily share during consultation or via email
• Messages or queries submitted through our website or WhatsApp

Information collected automatically:

• IP address, browser type, operating system, and device type
• Pages visited, time spent, and navigation paths on our website
• Referral source (URL that directed you to us)
• UTM parameters and Google Click IDs (gclid) from advertising campaigns
• Cookie data (detailed in the Cookies section below)

Information from third parties:

• Referral information from other doctors or healthcare providers
• Publicly available contact information when you reach out via social platforms

Your information is used solely for the purposes described below. We do not use it for unrelated commercial activities.

• Appointment scheduling — processing, confirming, and managing bookings made through our website chatbot or phone
• Patient communication — sending confirmation emails, appointment reminders, and follow-up care instructions
• Clinical care — maintaining records of consultations, treatment plans, and medical correspondence when you become a patient
• Service improvement — analyzing website usage patterns to improve navigation and patient experience
• Marketing analytics — attributing website visits to advertising sources (Google Ads, organic search) via UTM and gclid data to optimize our campaigns
• Legal compliance — meeting our obligations under Indian healthcare regulations and applicable law
• Second opinion requests — reviewing documents or reports you share for a medical second opinion

Medical and health-related information is classified as sensitive personal data under the DPDPA and is treated with the highest level of protection.

Any health information you share — including cancer diagnosis details, treatment history, pathology reports, or imaging — is used exclusively for:

• Facilitating your consultation with Dr. Aditya Sarin
• Enabling multidisciplinary tumor board discussions relevant to your care (with your consent)
• Generating second opinion reports or treatment recommendations
• Coordinating care with other treating physicians at Sir Ganga Ram Hospital if required

Patient records maintained through Sir Ganga Ram Hospital are subject to the hospital's own privacy and records management policies, in addition to this policy.

We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:

• Service providers: Third-party tools that power our website operations (hosting, email delivery, appointment calendar systems). These providers are contractually required to protect your data and may not use it for their own purposes.
• Healthcare coordination: With other treating physicians, labs, or hospitals when necessary for your medical care and with your knowledge.
• Legal obligations: When required by law, court order, or regulation — for example, mandatory reporting of certain medical conditions under Indian public health law.
• Consent-based sharing: In cases where you explicitly authorize us to share your information (e.g., for a referral or a telemedicine second opinion platform).

Our appointment booking system is hosted on a secure backend server. Booking data (name, phone, email, appointment slot) is stored on that server and transmitted to Dr. Sarin's practice management system. No booking data is shared with advertising platforms.

Our website uses cookies and similar tracking technologies to understand how visitors use the site and to measure the effectiveness of our advertising.

Types of cookies we use:

• Essential cookies — required for the website to function (session management, security)
• Analytics cookies — Google Analytics to measure page views, session duration, and traffic sources
• Advertising cookies — Google Ads (gclid, conversion tracking) to measure which ad campaigns lead to appointment bookings
• Functional cookies — to remember your preferences during a visit

We do not use cookies to build advertising profiles or track you across unrelated third-party websites for commercial targeting beyond our own Google Ads campaigns.

You may disable cookies in your browser settings. Note that disabling cookies may affect the functionality of our appointment booking widget.

We retain your information for as long as necessary for the purposes described in this policy:

• Appointment booking data — retained for a minimum of 3 years to allow for follow-up care and regulatory compliance
• Medical records and clinical correspondence — retained for a minimum of 7 years as required under Indian Medical Council regulations
• Website analytics data — retained for up to 26 months (Google Analytics default)
• Email correspondence — retained as long as clinically or administratively relevant
• Marketing / UTM data — retained for up to 12 months for campaign analysis

After applicable retention periods, data is securely deleted or anonymized. You may request early deletion of non-clinical data (see Your Rights below).

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

• Right to Access — request a copy of the personal data we hold about you
• Right to Correction — request correction of inaccurate or incomplete information
• Right to Erasure — request deletion of your personal data, subject to legal retention requirements (we cannot erase medical records during their mandatory retention period)
• Right to Grievance Redressal — lodge a complaint with us if you believe your data has been misused
• Right to Nominate — nominate another person to exercise your rights in the event of death or incapacity
• Right to Withdraw Consent — withdraw consent for processing where consent is the legal basis, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at the details provided at the bottom of this page. We will respond within 30 days of receiving your request.

We implement reasonable technical and organizational safeguards to protect your data from unauthorized access, disclosure, alteration, or destruction:

• HTTPS encryption for all data transmitted through our website
• Access-controlled backend servers for appointment data storage
• Restricted access to patient data — only authorized personnel may access records
• Regular security reviews of our digital systems
• Staff training on data confidentiality and professional obligations

While we take these precautions, no system is completely impenetrable. We encourage you not to share sensitive medical information over unsecured channels. For sending medical reports, please use our email (Dradityasarin@gmail.com) or hand-carry documents to the clinic.

In the event of a data breach that is likely to result in a risk to your rights, we will notify affected individuals and the Data Protection Board of India as required under the DPDPA.

Our website is not directed at children under the age of 18. We do not knowingly collect personal data from minors through our website forms or chatbot.

In cases where a child is the patient (pediatric oncology consultations), all personal and medical data is collected from and managed in coordination with the child's parent or legal guardian, who provides consent on the child's behalf.

If you believe we have inadvertently collected personal data from a minor without appropriate parental consent, please contact us immediately and we will take steps to delete such information.

Our website may contain links to third-party websites, including Sir Ganga Ram Hospital, health information portals, and social media platforms. Clicking these links will take you to websites governed by their own privacy policies.

We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policy of any website you visit before submitting personal information.

Third-party services we use that may process your data:

• Google Analytics (website analytics)
• Google Ads (advertising and conversion tracking)
• WhatsApp Business (via Meta, for patient communication)
• Email service provider (for appointment confirmations)

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect how we handle sensitive health data, we will make reasonable efforts to notify active patients by email.

We encourage you to review this page periodically. Your continued use of our website after any changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

We aim to acknowledge all privacy-related queries within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is operationalized under the DPDPA 2023.