Privacy Policy
 

Last Updated: 31st July, 2026
 

This Privacy Policy explains how PINKY PROMISE HEALTHCARE SERVICES PRIVATE LIMITED, operating Pinky Promise Women’s Clinic (“Pinky Promise”, “Clinic”, “we”, “our” or “us”), collects, uses, stores, protects and shares personal data when you:

• Visit www.pinkypromiseclinic.com;

• View or respond to our advertisements;

• Complete a Website or advertising lead form;

• Call, email, WhatsApp or otherwise contact us;

• Book or attend an appointment;

• Receive healthcare services from us;

• Make a payment;

• Interact with our social-media pages; or

• Otherwise communicate with the Clinic.

Our clinic is located at Second Floor, Maruti Chambers, 202, Veera Desai Road, off New Link Road, Veera Desai Industrial Estate, Andheri West, Mumbai, Maharashtra 400053.

For the purposes of applicable data-protection law, PINKY PROMISE HEALTHCARE SERVICES PRIVATE LIMITED is the entity responsible for determining why and how your personal data is processed. PINKY PROMISE HEALTHCARE SERVICES PRIVATE LIMITED is the body corporate responsible for handling personal information under the Information Technology Act, 2000 and the SPDI Rules, 2011 and, upon the relevant provisions becoming operative, will act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023
 

1. Personal Data We May Collect

Depending on your interaction with us, we may collect the following categories of information.

1.1 Identity and Contact Information

• Full name;

• Age or date of birth;

• Gender or gender identity, where relevant;

• Mobile number;

• WhatsApp number;

• Email address;

• Residential address;

• Government-issued identification, where required;

• Emergency-contact information; and

• Parent, guardian, caregiver or representative details.

1.2 Appointment and Lead Information

• Preferred appointment date and time;

• Preferred doctor or service;

• Reason for seeking an appointment;

• Location;

• Source through which you heard about us;

• Lead-form responses;

• Callback requests;

• Appointment status;

• Communication preferences; and

• Advertising campaign or referral information.

1.3 Health and Medical Information

Health and medical information is sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and may include:

• Physical, physiological and mental-health conditions, including symptoms and health concerns;

• Menstrual, reproductive, sexual, obstetric and gynaecological history;

• Sexual orientation, where disclosed;

• Pregnancy-related information;

• Medical records and history, including medical and surgical history;

• Medication and allergy information;

• Family medical history;

• Lifestyle information relevant to care;

• Consultation notes;

• Examination findings;

• Diagnosis and differential diagnosis;

• Prescriptions;

• Laboratory, imaging and diagnostic reports;

• Treatment plans;

• Referrals;

• Follow-up information;

• Consent records;

• Medical certificates; and

• Other information voluntarily shared during care.

Reproductive, sexual and pregnancy-related information, including information relating to the medical termination of pregnancy (“MTP”), is subject to strict medical confidentiality and to any special statutory restrictions governing its collection, use, disclosure, retention and access. Please avoid sending detailed medical records through social-media comments or unsecured public channels.

1.4 Payment and Transaction Information

• Amount charged or paid;

• Invoice and receipt details;

• Payment status;

• Transaction reference number;

• Refund information;

• Payment method; and

• Limited billing information.

Complete card information, banking passwords, UPI PINs or similar authentication credentials are ordinarily processed by the relevant payment provider and are not stored by us.

1.5 Website, Device and Analytics Information

When you use the Website, we or our service providers may collect:

• IP address;

• Browser and device type;

• Operating system;

• Approximate location derived from IP address;

• Date and time of access;

• Pages viewed;

• Links or buttons clicked;

• Referring website;

• Session identifiers;

• Cookie identifiers;

• Advertising identifiers;

• UTM parameters;

• Form interactions;

• Call or WhatsApp-button clicks;

• Website errors and performance information; and

• Consent preferences.

1.6 Communication Information

We may retain:

• Emails;

• SMS or WhatsApp messages;

• Call logs;

• Enquiry details;

• Complaint or feedback records;

• Appointment reminders; and

• Records of consent, opt-outs and communication preferences.

Calls will not be recorded unless permitted by law and you are appropriately informed.

