IVY Clinics, operated by IVY DENTAL CLINICS PRIVATE LIMITED, is a premium multi-specialty healthcare provider offering integrated dental, skin and hair care services. With a commitment to medical excellence, patient privacy, and compassionate care, we combine clinical expertise with modern technology to deliver safe, effective, and personalized treatment experiences.
Throughout this Privacy Policy, the terms “IVY Clinics”, “we”, “our”, or “us” refer to IVY DENTAL CLINICS PRIVATE LIMITED and all associated clinical operations, digital platforms, and service channels.
At Ivy Clinics, we are committed to protecting the privacy and security of our patients’ personal information. This policy outlines what data we collect, how we collect and use it, who can access it, any third-party sharing, applicable laws, use of tracking tools, your rights as a patient, and special provisions for minors.
Types of Data We Collect
We only collect personal data that is relevant for your healthcare and clinic services, adhering to the principle of data minimization (we do not gather extraneous sensitive information unrelated to treatment). The categories of data we collect include:
Personal Identification Details: Information to identify and contact you, such as your full name, phone number, email address, gender and date of birth (providing DOB is optional).
Medical and Health Information: Details necessary for providing medical care – for example, your medical history as shared during consultations, results of dental/skin/hair assessments, clinical photographs for treatment planning and progress tracking, prescriptions and medications, doctor’s notes and diagnostic test reports. (We limit health data collection to what is clinically relevant for your care and do not ask for unrelated sensitive personal details.)
Appointment and Service Data: Records about your interactions with our clinic services, like appointment bookings, visit history, preferred treatments or services, and any feedback or evaluation forms you complete.
Payment and Transaction Data: Data required to process and record payments, such as payment mode (e.g., credit card, UPI, etc.), transaction IDs, and billing details (like invoice information). Note: We do not store your card’s full number or payment credentials on our systems, in compliance with security standards – our payment processors handle sensitive card details and use tokenization so that actual card numbers are never retained by us.
Online Tracking & Technical Data: When you use our website or online services, we may collect technical data through cookies and similar technologies – for instance, your device information, IP address, pages visited on the Ivy Clinics website, and interactions with our online ads. This helps us understand website usage patterns and improve user experience.
Communication Data: Copies or logs of communications you have with us via various channels – for example, messages you send to our official WhatsApp number, call logs related to appointment scheduling, inquiries submitted through website forms, or chats with our AI chatbot/virtual assistant (for non-medical queries).
How We Collect Your Data
We collect personal data through several channels, always with your knowledge and consent. These include:
Website Forms: Information you submit on our website, such as when booking an appointment, sending a contact inquiry, or requesting details about a treatment. Our online forms ask for relevant contact and appointment information.
WhatsApp Communications: If you contact us or opt in via our WhatsApp Business API chat, we collect the information you provide (e.g. appointment requests or questions). We use an official WhatsApp Business service with your consent to send appointment reminders or updates.
Phone Calls: When you call our front desk or support lines, our staff may collect necessary details to schedule appointments or answer your queries (e.g. name, preferred time slot, service needed). These call interactions may be logged for appointment coordination and quality assurance.
In-Clinic Forms: During your visits to our clinics, you might fill out consultation or registration forms (digitally on a tablet or on paper). These forms collect medical and contact information required for your treatment and are entered into our secure system.
Social Media Lead Forms: If you engage with Ivy Clinics via social media ads or promotions (for example, fill out a Meta/Facebook Lead Form for an offer or consultation), the information you provide (such as name and contact info) is forwarded to us by that platform.
Analytics Tools: Our website uses third-party analytics like Google Analytics and Microsoft Clarity to automatically collect data on how users navigate the site (page views, clicks, etc.). This is done through cookies or scripts on our site. (See Analytics and Online Tracking section below for details.)
CRM/Patient Management System: All the data you provide is ultimately stored in our Clinic’s secure Customer Relationship Management (CRM) platform. This platform aggregates information from the website, calls, in-clinic visits, etc., and helps us manage appointments, medical records, and follow-ups in one secure place.
Email and Newsletters: If you subscribe to our newsletter or provide your email for updates, we will collect your email address and any communication preferences. We use this to send health tips, clinic news, or follow-up emails and you can unsubscribe at any time.
