Privacy Policy
This policy explains what personal data Cure4Pain collects, why, who it is shared with, and how long it is kept. It describes what our systems actually do.
1. Who we are
Cure4Pain is a clinic based in Mumbai, India.
2. What personal data we collect
- Identity: name, age or date of birth, gender, and other details you give us for your clinical file (for example blood group, language, marital status).
- Contact: mobile number, email address (optional), postal and delivery addresses.
- Family and caretaker: the name and phone number of a family member or caretaker, when you give them to us. Family members may hold separate accounts on the same mobile number.
- Clinical: medical history, complaints, diagnoses, vitals, prescriptions, treatment notes, the intake forms you fill in, and the lab reports and documents that you or the clinic upload.
- Financial: invoices, payments, the payment reference and the type of payment method used (for example card, UPI or net banking). We never receive or store card numbers or bank account details.
- Appointments and orders: bookings, online consultation links, orders, delivery details and your notification choices.
- Blood test reports: reports of blood tests booked through the portal, which our lab partner, Redcliffe Labs, sends to us.
- Messages: messages you send to the clinic’s WhatsApp number.
- Technical: logs our servers keep for security and troubleshooting, such as IP address, browser type, the page visited and the time.
We do not use third-party analytics or advertising trackers.
3. How we use your data
- To provide consultations, treatment and follow-up care.
- To book, confirm, remind you of and run your appointments, including online consultations.
- To prepare and deliver supplement orders.
- To issue invoices, take payments and keep our accounts.
- To send sign-in codes, confirmations and reminders by WhatsApp, SMS or email.
- To keep our systems secure, prevent misuse, and fix problems.
- To meet our legal obligations, including tax and GST record-keeping, and any lawful request to furnish records.
We do not sell or rent your personal data, and we do not use it for advertising.
4. Service providers
We do not sell or rent your personal data. To run the clinic’s online services we use a small number of service providers — for hosting, backups, payments, sign-in codes, WhatsApp and email messages, and video consultations. Each receives only what it needs for its task: for example, your mobile number to deliver a sign-in code or a message, or the amount to take a payment. Your medical records are not shared with them.
Blood tests. If you book a blood test on the portal, the test is done by our lab partner, Redcliffe Labs. To book it and collect the sample, we share the patient’s name, age, gender, phone number, the collection address and the tests chosen with Redcliffe. Redcliffe sends the report back to us, and it appears under Reports.
For delivery orders, the name, address and mobile number on the order are given to the courier or delivery rider. We may also disclose records where the law requires it.
5. Data processed outside India
Our server and database are in India. Some of our service providers may process the limited information they receive, described in section 4, outside India.
6. How long we keep your data
We keep your records. Your clinical records, prescriptions, reports, invoices, payment records and orders form your medical and financial file with the clinic. We retain them, together with a history of every change made to them, for your continuing care, for the safety of our patients and our clinic, to maintain our patient database, and to meet any requirement to furnish them later, for example to you, a court, a regulator or a tax authority. We do not delete these records on request.
Your patient-portal sign-in is kept while you use it and can be removed on request (see “Removing your portal account” below). Technical logs are kept to run the service and keep it secure. We keep a record of when you accepted our Terms of Service, which include the informed consent.
7. Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Access your data. Much of it is already in your patient portal (appointments, prescriptions, reports, invoices and orders); for anything else, ask us.
- Correct inaccurate data. Your name and mobile number are part of your clinic record, so the clinic changes them for you — tell us what they should be.
- Choose how we contact you: turn WhatsApp reminders off, or remove your email address, from your portal.
- Nominate another person to act for you in case of death or incapacity, by telling us in writing.
- Complain to us (section 8) or to the Data Protection Board of India.
Because of section 6, a request to erase your clinical, billing or order records cannot be met; we will explain this and tell you what we can remove.
To use any of these rights, message the clinic on WhatsApp from the mobile number on your account, or email info@cure4pain.in.
Removing your portal account
To remove your patient-portal account, message the clinic on WhatsApp from the mobile number on your account, or email info@cure4pain.in, with the words “remove my portal account” and your name. We confirm the request with you and, within 90 days, remove your portal sign-in, your saved addresses and any unfinished cart. Your patient record, clinical records, invoices, payments and orders are kept as described in section 6. If you have placed orders through the portal, we close your sign-in (lock the account) instead of removing it.
8. Grievances
If you have a grievance about how we handle your data, contact us (section 12) and we will respond as required by law.
9. Children
A parent or guardian books appointments and manages the portal account for a patient under 18, and we record a caretaker’s name and number when it is given to us. We do not track, profile or advertise to children.
10. Security
Clinic staff use their own individual sign-ins; financial reports, data exports and system administration are limited to the clinic’s owners, and the administration area needs a second, personal code. Every change to clinical and financial records is recorded with who made it and when, and automated checks run on our data every night. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the Act requires.
11. Changes to this policy
We may update this policy. The “Last updated” date at the top shows the latest version; we will tell you about material changes through the portal or your contact details on record.
12. Contact
For any question about this policy, contact the clinic.