1.7 Images, Video or Audio

We may collect photographs, videos or audio only where relevant to treatment, security, documentation or another stated purpose and where an appropriate legal basis or consent exists.

Patient images, stories, reviews or testimonials will not be used for promotional purposes without separate, specific consent. Before any usage, consent will be taken in writing. Promotional consent is voluntary, separate from treatment, channel-specific, time-bound where appropriate and capable of withdrawal prospectively.

1.8 CCTV Information

CCTV may be used in appropriate common areas of the clinic for safety, security and incident management.

CCTV is not installed in consultation, examination, changing or washroom areas. CCTV footage will be retained only for a reasonable security period unless required for an investigation, complaint or legal proceeding.

2. How We Collect Personal Data

We may collect information:

• Directly from you;

• From your parent, guardian, caregiver or authorised representative;

• From a referring doctor or healthcare provider;

• From laboratories, imaging centres, pharmacies, hospitals or specialists;

• Through Website and appointment forms;

• Through Meta, Facebook, Instagram, Google or other advertising lead forms;

• Through telephone, SMS, email or WhatsApp;

• Through cookies, analytics tags and advertising technologies;

• Through payment providers;

• From publicly available sources where lawful; and

• As otherwise permitted or required by law.

Where someone provides information about another person, that individual should have the authority to do so and should inform the person about this Privacy Policy where appropriate. Pinky Promise may verify the representative's authority and will restrict disclosure to the representative unless the patient has authorised it or law permits it. A person's mere possession of patient information is not proof of authority.

3. Why We Process Personal Data

We may process personal data for the following purposes.

3.1 Appointments and Enquiries

• Responding to enquiries;

• Calling back prospective patients;

• Scheduling, confirming, cancelling or rescheduling appointments;

• Sending directions and visit instructions;

• Managing waitlists;

• Coordinating with doctors and clinic staff; and

• Following up on missed enquiries or appointments.

3.2 Healthcare and Clinical Purposes

• Verifying identity;

• Assessing symptoms and medical history;

• Providing consultations, examinations and treatment;

• Issuing prescriptions;

• Ordering or reviewing investigations;

• Maintaining clinical records;

• Coordinating referrals;

• Supporting continuity of care;

• Communicating reports and follow-up instructions;

• Managing medical or patient-safety incidents; and

• Complying with medical, ethical and legal obligations.

3.3 Payments and Administration

• Processing payments and refunds;

• Issuing invoices and receipts;

• Maintaining financial records;

• Managing operational and accounting requirements;

• Preventing fraud;

• Handling complaints and disputes; and

• Conducting authorised audits.

3.4 Service Communications

• Sending appointment reminders;

• Communicating changes in doctor or clinic availability;

• Sending follow-up and care-related messages;

• Responding to support requests;

• Informing you about relevant administrative matters; and

• Requesting service feedback.

3.5 Marketing and Advertising

Subject to applicable law and consent requirements, we may:

• Send information about clinic services;

• Run advertising campaigns;

• Measure advertisement performance;

• Understand which campaign, advertisement or channel resulted in an enquiry;

• Create aggregated marketing reports;

• Avoid repeatedly showing irrelevant advertisements;

• Contact people who requested information;

• Analyse lead-to-appointment conversion; and

• Improve our communication and campaign effectiveness.

We will not ordinarily provide detailed medical records, diagnosis, consultation notes or treatment information to advertising platforms for advertising-personalisation purposes.

We will not use identifiable health information for targeted advertising without an appropriate lawful basis and explicit consent where required.

3.6 Website Analytics and Improvement

• Understanding how visitors use the Website;

• Measuring Website traffic and engagement;

• Tracking appointment-button, call-button and WhatsApp-button interactions;

• Diagnosing technical problems;

• Improving Website design and performance;

• Maintaining security; and

• Preventing misuse.

3.7 Legal, Regulatory and Safety Purposes

• Complying with applicable law;

• Responding to lawful requests from authorities;

• Establishing, exercising or defending legal claims;

• Protecting patients, doctors, staff and the public;

• Investigating fraud, abuse or security incidents;

• Maintaining professional and clinical standards; and

• Fulfilling reporting obligations.