(All collection points will expressly inform you of the data being collected and its purpose, in line with transparency requirements. We ensure no data is collected without a valid purpose and consent.)
Role-Based Access and Confidentiality
We maintain strict internal controls so that only authorized personnel can access your personal data, on a need-to-know basis. Access to patient data is role-based, meaning different staff roles see only the information necessary for their duties. Our internal policy follows the principle of least privilege and doctor-patient confidentiality norms:
Medical Team (Doctors and Clinical Assistants): Have access to your medical records and health information. Doctors, dentists, dermatologists, and their medical assistants can view consultation notes, test results, and treatment plans in order to provide you care. They do not access your payment details or any marketing data. All medical staff are bound by medical confidentiality laws that prohibit sharing your health information without consent.
Administrative Staff (Front Desk and Appointment Coordinators): Have access to contact details and scheduling information. Our receptionists and coordinators can see your basic personal identifiers (name, phone, etc.) and appointment history to schedule visits or send reminders. They do not view your detailed medical history beyond the appointment reason or basic notes necessary for scheduling.
Management (Clinic Leadership): May access aggregated business performance data and overall clinic metrics. This could include statistics like the number of appointments, operational reports, or financial summaries. Management does not access individual patient medical records. Any review of data at the individual level by leadership (if ever required for issue resolution) is done under strict privacy controls.
Marketing Team: Has access only to marketing and analytics data, not to your medical or sensitive personal health records. For example, the marketing department may see website analytics, campaign performance data, or lead form metadata (e.g. which campaign a lead came from, basic contact info if you opted in). They use this data to improve our outreach and do not see medical consultation details. (The marketing team’s access is limited to ensure they cannot view or handle medical history or treatment information of patients.)
Every staff member is trained in confidentiality practices and is required to adhere to our privacy policy and professional ethics. By implementing access controls and staff training, we ensure that patient records are only seen by those who are authorized to see them. This role-based segregation of data access helps maintain the confidentiality of your health information at all times.
Sharing of Data with Third-Party Service Providers
We do not sell or rent your personal data to any third party. We only share your data with external third parties in specific scenarios where it is necessary to operate our services or required by law – and always with safeguards in place. Such third parties are typically service providers bound by confidentiality agreements and security obligations. Key examples include:
Payment Processors: When you make a payment for our services (e.g., online payment or card swipe at the clinic), the transaction is processed through trusted payment gateways. These payment processors receive the necessary billing information to process the payment (for instance, your transaction amount and card details). We ensure that these processors are compliant with applicable security standards – for example, they tokenise or encrypt card data and do not expose the full card number to us. We ourselves do not store your card number or CVV on our systems, in line with RBI regulations and good security practice. The payment processors only use your data to complete the transaction and are not permitted to use it for any other purposes.
Clinic Management System / CRM: We use a secure cloud-based Clinic Management Software (CMS) to store and manage patient records, appointments, and related data. This means some of your data (contact info, medical records, appointment details) resides on the servers of our CRM provider. The CRM is a dedicated system for healthcare practices, and the provider is contractually bound to protect your data with high security (encryption, access control) and to keep it confidential. They act as a data processor on our behalf, only processing your information to help us manage our services.
Analytics and Advertising Partners: We use certain analytics and advertising tools to understand how users interact with our website and to reach people who might benefit from our services. For instance, we use Google Analytics to track website traffic and user behavior, Microsoft Clarity for user experience insights, and the Meta Pixel (Facebook Pixel) for measuring the effectiveness of our Facebook/Instagram ads. These tools may collect data like your IP address, device ID, and browsing behavior on our site via cookies or similar trackers. We disclose the use of these tools in this policy because they involve user data collection by third parties. The data they gather is used in aggregate form (e.g., to see how many users visited a page or which ad brought you to our site). We do not receive personal identifiers like your name from analytics – and wherever possible, we enable privacy features (for example, IP anonymization in Google Analytics). These third-party platforms are not allowed to use the data for their own purposes beyond providing analytics/advertising services to us. (See also Analytics and Online Tracking below for more on how we use cookies and how you can control them.)
