Privacy Policy

Last updated: 9 October 2026

Sikara Health Sciences LLP takes your privacy seriously. We are a medical practice, so a good deal of what you tell us is health information, which is among the most sensitive categories of personal data there is. This policy explains what we collect, why, who sees it, how long we keep it, and what you can ask us to do about it.

Please read it alongside our Terms and Conditions.

1. Who we are and who is responsible for your data

Sikara Health Sciences LLP, a limited liability partnership registered in India, with its principal place of business at 1st Floor, H No. 8, Road No. 2, opposite KBR Park, Banjara Hills, Hyderabad 500034, Telangana, is the Data Fiduciary responsible for your personal data under the Digital Personal Data Protection Act 2023. We are also the body corporate responsible under the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.

In this policy, we, us and our mean Sikara Health Sciences LLP. You and your mean any person whose personal data we hold, which the law calls a Data Principal.

2. What this policy covers

This policy covers personal data we collect through:

3. What we collect

3.1 Information you give us

3.2 Information we collect automatically

3.3 Information from other sources

4. A specific note on your health information

Health information, medical records and medical history are Sensitive Personal Data or Information under the Information Technology Rules 2011, and personal data under the Digital Personal Data Protection Act 2023.

We treat it accordingly. Specifically:

5. Why we use your data, and on what basis

Purpose What this means in practice

Providing care Examining you, diagnosing, planning and delivering treatment, maintaining your medical record, and reviewing your progress.

Appointments Confirming, reminding, rescheduling and following up on your appointment.

Safety Checking allergies, interactions and contraindications before any procedure.

Billing and accounts Raising invoices, taking payment, issuing refunds, and meeting tax and accounting obligations.

Answering you Responding to an enquiry, a question or a complaint.

Marketing, with your consent Sending you offers, the newsletter and clinic updates. You can opt out at any time.

Improving our service Understanding which treatments people ask about, how our website is used, and where our service falls short.

Advertising measurement Understanding in aggregate which campaigns bring enquiries. This uses website analytics, not your clinical information.

Franchise discussions Evaluating and corresponding with prospective franchise partners.

Legal and regulatory Meeting obligations under medical, tax, consumer and data protection law, and establishing or defending a legal claim.

We process your data on the basis of the consent you give us, and for certain legitimate uses permitted by law, including compliance with a legal obligation and responding to a medical emergency where you are not in a position to consent.

6. Consent, and how to withdraw it

Where we rely on your consent, we ask for it clearly and separately for each purpose. Consenting to treatment is not the same as consenting to marketing, and you can agree to one without the other.

You can withdraw your consent at any time by writing to contact@sikaraclinics.com or by contacting the Grievance Officer named in section 17. Withdrawing is as easy as giving consent.

Two things to understand about withdrawal. It does not make our earlier processing unlawful. And where we need certain information to treat you safely, withdrawing consent for that information may mean we can no longer treat you. We will tell you if that is the case.

Withdrawing consent for marketing has no effect on your care.

7. If you are under 18

Under the Digital Personal Data Protection Act 2023, a child is anyone under the age of 18.

Where a patient is under 18:

If you believe we hold data about a child without proper parental consent, tell us at contact@sikaraclinics.com and we will delete it.

8. Who we share your data with

We share only what is necessary, only with those who need it, and only under an obligation of confidentiality.

Where a clinic is operated by a franchise partner, that partner has access to the records of patients treated at that clinic only, under a written agreement that binds them to this policy and to medical confidentiality.

We do not share your data with advertisers, data brokers or marketing list companies.

9. Marketing communications

If you consent, we may contact you by WhatsApp, SMS, email or phone with clinic updates, seasonal advice, offers and appointment reminders.

Appointment reminders, test results and clinical follow up are service communications, not marketing, and you receive them as part of your care.

To stop marketing, reply STOP to any WhatsApp or SMS message, click unsubscribe in any email, tell the clinic reception, or write to contact@sikaraclinics.com. We action opt outs within seven working days.

10. Where your data is held, and transfers outside India

Your data is held on servers located in India wherever our providers offer that option.

Some of the technology services we use, including analytics and messaging infrastructure, may process data on servers outside India. Where that happens we ensure the transfer is to a country not restricted by the Central Government under the Digital Personal Data Protection Act 2023, and that the provider is bound by contract to protect your data to the standard set out in this policy.

