Privacy Policy

Who We Are

This Privacy Policy applies to the following entity, which is the data fiduciary (controller) for your personal data:

This policy governs all personal data collected through our websites (cosmeticsurgerynagpur.com and mayflowerclinic.in), our WhatsApp Business line, our contact forms, and any in-person clinical interaction.

Applicable requirements include medical confidentiality duties, the Information Technology Act and relevant rules, and the Digital Personal Data Protection Act, 2023 and rules as their provisions come into force. The DPDP framework has phased commencement; this policy does not imply that every provision is already operational.

Information We Collect

We collect information in the following ways:

Information you provide directly

• Name, phone number, and email address when you submit an enquiry or contact form
• Medical history, current medications, allergies, and surgical goals when you attend a consultation
• Photographs taken for clinical documentation purposes (pre- and post-procedure), collected only with your explicit written consent
• Billing and transaction information needed for invoices, receipts and payment administration
• Messages and communication sent to us via WhatsApp, email, or phone

Information collected automatically

• Browser type, device type, operating system, and IP address when you visit our website
• Pages viewed, time spent on pages, and navigation patterns (via Google Analytics — see Section 6)
• Referring website or search query that brought you to our site

Information not needed for routine enquiries

• Do not include payment card numbers, bank account details, banking passwords or one-time codes in a routine enquiry
• Do not send Aadhaar, PAN or other identity documents in an initial enquiry. If documents are needed for care or administration, ask why they are required and how to provide them
• Do not share social-media credentials or passwords

How We Use Your Information

Your information is used solely for the following purposes. We will not use it for any purpose not listed here without obtaining your consent first.

• To provide medical care — maintaining your clinical records, tracking treatment history, and coordinating follow-up care
• To respond to enquiries — calling, messaging, or emailing you in response to a contact form or WhatsApp message
• To confirm and manage appointments — sending reminders and post-procedure follow-up instructions
• To process payments — issuing invoices and receipts for procedures
• Website and advertising measurement — understanding website use and measuring advertising responses through Google Analytics and Google Ads, as described in Section 6
• To comply with legal obligations — maintaining records as required under applicable medical and tax regulations in India

Data Sharing & Disclosure

Mayflower Clinic does not sell, rent, or trade your personal information. Disclosure occurs only in the following limited circumstances:

Service providers (data processors)

We may share minimal data with trusted vendors who help us operate our services:

• Google services — Google Analytics 4, Google Ads measurement and embedded Google Maps can process website activity and device information under Google's privacy terms. See Section 6 for tracking details.
• Meta Platforms Inc. — if you contact us via Facebook Messenger or interact with our Facebook page, Meta's data policies also apply.
• WhatsApp Business — messages sent to our WhatsApp number are processed by Meta under their Business Data Processing terms.
• Payment providers — where a third-party payment service is used, its terms and privacy policy also apply. Ask the clinic which payment methods are available. Do not send card details, banking passwords or one-time codes through routine enquiry channels.

Third-party services may process information under their own terms and privacy policies. Using WhatsApp, Maps, video embeds or social media can share information with the relevant provider. Avoid sending intimate photographs or detailed medical records through routine enquiry channels.

Legal disclosure

We may disclose your information if required by a court order, regulatory authority, or applicable Indian law, or where necessary to protect the safety of a patient or third party.

Medical referrals

With your explicit consent, relevant medical history may be shared with a specialist or hospital in the context of your treatment or referral.

Data Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• SSL/TLS encryption for all data transmitted through our website (HTTPS)
• Access controls ensuring that clinical records are accessible only to authorised clinic staff directly involved in your care
• Password protection and limited-access storage for digital records
• Physical security measures for paper-based clinical records held at the clinic premises

Cookies & Tracking Technologies

Our website uses cookies — small text files placed on your device — to improve your browsing experience and understand site usage.

Types of cookies we use

• Essential cookies — Support site functions where used. Blocking them in your browser may affect those features.
• Analytics and advertising measurement — Google Analytics and Google Ads tags are present on this website. They can process identifiers, device or browser information, page visits and measurement events. Aggregated reports do not mean that all underlying information is anonymous. Google also processes information under its own policies.
• Preference cookies — Store settings such as language or region preferences if applicable.