Cloud Hosting Providers: Ivy Clinics hosts its digital infrastructure on secure cloud servers provided by reputable companies. This could include cloud storage for our databases, backup services, and website hosting. Any personal data stored in the cloud is encrypted and protected by firewalls and other security measures. The cloud providers do not access the data; they merely store it on our behalf. We choose providers with strong security certifications to ensure your information remains safe in storage and transit.
WhatsApp Business API Provider: Our WhatsApp messaging for appointment reminders and updates is facilitated through an official WhatsApp Business API partner (approved by Meta). This means when we send you a WhatsApp notification (e.g., confirmation of an appointment or a follow-up message), it is transmitted via that secure third-party platform. They process your phone number and message content only to deliver the communication, and they are not allowed to use it for any other purpose. All WhatsApp communications are based on your opt-in or request (for example, you messaging us first or agreeing to receive updates).
In all cases, whenever we share data with any external service provider, we ensure there are contractual and technical safeguards. These third parties are required to maintain the confidentiality and security of the data we provide, and to use it only for the specified service on our instructions. Ivy Clinics will never share your personal information with outside parties for their own marketing or profit. The only other times we might disclose data are when required by law or a government authority (for example, a legal obligation to report certain information), and even then, we would only share the minimum necessary as permitted under applicable regulations.
Analytics and Online Tracking
Cookies and similar technologies: Ivy Clinics’ website uses cookies and third-party tracking technologies to enhance user experience and gather analytics information. Cookies are small text files stored on your device that help remember your preferences and activity. When you first visit our site, you may see a cookies notice; by continuing to use the site, you consent to our use of cookies as described here. You can control cookies through your browser settings, though disabling certain cookies may affect site functionality (for instance, booking forms or video content). Below are the main analytics/advertising tools we use and what they do:
Google Analytics (GA): We use Google Analytics (including GA4) to understand website traffic – e.g., which pages are most visited, how users navigate our site, and general location demographics of visitors. Google Analytics works by setting cookies in your browser and collecting data such as your IP address, device type, and on-site actions. This helps us improve the website and our services. Importantly, this data is aggregated and anonymized; we cannot identify you personally from GA reports. According to Google’s terms, we have updated our Privacy Policy to notify users of GA’s presence and data practices. Google Analytics may also use these cookies to provide us with analytical services, and Google’s privacy policy covers how they process data. If you wish, you can opt out of Google Analytics by using a browser add-on provided by Google or by adjusting ad settings.
Meta Pixel (Facebook Pixel): We have installed the Meta Pixel on our website, which is a snippet of code from Facebook/Meta. This pixel tracks when you take certain actions on our site (like clicking on an ad we posted that brought you to our site, or browsing certain pages). It helps us measure the effectiveness of our Facebook and Instagram advertising and allows us to reach people who have shown interest in our site. The Meta Pixel may collect information such as your Facebook User ID (if you are logged in), device info, and the specific page you visited. We do not see individual personal data from this; we get aggregated ad reports from Meta. However, Meta uses the data to optimize our ads and may use it for their own analytics. Our Privacy Policy discloses the use of the Meta Pixel and how it collects data for targeted advertising purposes. If you prefer, you can adjust your ad privacy settings on Facebook/Instagram or use browser extensions to block tracking. We only implement the Pixel in compliance with Meta’s policies, which require informing users and obtaining any necessary consent for cookie use.
Microsoft Clarity: This is a user experience analytics tool that records anonymized information about how users interact with our website (e.g., where users click or how they scroll on a page). Clarity helps us identify usability issues or improve our site design. The data collected might include mouse movements, scrolls, and clicks, but it does not capture any sensitive personal details (fields like passwords are automatically masked). All recordings are stored securely and used only for analytics. As with other tools, this usage is disclosed to users.
Advertising Cookies: Besides the Meta Pixel, we may occasionally use Google Ads or similar platforms, which also deploy cookies if you interact with our ads. These cookies track ad performance and ensure we don’t show you the same ad repeatedly. Any such use will be noted in our cookie notice.
You have choices when it comes to these tracking tools. When required by law or best practice, we operate a consent mechanism (for example, if a certain jurisdiction requires explicit opt-in for analytics cookies, we will comply). You can also clear cookies from your browser at any time or use “Do Not Track” signals (while our site may not respond to Do Not Track in all cases, we treat it as a preference).