Your clinical records are not transferred outside India.

11. How long we keep your data

Category Retention period

Medical records of an outpatient Three years from the date of the last entry, in line with the medical records requirement applicable to registered medical practitioners. We generally keep them longer where there is an ongoing course of treatment or a possibility of a claim.

Records relating to a medico legal case or an active claim Until the matter is finally concluded and all appeal periods have expired.

Financial records, invoices and tax records Eight years, as required under tax and company law.

Consent forms For as long as the related medical record is kept.

Enquiries that did not become patients Two years from the last contact, then deleted.

Franchise enquiries Three years from the last contact, or for the life of any resulting agreement plus the period required by law.

Marketing contact data Until you withdraw consent, after which we keep only enough to honour your opt out.

Website analytics data Up to 26 months.

CCTV footage at clinics 30 days, unless retained for a specific incident.

When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.

12. Cookies and tracking

A cookie is a small file placed on your device when you visit a website. We use them as follows.

Type What it does Can you refuse it

Strictly necessary Makes the site work. Page loading, form submission, security. No. The site will not function without these.

Analytics Tells us which pages are read, how long for, and where visitors come from. We use Google Analytics. Yes.

Advertising Lets us measure which of our Meta and Google campaigns produced an enquiry, and show relevant ads to people who have visited the site. We use the Meta Pixel and Google tags. Yes.

Functional Remembers your preferences, such as the clinic you last selected. Yes.

When you first visit the website you are asked which categories you accept. You can change your choice at any time through the cookie settings link in the footer, or by clearing cookies in your browser.

We do not use advertising or tracking cookies to target anyone we know to be under 18.

Our advertising measurement uses website behaviour only. We never pass your name, phone number, email address or any health information to an advertising platform.

13. How we protect your data

No system is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person, in the form and within the time the Digital Personal Data Protection Act 2023 requires.

14. Your rights

Under the Digital Personal Data Protection Act 2023 you have the following rights.

Separately, you have the right to a copy of your own medical records. We provide these within 72 hours of a written request.

How to exercise a right

Write to contact@sikaraclinics.com or to the Grievance Officer in section 17, telling us which right you want to exercise. We may ask you to verify your identity before we act, because we will not hand a person’s medical information to someone who cannot prove who they are.

We respond within 30 days. There is no charge, except that we may charge a reasonable fee for additional copies of a medical record.

Your duties

The Act also places duties on you. Please give us accurate information, do not impersonate anyone else, and do not raise a grievance you know to be false. Furnishing false particulars or filing a frivolous complaint can attract a penalty under the Act.

15. Automated decision making

We do not make any decision about your treatment, your eligibility or your pricing by automated means. Every clinical decision is made by a qualified dermatologist. The skin quiz on our website does not make a decision about you and does not produce a diagnosis.

16. Third party websites

This website links to and embeds third party services including Google Maps, Instagram, YouTube and WhatsApp. Once you click through to those services, their privacy policies apply, not ours. We are not responsible for how they handle your data and we encourage you to read their policies.

17. Grievance Officer

If you have any question or complaint about this policy or about how we have handled your personal data, contact our Grievance Officer. This officer is appointed under the Information Technology Act 2000 and the rules made under it, and under the Digital Personal Data Protection Act 2023.

Name: Sirisha Alapati

Designation: Founder and Managing Director, Sikara Health Sciences LLP

Email: contact@sikaraclinics.com

Phone: 8121968111

Address: Sikara Health Sciences LLP, 1st Floor, H No. 8, Road No. 2, opposite KBR Park, Banjara Hills, Hyderabad 500034, Telangana

We acknowledge every complaint within 24 hours and resolve it within 15 days.

If you are not satisfied with how we have handled your complaint, you may approach the Data Protection Board of India, established under the Digital Personal Data Protection Act 2023. You must raise the matter with us first.

18. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Where a change is material, we will tell you by email, by WhatsApp or by a notice on this website before it takes effect.

We keep previous versions and will provide one on request.

19. Contact us

Sikara Health Sciences LLP

1st Floor, H No. 8, Road No. 2, opposite KBR Park, Banjara Hills, Hyderabad 500034, Telangana, India

Phone: 8121968111

Email: contact@sikaraclinics.com

Clinics: Banjara Hills, Kothapet, Kondapur and Gachibowli.