4. Basis for Processing

Depending on the circumstances and applicable law, we may process personal data:

• With your consent;

• To respond to a service or appointment request initiated by you;

• To provide healthcare and related services requested by you;

• To comply with legal, regulatory, accounting or professional obligations;

• For medical emergencies or to protect life and safety where legally permitted;

• For employment-related purposes where applicable;

• For legitimate uses recognised under applicable law; or

• For another purpose notified to you at the time of collection.

Where processing is based on consent, you may withdraw that consent. Withdrawal will apply prospectively and will not invalidate processing already lawfully undertaken.

Some information is necessary for safe medical care, billing, legal compliance or recordkeeping. If you do not provide it, we may be unable to provide or continue the relevant service.

5. Lead Forms and Advertising Platforms

When you complete a lead form hosted by Meta, Facebook, Instagram, Google or another advertising platform:

1. The platform may collect and process your information under its own privacy policy;

2. The information you submit may be transferred to us or an authorised lead-management provider;

3. We may contact you regarding the enquiry or appointment you requested;

4. Campaign information may be associated with your enquiry to measure advertising effectiveness; and

5. We may retain a record of your consent, enquiry source and communication status.

Submitting a healthcare-related lead form can reveal an interest in women’s healthcare. We therefore aim to limit the information requested at the advertising stage.

Unless specifically necessary and appropriately protected, our lead forms should not ask you to submit detailed medical histories, diagnostic reports, intimate photographs, government identification numbers or payment credentials.
 

6. Marketing Communications

We may send promotional communications only where legally permitted and, where required, after obtaining consent.

Marketing consent is optional and separate from consent required to:

• Respond to an appointment request;

• Provide medical care;

• Send appointment reminders;

• Process a payment; or

• Fulfil legal obligations.

You can opt out of promotional communication by:

• Clicking an unsubscribe link;

• Replying “STOP”, where supported;

• Adjusting your preferences;

• Contacting clinic@askpinkypromise.com; or

• Calling +91 7304728721.

Even after opting out of marketing, you may continue to receive essential administrative, appointment, billing, security or care-related communications.
 

7. Cookies and Similar Technologies

The Website may use cookies, pixels, tags, software development kits and similar technologies.

7.1 Essential Cookies

These support core Website functions, security, form submission, consent preferences and fraud prevention.

7.2 Analytics Cookies

These help us understand Website traffic, visitor behaviour, page performance and button interactions.

7.3 Advertising Cookies and Pixels

Subject to consent requirements, these may help:

• Measure advertisement performance;

• Attribute enquiries to campaigns;

• Understand whether an advertisement led to a Website visit or appointment request;

• Limit repetitive advertisements; and

• Build aggregated campaign reports.

Possible providers may include:

• Google Analytics;

• Google Ads;

• Meta Pixel;

• Wix analytics or Website tools;

• Call-tracking or customer-relationship-management providers; and

• Other providers listed in our cookie-management interface.

You can manage non-essential cookies through our cookie banner, browser settings or applicable platform settings. Disabling cookies may affect some Website functions.

The final Website configuration, cookie banner and this Policy must accurately reflect the technologies actually installed on the Website.
 

8. Information Sharing

We may share personal data only where reasonably necessary and permitted by law.

8.1 Doctors and Clinic Personnel

Information may be shared with treating doctors, nurses, authorised employees, consultants and support staff who require access for care or operations.

8.2 Healthcare Partners

Information may be shared with laboratories, diagnostic centres, pharmacies, hospitals, specialists or other providers involved in your care.

8.3 Technology and Operational Providers

We may use vendors for:

• Website hosting and maintenance;

• Appointment management;

• Customer-relationship management;

• Cloud storage;

• Electronic medical records;

• Email, SMS and WhatsApp communication;

• Telephony and call management;

• Analytics;

• Cybersecurity;

• Accounting;

• Payment processing;

• Document management; and

• Customer support.

These providers should process information only for authorised purposes and under appropriate confidentiality and data-protection obligations.

8.4 Advertising and Analytics Providers

We may share limited Website, device, cookie, campaign and conversion information with advertising or analytics providers.

We will take reasonable steps to avoid sharing detailed clinical information with such providers for targeted advertising.