Overall, the data collected via cookies/trackers is used to improve our services and marketing in-house, and is not shared with unauthorized parties. We ensure our use of these tools adheres to applicable privacy laws and industry guidelines. For instance, Google’s and Meta’s terms of service oblige us to disclose our use of their tracking cookies and to obtain necessary consents, and we fulfill these obligations through this policy and our website notices.
(For more information, you can refer to Google’s Privacy Policy and Facebook’s Data Policy to see how those companies handle data collected via their tools. Ivy Clinics does not have control over third-party data processing, but we only use reputable tools that respect user privacy.)
Data Security Measures
Protecting your data is of paramount importance to us. Ivy Clinics implements a range of security measures to safeguard personal information against unauthorized access, alteration, or loss. These measures include:
Encryption: All sensitive personal data is stored in encrypted form on our servers or cloud databases. We use strong encryption protocols (both at rest and in transit) so that even if data were intercepted or accessed improperly, it would be unreadable without the decryption keys. For example, our databases encrypt personal health information, and our website is secured via HTTPS, which encrypts data transmission.
Access Controls: As noted in the Role-Based Access section, we restrict internal access to personal data. Our systems are password-protected and use role-based permissions – staff only access the minimum data they need. We regularly review and update user access rights. Administrative access to servers or databases is limited to authorized IT personnel and doctors, and requires multi-factor authentication. These access control practices are in line with recommended safeguards for healthcare data.
Secure Infrastructure: We host our IT systems on secure cloud platforms that comply with industry security standards. The servers are behind firewalls and undergo frequent security updates. We employ anti-malware protection and intrusion detection systems to monitor for any unauthorized activities.
Data Retention and Disposal: We retain medical records and personal data only for as long as necessary to fulfill the purposes for which they were collected or as required by law (for instance, medical regulatory guidelines may require retaining records for a minimum period). When data is no longer needed, we dispose of it safely – e.g., by permanently deleting electronic records and shredding any paper records.
Training and Protocols: We conduct regular privacy and cybersecurity training for our staff. Every team member is trained to follow standard protocols (like verifying identity before sharing sensitive info, recognizing phishing attempts, etc.). We also have an incident response plan in case of any data breach or security issue, which includes notifying affected individuals and authorities as required by law.
Third-Party Security: When we work with third-party service providers (as described above), we vet their security practices. We choose partners who use robust security (for example, our payment gateways are PCI-DSS compliant for card security, our CRM and cloud providers follow encryption and certifiable security standards). Contracts with them include data protection clauses to ensure your data gets an equivalent level of protection off-site.
While no system is 100% immune to threats, we follow industry best practices and legal requirements to continuously protect your personal information. The Indian IT law and healthcare regulations also mandate “reasonable security practices” for sensitive personal data, which we implement (such as using encryption, access control, audits, etc.). We also stay updated on emerging cybersecurity threats and upgrade our safeguards accordingly to prevent unauthorized access or data breaches.
Your Rights Regarding Personal Data
We believe it is important that you have control over your personal information. Ivy Clinics upholds patient rights in line with applicable laws like the Indian data protection law and global best practices (many of these rights are comparable to those found in GDPR). As a user or patient, you have the following rights:
Right to Access: You can request a copy of the personal data we hold about you. This includes your basic info on file and medical records. We will provide this information, barring a few exceptions (for instance, if providing certain data would violate someone else’s privacy or as otherwise exempt under law). Generally, you have a right to know what data of yours is in our possession.
Right to Correction (Rectification): If any of your personal data with us is inaccurate or outdated (for example, you change your phone number or notice an error in your medical record), you have the right to have it corrected or updated. We encourage you to keep us informed of any changes. We will rectify any confirmed inaccuracies in a timely manner.
Right to Deletion (Erasure): You may request deletion of your personal data. For example, if you withdraw your consent or if you are no longer a patient, you can ask that we remove certain information. We will delete the data provided there is no overriding legal requirement to retain it. (For instance, medical establishments might be required by law or by medical guidelines to retain records for a minimum period – we will inform you if such an exception applies in your case.) When consent is withdrawn and no law mandates retention, we will erase your data.
