Privacy policy

Last updated: 31 August 2026 · Version 1.0

Dr. Keerti Holistic Healthcare ("we", "us") provides online homeopathy and clinical nutrition consultations. This policy explains what information is collected about you, by whom, why, how long it is kept, and the control you have over it. It covers this website and the care Dr. Keerti provides, including consultations booked through Eka Care.

1. Who is responsible for your data

The data fiduciary (under India's Digital Personal Data Protection Act 2023) and data controller (under the UK/EU GDPR) is Dr. Keerti Holistic Healthcare, a sole proprietorship of Dr. Keerti Madhukar, at Bengaluru, Karnataka, India. As a sole proprietorship the practice has no separate legal personality, so the proprietor is personally accountable for how your data is handled.

2. What we collect

Health information is sensitive personal data under the DPDP Act and a special category of personal data under Article 9 GDPR. We treat it accordingly.

3. Why we are allowed to process it

• Your explicit consent, given when you confirm the booking and consent statements on Eka Care, and again at the start of your consultation. You can withdraw it at any time.
• Provision of healthcare — Article 9(2)(h) GDPR permits processing health data for medical diagnosis and the provision of treatment by a health professional bound by professional secrecy.
• Performance of a contract — to deliver the consultation you have paid for.
• Legal obligation — to keep clinical and financial records for the periods the law requires.

4. Who we share it with

We do not sell your data, and we never use health information for advertising. We share the minimum necessary with:

• Eka Care — our clinical and appointment platform. Because booking happens on Eka Care's own page, Eka Care collects your booking and payment details directly rather than receiving them from us, and processes them under its own privacy policy in addition to this one. Eka Care also holds the clinical record Dr. Keerti creates. Its privacy policy and terms are linked from the booking page, and we recommend reading them before you book. [Confirm the data-processing agreement, the respective roles of each party, and the applicable data-residency terms.]
• Our hosting provider — Hostinger, which stores the website and its server logs. [Confirm the hosting region.]
• Diabetica (diabetica.care), where your care is delivered through Dr. Keerti's consulting role there rather than through this practice. This only applies if you book through Diabetica; bookings made on this site stay with this practice.
• Authorities, where we are legally required to disclose.

If you consult us from outside India, your data will be processed in India. Where the GDPR applies, such transfers are made on the basis of your explicit consent and appropriate safeguards. [Confirm the transfer mechanism with counsel.]

5. How long we keep it

• Clinical records — retained for the period required of a medical practitioner. [Confirm; commonly 3 to 5 years from the last consultation in India, longer for minors.]
• Booking and payment records — as required by tax and accounting law.
• Abandoned bookings (started but never paid) — deleted within 30 days.
• Server and security logs — 90 days.
• Newsletter subscriptions — until you unsubscribe.

6. How we protect it

• All traffic is encrypted in transit with TLS, and HTTP is redirected to HTTPS.
• A strict Content Security Policy prevents unauthorised scripts from running on the site.
• Credentials for our clinical and payment systems are stored outside the public web directory and are never sent to your browser.
• The consultation price is fixed on our server, so it cannot be altered from a browser.
• Payment confirmations are verified by cryptographic signature before an appointment is confirmed.
• Access to health information is limited to Dr. Keerti and, where strictly necessary, authorised clinical staff.
• Operational logs are written without names, contact details or health information in them.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the relevant regulator within the timeframes the law requires.

7. Your rights

You may ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Erase your data, subject to the clinical and legal retention periods above.
• Port your data to another provider in a machine-readable format.
• Withdraw consent at any time — this does not affect processing already carried out.
• Object to or restrict processing in certain circumstances.
• Nominate someone to exercise these rights on your behalf, as the DPDP Act permits.

Write to privacy@keerti.care to make a request. We may need to verify your identity first, so that we do not disclose your health information to someone else.

8. Children

Consultations for anyone under 18 must be booked and consented to by a parent or legal guardian, and we verify that consent before treating a child — section 9 of the DPDP Act requires verifiable parental consent, not merely a tick-box assertion. We never track children, never profile them, and never direct advertising at them; the Act prohibits all three outright. If you believe a child has given us data without a guardian's consent, write to the Grievance Officer and we will delete it.

9. Cookies

We set only the cookies needed to keep the site secure and to remember your cookie choice. Nothing that tracks or profiles you loads unless you have chosen "Accept all". See the cookie policy.

10. Changes

If we make a material change we will update the version and date at the top of this page and, where the change affects how we use your health information, ask for your consent again.