Managing cookies

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our contact forms. Most modern browsers allow you to:

• View and delete cookies currently stored by websites
• Block cookies from specific sites or all sites
• Receive a notification before a cookie is placed

For guidance specific to your browser, visit the browser's official help documentation. To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-out Browser Add-on.

Your Rights as a Data Principal

You may contact the clinic with the requests listed below. Statutory rights and complaint routes apply subject to the relevant law, its commencement dates and lawful retention requirements:

• Right to Access — You may request a summary of the personal data we hold about you and the purposes for which it is being processed.
• Right to Correction — You may request that we correct inaccurate or incomplete data about you.
• Right to Erasure — You may request deletion of your personal data, subject to legal obligations that require us to retain certain clinical records (see Section 11).
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Grievance Redressal — You may raise a grievance with us and we will respond within a reasonable timeframe.
• Right to Nominate — You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

Contact us using the details in Section 13. We aim to respond to general privacy requests within 30 days. Medical-record requests follow applicable medical deadlines; the 2002 medical ethics regulations specify 72 hours for requests by patients, authorised attendants or legal authorities.

Children's Privacy

Elective cosmetic enquiries are generally intended for adults. Children may need reconstructive or other medical assessment; age-appropriate consent, parental or lawful guardian involvement and applicable legal requirements are addressed individually.

We do not knowingly collect personal data from individuals under the age of 18 without the verified consent of a parent or legal guardian. If a minor requires surgical consultation, consent forms must be completed and signed by the parent or legal guardian, who also takes responsibility for any data submitted on the minor's behalf.

If you believe we have inadvertently collected data relating to a minor without appropriate parental consent, please notify us at contact@mayflowerclinic.in and we will take prompt corrective action.

Third-Party Links

Our website contains links to external platforms including our YouTube channel, Facebook page, Instagram profile, and Google Maps. These are independent services with their own privacy policies.

Clicking any external link takes you off our site and into a platform governed by that provider's own terms and conditions. We are not responsible for the privacy practices of any third-party site and encourage you to review their policies before sharing any personal information with them.

Third-party platforms we link to or embed content from include:

• YouTube (Google LLC) — patient education videos
• Facebook / Instagram (Meta Platforms Inc.) — social media profiles
• Google Maps — clinic location embed
• Trustindex / Google Reviews — patient review widget

Sensitive Health Data

Medical and health-related information is classified as sensitive personal data under Indian law. We treat it with the highest level of care and apply the following additional safeguards:

• Medical records and personal enquiry details must not be included in advertising or analytics events or used to build advertising audiences. Website measurement can nevertheless reveal which pages a visitor views.
• Clinical photographs are taken only with your explicit written informed consent, which you may withdraw at any time
• Clinical photographs are used only for the purpose stated at the time of consent (e.g. surgical planning, progress tracking, or — with separate explicit consent — educational or website use)
• Your health records are accessible only to Dr. Pawan Shahane and directly involved clinical staff
• Sharing sensitive clinical information with insurers, researchers or other third parties requires an appropriate lawful basis and any necessary specific consent; legally required disclosures may apply.

Data Retention

We retain your data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

• Clinical records — retained according to applicable medical requirements and the needs of continuing care or legal proceedings. Regulation 1.3.1 of the 2002 medical ethics regulations specifies 3 years for indoor-patient records from the start of treatment; this is not a universal deletion deadline for every record
• Enquiry and contact form data — kept to respond to enquiries, arrange care and provide necessary follow-up. Contact the clinic about retention or deletion of a specific enquiry
• Website analytics data — retention depends on the active configuration and data type. Standard GA4 user-level and event-level retention settings are generally 2 or 14 months; aggregated reports may be retained differently
• Payment records — retained for the periods required by the tax, accounting and other laws applicable to the clinic and record type

After the applicable retention period, data is securely deleted or anonymised so it can no longer be linked to you as an individual.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Make the revised policy available on this page
• Where required by law, notify affected individuals directly

Please review this page periodically. Continued browsing is not consent to a new use of personal information. Where consent is required for a new purpose, it must be obtained separately.

Contact Us — Grievances & Data Requests

For privacy questions, data requests or grievances, contact us through the channels below. We aim to respond to general privacy requests within 30 days; shorter statutory deadlines, including those for medical records, take priority.

If you remain dissatisfied, you may use remedies available under the law applicable to your request. Access to the Data Protection Board process is subject to commencement and procedures of the relevant DPDP provisions.