Right to Withdraw Consent / Opt-Out: Where we are processing your data based on consent, you have the right to withdraw that consent at any time. For example, if you earlier consented to receive marketing emails or WhatsApp notifications, you can opt out of those communications. We make opting out as easy as opting in – each marketing email contains an “unsubscribe” link, and you can inform our staff or reply “STOP” on WhatsApp to halt further messages. Once you withdraw consent, we will stop the specific processing and, if applicable, delete the data (unless retention is required by law).
Right to Restrict Certain Processing: You have the right to request that we limit how we use your data, in particular situations. For instance, if you contest the accuracy of your data or object to a certain use, you can ask us to restrict processing (beyond storage) until the issue is resolved. If you object to non-essential processing (like direct marketing), we will restrict that use. Under India’s new data protection regime, individuals can opt out of their data being processed for specific purposes such as marketing emails, and we will honor such preferences.
Right to Data Portability: To the extent feasible, we can assist if you wish to obtain your personal data in a structured, commonly used electronic format. For example, if you want to transfer your medical records to another healthcare provider, upon your request (and authorization), we can provide your records in a standard format that can be used by the other provider. This is subject to technical constraints and legal considerations, but we support the principle of portability for your convenience.
Right to Object to Marketing: As mentioned, you can object to your data being used for marketing or promotional purposes. If you prefer not to receive any newsletters, special offers, or hear about new services, you can opt out and we will cease such communications. We never want to spam you – and you have the right to tell us to stop. We comply with regulations that, for example, allow individuals to be on a “Do Not Call” or “Do Not Disturb” list for marketing. Your preference will be duly respected in our systems.
Right to Not be Subject to Automated Decisions: Ivy Clinics currently does not make any legally significant decisions about patients using purely automated algorithms (without human involvement). However, if in future we use automated processing (for instance, an AI-based health assessment tool) that has a significant effect on you, you would have the right to request human intervention or to contest an automated decision.
To exercise any of these rights, you can contact us through the provided channels (email or in-clinic). We will require verification of your identity (to ensure we’re providing data to the right person) and then promptly address your request in accordance with applicable law. We do not charge any fee for reasonable requests. Please note that these rights are subject to certain legal limitations – for example, a request for deletion can’t override legal obligations to retain records, and access might be limited if it infringes on another person’s rights – but we will explain any such limitations in our response. Our policy of transparency and compliance with India’s laws (like the Digital Personal Data Protection Act, 2023) means we have processes in place to allow you to exercise your data rights.
(In summary, you have full control – you can see what data we have, fix it if it’s wrong, ask for a copy, or request us to delete or stop using it in certain ways. We are here to support those rights and maintain your trust.)
Children’s Privacy (Treatment of Minors)
Protecting the privacy of minors is especially important. Our services are generally aimed at adults, but we do treat patients who are minors (under 18 years of age) with parental or guardian consent. In compliance with Indian law and medical ethics, any patient under 18 must have a parent or legal guardian involved in their care and in decisions about their data. We require verifiable parental consent before collecting or using personal data of minors, and the parent/guardian exercises the child’s data rights on their behalf. For example, a parent will fill out the registration and consent forms for a child’s treatment and control what information is shared.
Key points regarding minors’ data:
Parental Consent: If you are under 18, Ivy Clinics will only collect and process your information with the authorization of your parent or legal guardian. The guardian must consent to the treatment and the associated data processing (such as creating medical records, taking photographs for treatment progress, etc.). We will also typically communicate about appointments and treatment plans with the parent/guardian.
Limited Collection: We do not collect more information on minors than is necessary. We will ask for the child’s relevant medical history and necessary personal details, but, for instance, we won’t collect identification details like Aadhaar or school info unless needed for a specific lawful purpose. All data is handled with heightened sensitivity.
No Targeted Marketing to Minors: Ivy Clinics does not knowingly target or direct any promotional content to minors. We do not use a minor’s data for any marketing or advertising purposes. In fact, under India’s data protection rules, tracking or profiling children for targeted advertising is either disallowed or heavily discouraged. We fully comply with this – for example, if a minor visits our website, our analytics will treat them as just a user and not perform any behavior tracking beyond necessary site function, and certainly we do not create marketing audiences specifically of minors.
