Legal

Privacy Policy

Last updated 20 October 2026

This Privacy Policy explains how Dr. Sudheer Pandey (“we”, “us”, “the practice”) collects, uses, shares and protects personal data when you visit drsudheerpandey.com (the “Website”) and when our clinic automation application (the “Application”, described at /automation) processes data on our behalf. It also explains your rights under applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Questions about this policy or your data can be sent to contact@drsudheerpandey.com.

1. Who we are

Dr. Sudheer Pandey is a consultant neurologist practising at MGS Super Speciality Hospital & Shree Aggarsain International Hospital, New Delhi. The Website provides information about the practice, the conditions treated and how to book an appointment. The Application is an internal tool that publishes the practice’s health-education posts to its social and business profiles.

2. Personal data we collect

When you use the Website

• Contact and enquiry details. The contact form opens a pre-filled WhatsApp message to the clinic number; nothing you type in the form is stored on our servers. Phone calls and WhatsApp messages are handled by the clinic directly.
• Questions you ask the assistant and symptom checker. Text you enter into the on-site assistant (“NeuroBot”) or the symptom checker is sent to our AI provider, OpenAI, to generate a response. We do not store these conversations and we ask you not to include names, phone numbers or other identifying details. The tools provide general information only and are not a medical consultation.
• Technical and usage information. Device and browser type, pages viewed, approximate location derived from your IP address, and similar data collected through Google Analytics and by our hosting provider, Cloudflare, to keep the Website secure and understand how it is used.

When the Application runs

• Content-calendar data from the practice’s own Google Sheet: post text, image links, scheduled dates and the IDs of published posts. This is the practice’s marketing content, not patient data.
• Connected-account tokens for the practice’s Google, Facebook and Instagram accounts, granted by the practice’s own team so that the Application can publish on its behalf.

We do not collect health records, appointment details or any patient data through the Website or the Application. Clinical information is handled only in person at the hospitals where Dr. Sudheer Pandeyconsults, under their own policies.

3. Google user data and the Limited Use requirement

The Application connects to Google services through Google APIs using the practice’s Google account. It requests access to Google Sheets (to read and update the content-calendar spreadsheet the team selects) and to Google Business Profile (to create posts on the practice’s own listing). Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the publishing features described above.
• We do not transfer Google user data to others except to the platforms a post is published to, to comply with applicable law, or as part of a merger or acquisition with prior notice.
• We do not use Google user data for advertising, and we do not sell it.
• Humans do not read Google user data obtained through the Application except the practice’s own team managing its own content, for security or abuse investigations, to comply with law, or in aggregated, anonymised form.
• We do not use Google user data, including Google Workspace content, to develop, improve or train generalised artificial-intelligence or machine-learning models.

Access can be revoked at any time from the Google account’s third-party access page. Revoking access stops further processing immediately.

4. How we use personal data

• To run the Website and respond to enquiries you send us.
• To generate answers from the on-site assistant and symptom checker when you use them.
• To publish the practice’s own health-education content through the Application.
• To keep the Website and Application secure and to understand how the Website is used.
• To comply with legal obligations.

We process personal data on the basis of your consent, our legitimate interest in operating the practice and its Website, and other lawful uses recognised by the DPDP Act. Where processing is based on consent you may withdraw it at any time by writing to contact@drsudheerpandey.com.

5. When we share data

We share personal data only with:

• Service providers that help us run the Website and Application: Cloudflare (hosting and security), Amazon Web Services (hosting of the automation server, in India), OpenAI (AI responses for the assistant and symptom checker), Google (Analytics, Maps embeds, Sheets and Business Profile APIs), Meta (Facebook and Instagram publishing) and Senja (testimonial display). Each processes data only to provide its service to us.
• Authorities, where disclosure is required by law, legal process or to protect rights and safety.

We do not sell personal data and we do not use it for third-party advertising.

6. Cookies and analytics

The Website uses Google Analytics to measure visits in aggregate. Embedded content from Google Maps and Senja may set their own cookies, governed by their policies. You can control cookies through your browser settings; the Website works without them.

7. Retention

Enquiry messages are kept by the clinic only as long as needed to respond. Assistant and symptom-checker inputs are not stored by us. Connected-account tokens are stored encrypted on the automation server and deleted when access is revoked. Content-calendar data stays in the practice’s own Google Sheet under its control. Analytics data is retained for the period set in Google Analytics (currently 14 months).

8. Security

We use HTTPS throughout, store credentials encrypted, restrict access to the automation server to the practice’s own team, and rely on providers that are independently certified against international security standards. No method of transmission or storage is completely secure; contact us immediately if you believe your data has been compromised.

9. Your rights

Subject to applicable law, you may request access to the personal data we hold about you, ask for it to be corrected or erased, withdraw consent, nominate a person to exercise your rights on your behalf, and raise a grievance. Write to contact@drsudheerpandey.com; we will respond within the time the law allows. If you are not satisfied with our response you may approach the Data Protection Board of India.

10. Children

The Website is intended for adults seeking information about neurological care. We do not knowingly collect personal data from anyone under 18; parents and guardians should contact the clinic directly on a child’s behalf.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date above reflects the latest revision, and material changes will be posted on this page.