8.5 Professional Advisers

Information may be shared with lawyers, auditors, accountants, insurers and other professional advisers subject to confidentiality obligations.

8.6 Government and Legal Authorities

Information may be disclosed where reasonably believed to be required:

• Under law;

• By a court or competent authority;

• For public-health reporting;

• For law-enforcement purposes;

• To investigate fraud or misconduct;

• To protect life, health or safety; or

• To establish, exercise or defend legal claims.

8.7 Business Reorganisation

If the Clinic undergoes a merger, acquisition, restructuring, financing or transfer of business, personal data may be transferred subject to applicable law, confidentiality and continued protection.

8.8 With Your Direction or Consent

We may share information with a family member, employer, insurer, caregiver or other person where you direct us or provide valid consent, subject to applicable legal and ethical restrictions.

9. Information We Do Not Sell

We do not sell identifiable patient medical records or consultation information to advertisers or data brokers.

We do not permit third parties to independently use confidential medical information for their own advertising purposes unless you have provided valid, specific consent and such use is lawful.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose, including:

• Providing care and continuity of treatment;

• Maintaining medical records;

• Responding to enquiries;

• Meeting legal, medical, tax, accounting and regulatory requirements;

• Resolving disputes;

• Preventing fraud;

• Enforcing agreements; and

• Protecting legal rights.

Indicative retention periods should be documented internally and may include:

• Unconverted marketing leads: 12 months after the last interaction;

• Marketing consent and opt-out records: for as long as needed to demonstrate and honour preferences;

• Appointment and communication records: 5 years since the use of service;

• Medical records: 5 years since the usage of service;

• Billing and tax records: for the statutory retention period;

• CCTV footage: ordinarily [15/30/60/90] days, unless required for an incident; and

• Website analytics information: according to the configured analytics-retention period.

Information may be retained longer where required by law, litigation hold, an investigation, professional standards or patient-safety considerations.

When retention is no longer necessary, data will be deleted, anonymised or securely archived, as appropriate.
 

11. Data Security

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information, which may include:

• Role-based access controls;

• Password and authentication controls;

• Encryption where appropriate;

• Secure backups;

• Access logging;

• Vendor due diligence;

• Confidentiality obligations;

• Staff training;

• Device and network security;

• Incident-response processes;

• Secure disposal; and

• Periodic review of access permissions.

No system or method of transmission can be guaranteed to be completely secure. You should avoid sharing passwords, OTPs, UPI PINs or unnecessary health information through public or unsecured channels.

Where a personal-data breach occurs, we will take reasonable containment and remedial measures and will provide notifications where required by applicable law.
 

12. Children’s Personal Data

Where we process personal data of a person under 18, we may obtain verifiable consent from a parent or lawful guardian where required by law.

We will not knowingly:

• Use children’s personal data for behavioural tracking or targeted advertising where prohibited;

• Process more information than reasonably necessary;

• Engage in processing likely to cause a detrimental effect on a child’s wellbeing; or

• Seek marketing consent from a child where parental consent is required.

Certain healthcare services may involve legal and ethical exceptions concerning confidential treatment of minors. Such situations will be handled according to applicable law, medical ethics and patient safety.
 

13. Your Rights

Subject to applicable law, verification and lawful exceptions, you may have the right to:

• Obtain information about the personal data being processed;

• Request access to personal data;

• Request correction, completion or updating of inaccurate information;

• Request erasure where retention is no longer necessary or legally required;

• Withdraw consent;

• Opt out of marketing;

• Raise a grievance;

• Nominate another person to exercise applicable rights in the event of death or incapacity; and

• Approach the appropriate regulatory or judicial authority.

A request can be submitted to clinic@askpinkypromise.com

We may ask for information necessary to verify your identity and protect confidentiality. Requests made on behalf of another person must include appropriate authority.

Certain information may not be deleted where retention is necessary for medical records, patient safety, legal obligations, fraud prevention, claims or defence of legal rights.

14. Correction of Medical Records

You may request correction of factual inaccuracies in your demographic or contact information.

Clinical records will not ordinarily be retrospectively altered or deleted where doing so would compromise their integrity. Where appropriate, a correction, clarification or patient statement may be appended while preserving the original clinical entry and audit history.

