Privacy Policy

All Things Physio is a physiotherapy practice run by Tejdurg Physiotherapy OPC Private Limited, a company incorporated in India, with its registered office at First Floor, Chinar Heights, Lane 5, Prabhat Road, Opposite Irani Cafe, Pune, Maharashtra 411004, India.

For the purposes of the DPDP Act, Tejdurg Physiotherapy OPC Private Limited is the Data Fiduciary: we decide why and how your personal data is processed, and we are responsible for it. You are the Data Principal.

We treat patients at four clinics in Pune: Prabhat Road-Deccan, Baner-Balewadi, Aundh, Bibwewadi.

Personal data about patients, prospective patients and visitors, collected through:

• this website, including its online booking form;
• phone calls, WhatsApp messages and emails with us;
• visits to our clinics, including assessment, treatment and billing.

It does not cover the websites or apps of other organisations that we link to, such as Google Maps, WhatsApp or Instagram. Their own privacy notices apply there. Our staff are covered by a separate notice given to them.

We collect only what we need for the purposes in section 4. You are not required to give us health information on the website: the booking form asks only for what is needed to book, and anything else is optional.

• To book and manage your appointments: confirming, rescheduling and cancelling, and sending you confirmations and reminders by email, SMS or WhatsApp.
• To assess and treat you, and to keep an accurate record of your care so that any physiotherapist who treats you has the full picture.
• To bill you and keep accounts.
• To answer your questions and requests.
• To keep our services safe: preventing spam and misuse of the booking form, and keeping our systems secure.
• To meet legal obligations, for example keeping records we are required to keep, and responding to lawful requests from authorities.
• With your separate permission only: asking for a review or feedback, sending you updates about our services, and measuring how our website and adverts perform. You can say no, or change your mind later, without affecting your care.

We do not sell or rent your personal data, and we do not use it for any purpose that is not described here.

We process your personal data on the basis of your consent, which you give when you book an appointment, register as a patient, or choose your cookie settings. Consent must be free, specific, informed and unambiguous, and it is limited to the purposes stated when you give it.

In some situations the DPDP Act allows processing without separate consent (legitimate uses), for example:

• when you voluntarily give us your data for a specific purpose and have not objected to its use for that purpose;
• to respond to a medical emergency involving a threat to your life or health;
• to comply with a law, a court order, or a lawful request from a government authority.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it: email or call us (section 13), use "Cookie settings" at the bottom of any page for the website, or follow the unsubscribe link in any optional message. Withdrawal does not affect what was lawfully done before it, and we may need to keep some records where the law requires. If you withdraw consent needed to treat you or manage your bookings, we may no longer be able to provide those services.

We treat children. Appointments for anyone under 18 must be booked, and consent given, by a parent or lawful guardian, who should accompany the child to the clinic. Where a person with a disability has a lawful guardian, the guardian gives consent on their behalf. We may ask for reasonable confirmation of the relationship.

We do not track children's behaviour, and we do not direct advertising at children.

Your personal data is seen only by our team members who need it for your care or your booking. We also use trusted service providers (Data Processors), who process data only on our instructions and under a contract that requires them to protect it:

• SpatioWorld Technologies Private Limited (SpatioCare): our clinic management and online booking system, which holds appointments, patient records and our staff app.
• Email and messaging providers: to send confirmations and reminders, and when you choose to message us on WhatsApp (operated by Meta).
• Cloudflare: checks that booking requests come from a person and not an automated program.
• Payment provider: if you choose to pay online (for example Razorpay), to process the payment.
• Our website host: to deliver this website securely.

We may also share personal data:

• with another doctor, hospital or healthcare provider involved in your care, with your consent or in an emergency;
• when required by law, a court or a government authority;
• with a successor if our practice is transferred, in which case this notice continues to protect your data.

Some of our providers may process data on servers outside India. Where that happens, it is only to countries to which transfer is not restricted by the Government of India, and with safeguards in place.

We take reasonable security safeguards to prevent a personal data breach, including: access limited to the team members who need it; clinical records visible only to physiotherapists and the clinic's owner; encrypted connections (HTTPS); password-protected accounts; records of who accessed clinical information; and backups.

No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires, and tell you what happened, what it may mean for you, and what we are doing about it.

• Clinical and treatment records: for as long as applicable laws and professional guidelines require healthcare records to be kept, and for as long as needed to continue your care.
• Billing records: for the period required by tax and accounting laws.
• Enquiries and bookings that never led to treatment: until the purpose is served, and then deleted.
• Cookie choices: for up to 12 months, after which we ask again.

When personal data is no longer needed for its purpose and the law does not require us to keep it, we erase it, and we ask our service providers to do the same.

The website uses only what is necessary unless you allow more. Necessary storage remembers your cookie choice and protects the booking form from spam. Analytics (how many people visit and book) and marketing (whether our adverts work) are switched off unless you turn them on. You can change your choice at any time from Cookie settings at the bottom of every page.

Your choice is recorded anonymously so we can show that we asked, and when.

Under the DPDP Act, you have the right to:

• Access information: a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with.
• Correction, completion, updating and erasure of your personal data. We will correct or update it promptly. We will erase it when it is no longer needed, unless the law requires us to keep it (for example clinical records), in which case we will tell you.
• Withdraw consent at any time (section 5).
• Grievance redressal: to complain to us, and to have your complaint answered (section 13).
• Nominate another person to exercise these rights on your behalf if you die or become unable to do so.

Email contact@allthingsphysio.com, call +91 90288 99945, or speak to us at any of our clinics. Tell us which right you want to exercise. So that we give your data only to you, we may ask you to confirm your identity, for example with the phone number or email you used to book.

There is no charge. We will respond as soon as we can, and in any case within the period the law allows.

For any question, request or complaint about your personal data, contact:

We will acknowledge your grievance and resolve it within 90 days.

If you are not satisfied with how we resolved your grievance, you may complain to the Data Protection Board of India. Please contact us first, since the law asks that grievances be raised with the Data Fiduciary before the Board.

The DPDP Act also asks Data Principals to give accurate information, not to impersonate another person, not to suppress material information when asked for it, and not to file false or frivolous complaints.

We may update this notice when our services or the law change. The effective date at the top shows when it last changed. If a change affects how we use personal data you have already given us, we will tell you, and ask for your consent again where needed.