Privacy Policy

1. Data Fiduciary Details

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), DermaTales acts as the Data Fiduciary responsible for determining the purpose and means of processing your personal data.

• Clinic Name: DermaTales Skin, Hair & Aesthetic Clinic
• Registered Clinics:
  • Gurugram Clinic: Sector 31, Gurugram, Haryana, India
  • Delhi Clinic: Back Side, 25/4, Block 25, East Patel Nagar, New Delhi 110008, India
• Website: https://www.dermatales.com
• Contact Phone: +91 95600 15155
• Grievance & Data Protection Desk: care@dermatales.com

2. Personal Data We Collect

We only collect personal data that is necessary for coordinating healthcare consultations, responding to clinical inquiries, and scheduling appointments:

• Identity & Contact Data: Your name, phone number, email address, and preferred clinic location when voluntarily submitted via our website appointment and consultation forms.
• Voluntary Clinical Inquiry Data: General descriptions of skin, hair, or aesthetic concerns that you choose to include in the message field of our enquiry forms to assist in routing your consultation.
• Appointment Scheduling Details: Preferred appointment date, preferred time, and consultation type (in-person clinic visit or follow-up).
• Technical & Log Data: Basic technical metadata collected automatically through secure server logs, such as IP addresses, browser types, referring pages, and device information to maintain website security, prevent spam, and improve site performance.

Note: Comprehensive medical history, diagnostic clinical photographs, and formal prescription records are collected and maintained strictly during in-person consultations at our registered physical clinics under medical confidentiality and Indian Medical Council / NMC record-keeping guidelines.

3. Purpose and Legal Grounds for Data Processing

We process your personal data under the following legitimate grounds recognized under Section 4 and Section 6 of the DPDP Act, 2023:

• Informed Consent (Section 6, DPDP Act 2023): When you fill out an enquiry or appointment form on our website, you provide explicit, revocable consent for us to use your contact details to communicate regarding your appointment.
• Healthcare Service Delivery: To confirm, schedule, reschedule, or remind you of clinical appointments with our doctors.
• Responding to Queries: To answer questions submitted regarding clinical procedures, clinic timings, fees, and location details.
• Legal & Regulatory Compliance: To comply with applicable statutory laws, including the National Medical Commission (NMC) Act, Clinical Establishments Act, and Information Technology Act, 2000.

We do NOT:

• Sell, rent, or trade your personal or health data to third-party brokers, advertisers, or pharmaceutical companies.
• Engage in aggressive marketing or unsolicited third-party promotions using your personal data.
• Use automated algorithms to make diagnostic decisions without registered medical practitioner oversight.

4. Explicit Consent Mechanism

In alignment with the DPDP Act, 2023, every data collection point on this website features a clear, unambiguous notice and affirmative consent mechanism. You are explicitly informed about what data is being collected and the exact purpose before submission. You retain the right to withhold or withdraw consent at any time.

5. Data Storage, Security & Retention

We deploy robust technical and organizational security measures to protect your Digital Personal Data against unauthorized access, loss, misuse, or alteration:

• Transport Security: All web traffic is encrypted using 256-bit Secure Sockets Layer / Transport Layer Security (SSL/TLS).
• Access Restrictions: Access to consultation submissions is restricted strictly to authorized clinic reception staff and medical personnel bound by professional confidentiality.
• Data Retention: Digital web enquiry data is retained only for the duration required to process the inquiry and coordinate appointment logistics, unless required to be retained longer under statutory medical documentation guidelines.

6. Data Principal Rights Under DPDP Act, 2023

As a Data Principal under the DPDP Act, 2023, you enjoy statutory rights regarding your personal data:

• Right to Access Information: You have the right to request a summary of your personal data processed by DermaTales and details of any processing activities.
• Right to Correction & Erasure: You may request the correction of inaccurate or misleading data, updating of incomplete data, or erasure of personal data that is no longer required for the purpose for which it was collected.
• Right of Grievance Redressal: You have the right to have your data protection grievances addressed promptly by our designated Data Protection Officer.
• Right to Nominate: You have the right to designate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
• Right to Withdraw Consent: You may withdraw your consent for future communication at any time by contacting us at care@dermatales.com.

7. Disclosure to Service Providers

We may share limited personal contact data with trusted technical infrastructure partners who assist our operations (such as secure cloud hosting providers, transactional SMS gateways, or WhatsApp Business API providers solely for sending appointment confirmations). All such partners operate under strict non-disclosure and data protection contracts in compliance with Indian law.

8. AI-Generated & Illustrative Content Notice

In compliance with healthcare communication standards, certain visual illustrations, diagrams, or content on this website may be created or assisted by artificial intelligence (AI). Such content is strictly illustrative and educational. It does not represent actual clinical before-and-after guarantees, nor does it substitute for clinical evaluation by a Registered Medical Practitioner.

9. Cookies and Analytics

Our website uses minimal, functional cookies and anonymized website analytics (such as Google Analytics) to monitor website performance, navigation patterns, and user experience. You can modify your browser settings to decline cookies at any time without impacting your ability to browse informative content.

10. Grievance Redressal & Data Protection Officer

If you have any questions, concerns, or requests to exercise your rights under the Digital Personal Data Protection Act, 2023, please contact our designated Grievance Officer:

We are committed to acknowledging your data protection requests within 48 hours and resolving grievances within 30 days in accordance with the DPDP Act, 2023.