Privacy Policy

This website is operated by Hitex Health Nest — Acupuncture and Chiropractic Center, a poly clinic at Hitex Health Nest, 3rd Floor, 301, Sai Jyothi Apartments Society, beside Aditya Sunshine Lane, Hanuman Nagar, Shilpa Hills, Hyderabad, Telangana 500084. Consultations are provided by Dr. Bhaskar Reddy.

For the purposes of India’s data protection framework, the clinic is the data fiduciary for the information described below — it decides why and how that information is processed.

We ask for the minimum needed to hold an appointment and contact you about it. There is no account, no password and no patient login on this website.

• Name, age, and mobile numberTo identify your booking and to reach you about timing. The mobile number is also where your WhatsApp confirmation is sent.
• Email address (optional)Only if you give one. Used for booking correspondence.
• Gender and city (optional)Helps the clinic prepare for your visit. You may leave both blank.
• Preferred languageSo the doctor consults with you in a language you are comfortable in.
• Service, preferred date, backup date and timeTo schedule the appointment.
• What you write in “tell us a little more”Your own description of your concern. This is health information, and it is shared with the doctor so they can prepare for your consultation.
• Payment identifiersThe Razorpay order and payment reference and the amount, so a payment can be reconciled with your booking.

What we deliberately do not collect: medical history, current prescriptions, test results, scans, or any uploaded document. This website has no upload feature at all. If the doctor needs those, our team asks you for them on WhatsApp, and you share them directly with the clinic.

We also never see or store your card number, CVV, UPI ID or UPI PIN. Those are entered on Razorpay’s own secure checkout and never pass through this website.

Currently: this website does not take online payments. No payment is made when you book, so no payment identifier is created and nothing at all is sent to a payment processor. The paragraphs above describe what happens if online payment is offered again.

Before a booking can be submitted you must tick a consent checkbox. Because your description of your concern is health information, that consent is specific and is asked for separately from the act of filling in the form.

You can decline it and simply call the clinic on +91 97421 12342 instead — booking through this website is optional.

Withdrawing consent. You may withdraw your consent at any time by contacting us using the details in section 12. Withdrawal applies going forward: it does not undo processing already carried out, and we may still need to keep certain records where the law requires it (for example, payment records for accounting). If you withdraw consent before your appointment, we will treat it as a cancellation request.

We do not sell your information, and we do not use it for advertising. It is shared only with the service providers below, and only to the extent each one needs.

• Razorpay Software Private Limited (payments)Receives the payment amount, a booking reference, and the contact details you enter into their checkout. They are the payment processor and hold your card or UPI details, not us. Razorpay is an Indian company and processes this data under its own privacy policy.
• Supabase (database hosting)Stores the appointment record described in section 2. Access is restricted to the clinic’s server; the database is not readable from your browser or by other visitors. Supabase is a non-Indian provider and the data may be stored on servers outside India — see section 8.
• Meta Platforms (WhatsApp Business)Receives your mobile number and the confirmation message so it can be delivered. The message sent to the clinic’s own number includes your booking details and your description of your concern, because the doctor needs that context before your visit.
• Vercel (website hosting)Hosts this website and its server functions. Handles the request as it passes through, and keeps short-lived operational logs — see section 6.

We may also disclose information where we are legally required to, for example in response to a lawful order from a court or authority.

The chat assistant is not an AI service and does not send anything anywhere. It runs entirely inside your own browser, matching what you type against a fixed list of answers written by the clinic. Nothing you type into it is transmitted to us or to any third party, nothing is stored, and the conversation is forgotten when you close the tab.

It cannot diagnose you or recommend medicines, by design, and it is never trained on anything you or any other patient says to it.

This website sets no advertising or analytics cookies, and we use no analytics or tracking service. There is no cookie banner because there is nothing to consent to.

Your personal and health details are never stored in your browser’s local storage or session storage, and never placed in a URL or query string.

Our hosting provider keeps short-lived technical logs of requests, which include IP addresses, as every web server does. Our own application logs are written so that they carry a service name and an internal reference only — phone numbers, names and your description of your concern are deliberately kept out of them.

Appointment records, including your contact details, are kept for approximately 3 years and then removed or anonymised. Payment reconciliation records are kept for as long as tax and accounting law requires.

Clinical records created during an actual consultation are held separately by the clinic under medical record-keeping rules, which require longer retention than this website’s booking data. Your WhatsApp conversation remains in the clinic’s WhatsApp account.

Some of the providers in section 4 — notably our database and website hosting — may store or process data on servers located outside India. Where that happens, it is done under those providers’ contractual and security commitments. If you would prefer your details not to be handled this way, please book by telephone on +91 97421 12342 instead.

• Encrypted in transitThe whole site is served over HTTPS and connections are forced to it.
• Restricted database accessRow Level Security is enabled on every table and no client-side key can read them. Only the clinic’s server can query appointment data.
• Server-side payment verificationPayment status is confirmed cryptographically with Razorpay on our server. A browser cannot declare a payment successful.
• Minimised loggingPersonal and health details are kept out of application logs.
• No credentials in the browserEvery API key and secret lives on the server; none is included in the code sent to your device.

No system can be guaranteed completely secure, and we do not claim otherwise. What we can say is that the measures above are actually implemented, not merely intended.

If we become aware of a security incident affecting your personal data, we will investigate it, take steps to contain it, notify the relevant authority where we are required to, and inform affected patients where the incident is likely to affect them. Notification will describe what happened, what information was involved, and what you can do about it.

Subject to applicable law, you may ask us to:

• AccessTell you what personal data about you we hold and who it has been shared with.
• Correct or completeFix anything inaccurate, or fill in anything incomplete.
• EraseDelete your details where we are not legally required to keep them.
• Withdraw consentStop further processing based on your consent — see section 3.
• NominateName someone to exercise these rights on your behalf if you are unable to.
• Raise a grievanceComplain about how we have handled your data — see section 12.

We will respond within a reasonable period. We may need to verify your identity first, so that we do not disclose one patient’s information to another.

To exercise any of the rights above, or to raise a concern about how your data has been handled, contact the clinic directly. Please say clearly that your message is a data protection request so it reaches the right person.

If you are not satisfied with our response, you may escalate the matter to the relevant data protection authority in India.

Appointments for children are booked by a parent or guardian, who provides the child’s details and gives consent on their behalf. We do not knowingly collect information directly from a child through this website, and we do not profile children or target any advertising at them — we run no advertising at all.

If we change how we handle your information, we will update this page and change the effective date at the top. Where a change is significant, we will make it clear rather than relying on you to notice.

Information on this website is general and is not a diagnosis, a treatment plan, or a substitute for consulting the doctor. Booking an appointment does not create a doctor–patient relationship until you are actually seen at the clinic. Treatment decisions are made by Dr. Bhaskar Reddy during consultation.

If you are experiencing a medical emergency, call 108 or go to the nearest emergency department. Do not use this website.