Website Use: Our website and online services are not intended for unsupervised use by individuals under 18. We do not knowingly allow account sign-ups or newsletter subscriptions from minors without guardian involvement. If you are a minor, please use our online resources only with your parent or guardian’s guidance. If we discover we’ve collected personal data from someone under 18 without consent, we will delete it promptly.
Medical Confidentiality for Minors: Even though a parent consents for the treatment, we still respect the young patient’s confidentiality to the extent appropriate. Doctors may, for example, choose to speak privately with teenage patients about certain sensitive health matters, but ultimately, a parent or guardian typically has the right to access the medical records of their minor child. We navigate these situations in accordance with medical ethics and legal requirements – always prioritizing the child’s best interest.
In essence, any data about minors in our system is protected with the highest care. Guardians have the ability to review and control that data. We encourage parents/guardians to talk to their children about sharing personal information and to oversee their healthcare journey. Ivy Clinics does not provide services to minors without guardian consent, and we do not permit minors to independently avail services or divulge personal information. This focus on children’s privacy is in line with both our own values and regulatory expectations (for example, the Digital Personal Data Protection Act treats consent of a parent as mandatory for processing children’s data, and forbids certain data practices regarding children).
Compliance with Laws and Standards
Our privacy practices are designed to meet the requirements of applicable Indian laws and reflect global best practices. Key laws and guidelines we adhere to include:
Information Technology Act, 2000 and the IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 – which classify health information as sensitive personal data and mandate obtaining consent for its collection, and maintaining reasonable security practices. We follow these rules by securing your data and only collecting with consent.
Digital Personal Data Protection Act, 2023 (DPDP Act) – India’s comprehensive data protection law, which reinforces principles of consent, purpose limitation, data minimization, and user rights for personal data. Ivy Clinics abides by this Act: for instance, we provide clear notices of what data we collect and why, we allow you to access/correct your data, and we have appointed a contact for data protection queries.
Clinical Establishments (Registration and Regulation) Act, 2010 – which requires registered clinics/hospitals to ensure confidentiality of patient records and maintain medical records properly. We comply by keeping your records confidential and only accessible to treating professionals.
National Medical Commission (previously Medical Council of India) guidelines – including the MCI Code of Ethics Regulations, 2002, which obligate doctors to maintain patient confidentiality and not disclose medical information without consent. Our medical team follows this strictly. Exceptions are only made in rare, legally permitted cases (e.g., court order or public health requirement).
Draft DISHA (Digital Information Security in Healthcare Act) – a proposed law aimed specifically at healthcare data privacy and security. Although as of now DISHA has not been separately enacted (the draft was subsumed into the broader data protection framework), we uphold its core principles of protecting digital health data. DISHA’s objective was to ensure confidentiality, privacy, and security of electronic health records, which is exactly what our policies and systems strive to do.
Global Standards (GDPR and HIPAA principles): Even though the European GDPR and US HIPAA laws do not directly apply to us (since we operate in India), we have modeled many of our practices on their high standards. This means we emphasize transparency with patients about how we use data, we obtain explicit consent for sensitive data use, we allow patients control over their data (access, deletion, etc.), and we implement strict security akin to HIPAA’s requirements for protecting health information. We want our patients to enjoy privacy protections comparable to those in leading international frameworks. (For clarity: We do not claim official HIPAA compliance as that law is US-specific, but we follow similar confidentiality and security practices to safeguard health data.)
Should there be any changes in relevant laws or the introduction of new regulations, we will update our privacy policy accordingly and ensure continued compliance. Our legal team periodically reviews our data protection measures to confirm they meet the latest requirements.
Contact and Queries: If you have any questions or concerns about our Privacy Policy or how your data is handled, please contact our Data Protection Officer or Clinic Manager at Info@theivyclinics.com. We will be happy to assist you and address any issues.
In summary, Ivy Clinics deeply values your trust. We collect only what is necessary, keep it safe, use it to serve you better, and never misuse it. We stay transparent about our practices and empower you with choices regarding your personal information. By adhering to robust privacy standards and legal mandates, we aim to provide you not only exceptional medical care but also peace of mind that your personal data is in good hands. Thank you for choosing Ivy Clinics – your privacy is our priority.
Last Updated: 02.12.2025