15. Withdrawal of Consent

You may withdraw consent by contacting us.

Withdrawal will not:

• Affect processing already undertaken lawfully;

• Require deletion of information that must be retained by law;

• Prevent essential service or safety communications; or

• Override legitimate medical-recordkeeping requirements.

Depending on the consent withdrawn, we may be unable to continue a requested service.

16. International and Cross-Border Processing

Some technology, cloud, communication, analytics or support providers may process or store data outside India.

Where cross-border processing occurs, we will seek to ensure that it is permitted under applicable Indian law and subject to appropriate contractual, security and organisational safeguards.

We may restrict transfers to countries, territories, entities or systems where required by the Government of India or another competent authority.
 

17. WhatsApp, SMS, Email and Telephone

Messages sent through WhatsApp, SMS or email may pass through third-party systems and may not offer the same confidentiality as an in-clinic consultation or dedicated clinical system.

By contacting us through one of these channels, you authorise us to respond through that channel unless you request otherwise.

For your privacy:

• Avoid sending intimate images or detailed reports unless specifically requested through an approved channel;

• Do not send passwords, OTPs, payment PINs or unrelated identification documents;

• Ensure that the phone number or email address belongs to you or that you have authority to use it; and

• Inform us if a shared device or number should not be used for sensitive communication.

We may use discreet wording in reminders, but cannot guarantee that a person with access to your device will not see a notification.

18. Social Media and Public Reviews

Information posted in public comments, reviews or social-media posts can be viewed and reused by others.

For confidentiality reasons, the Clinic may respond to a public complaint without confirming whether the person is a patient or discussing clinical details.

Please use a private support channel for appointment, complaint or medical matters.

19. Automated Processing

We may use automated tools to support appointment routing, lead prioritisation, spam detection, campaign attribution or operational analytics.

We do not intend to make significant clinical decisions solely through automated processing without appropriate human involvement.

Diagnosis, prescriptions and treatment decisions are made by qualified healthcare professionals.
 

20. Anonymised and Aggregated Information

We may create anonymised or aggregated information that does not reasonably identify an individual.

Such information may be used for:

• Service improvement;

• Quality audits;

• Operational analysis;

• Public-health insights;

• Research;

• Training;

• Statistical reporting; and

• Marketing-performance analysis.

Where information is truly anonymised, it may no longer constitute personal data under applicable law.

Research involving identifiable information will be undertaken only with appropriate consent, approval or other lawful authority.

21. Third-Party Websites and Services

Our Website may link to maps, messaging services, social networks, payment providers, laboratories, pharmacies or other third-party services.

Those parties process information under their own privacy policies. We recommend reviewing their policies before providing information.

We are not responsible for the privacy or security practices of independent third parties.

22. Changes to This Privacy Policy

We may update this Privacy Policy due to changes in law, technology, Website features, vendors or clinical operations.

The revised version will be published with an updated “Last Updated” date. Where required, we will provide additional notice or obtain fresh consent.
 

23. Grievance Officer and Contact Details

For questions, privacy requests or grievances, contact:

Grievance Officer: Dr. Rashi Srivastava
Entity: PINKY PROMISE HEALTHCARE SERVICES PRIVATE LIMITED
Email: clinic@askpinkypromise.com
Telephone: +91 7304728721
Postal address: Second Floor, Maruti Chambers, 202, Veera Desai Road, off New Link Road, Veera Desai Industrial Estate, Andheri West, Mumbai, Maharashtra 400053.

We will acknowledge and respond within the timelines required by applicable law.

You may also have the right to approach the Data Protection Board of India or another competent authority in accordance with the applicable legal framework after using our grievance-redressal process.

24. Clinic Contact Details

PINKY PROMISE HEALTHCARE SERVICES PRIVATE LIMITED
Operating as: Pinky Promise Women’s Clinic
Clinic address: Second Floor, Maruti Chambers, 202, Veera Desai Road, off New Link Road, Veera Desai Industrial Estate, Andheri West, Mumbai, Maharashtra 400053
Email: clinic@askpinkypromise.com
Phone/WhatsApp: +91 7304728721
Website: www.pinkypromiseclinic.com