• This website, including the appointment booking form, the franchise enquiry form, the newsletter signup and the skin quiz.
• WhatsApp, phone calls, SMS and email.
• Our social media pages and advertising on Meta and Google.
• Registration, consultation and treatment at any of our four clinics.
• Health camps, mall activations, corporate screening days and any other event we run.
• Our dispensary and billing systems.
• Identity and contact: name, age, date of birth, gender, phone number, email address, postal address, and where required, a government identity document for clinic registration.
• Appointment details: preferred clinic, preferred date and time, the service you are enquiring about, and how you found us.
• Health information: your presenting concern, medical history, current and past medications, allergies, previous reactions, prior procedures, pregnancy and breastfeeding status, family history where clinically relevant, blood test and diagnostic reports, and the clinical notes, photographs, dermatoscopic images and treatment records our doctors create about you.
• Payment information: the amount, the method and the transaction reference. We do not store your full card number, CVV or UPI PIN. Those are handled by the payment provider.
• Franchise enquiries: your name, phone, city of interest, preferred format and the investment band you select.
• Correspondence: what you say to us by WhatsApp, email, phone or on a form, including complaints and feedback.
• Device and connection data: IP address, browser type and version, operating system, device type, screen size and language.
• Usage data: pages visited, time on page, what you clicked, how you arrived at the site and where you went next.
• Cookies and similar technologies. Section 12 explains these in detail.
• Referring doctors, where another clinician refers you to us and shares relevant clinical information with your knowledge.
• Laboratories and diagnostic centres, where we have asked for a test on your behalf.
• Meta and Google advertising platforms, which tell us in aggregate how our advertising performed. We do not receive your identity from them.
• A family member or attendant who books on your behalf.
• Clinical information is accessible only to the doctors and clinical staff directly involved in your care, and to the administrative staff who need it to schedule, bill and follow up.
• Medical confidentiality applies to everyone who works at Sikara and continues after they leave.
• We do not publish, display or share any identifiable patient information, including photographs, in any marketing material, on this website, on social media or anywhere else, without that patient’s separate written consent for that specific use.
• We do not confirm to any third party, including a caller claiming to be a relative, whether a named person is or was our patient.
• We do not sell personal data. Not health data, not contact data, not any data, to anyone, ever.
• We obtain verifiable consent from a parent or legal guardian before collecting or processing any of that child’s personal data.
• The parent or guardian must be present at the clinic.
• We do not undertake any tracking, behavioural monitoring or targeted advertising directed at children.
• We do not process a child’s data in any way that is likely to cause a detrimental effect on their wellbeing.
• Our own doctors and clinical staff, across our four clinics, where you are treated at more than one or where a second opinion is needed.
• Laboratories and diagnostic centres, where a test is ordered for you.
• Specialists we refer you to, with your knowledge.
• Our technology providers, who host and operate our systems. This includes our customer relationship management system, our clinic management and records system, our cloud hosting provider, WhatsApp Business API, our email and SMS providers, and our website analytics. These providers act on our instructions and may not use your data for their own purposes.
• Payment gateways, banks and financing partners, for the limited purpose of processing a payment or an EMI application you have applied for.
• Our professional advisers, including auditors, lawyers and insurers, where required.
• Regulators, courts, police and government authorities, where we are legally required to disclose.
• A purchaser or successor, if the business or part of it is transferred, in which case your data passes under the same protections as this policy.
• Access to clinical systems is restricted by role. Staff see only what their job requires.
• Every user has an individual login. Logins are not shared.
• The website runs over an encrypted connection, and data is encrypted in transit.
• Physical records are kept in locked storage with access limited to authorised staff.
• Everyone who works at Sikara signs a confidentiality undertaking and is trained on handling patient information.
• Our technology providers are bound by written agreements covering security and confidentiality.
• Access logs are maintained and reviewed.
• The right to know what personal data of yours we hold, what we do with it, and who we have shared it with.
• The right to have inaccurate or incomplete data corrected, updated or completed.
• The right to have your data erased, where it is no longer needed for the purpose it was collected for and we are not required by law to keep it.
• The right to withdraw consent, as set out in section 6.
• The right to a readily available means of grievance redressal, as set out in section 17.
• The right to nominate another person to exercise your rights on your behalf if you die or become incapable of exercising them yourself.