Privacy requests

Make a request

There is no fee and no account needed. If you would rather write to us, email our Grievance Officer — details at the bottom of this page — and include the same information the form asks for.

What you can ask for

Access

A summary of the personal data we process about you, what we do with it, and the processors and other Data Fiduciaries we have shared it with.

Correct, complete or update my personal data

Tell us exactly which field is wrong and what it should say.

Erase my personal data

We will erase what we are not required by law to keep, and tell you what we must keep and why.

Nominate someone to exercise my rights

Name a person who may exercise your rights if you die or become incapable of exercising them yourself.

Withdraw my consent

Withdrawing consent stops future processing that relied on it. It does not undo processing already carried out lawfully.

Raise a grievance

Escalate a privacy complaint to our Grievance Officer.

The full description of each right, and the duties the DPDP Act places on you as a Data Principal, is in section 11 of the Privacy Policy.

Our timelines

• Ticket ID: issued the moment you submit.
• Acknowledgement: within 48 hours of submission.
• Resolution target: 30 days from the day we can verify who you are.
• Hard cap: 90 days — the outer limit the DPDP Rules 2025 set for resolving a grievance.
• If we need longer than 30 days we tell you before day 30, explain why, and give you a date.

There is no fee for any request, however many you make.

How we verify you

We must be sure a request is genuinely yours. Releasing or deleting data on an impostor’s say-so would itself be a breach.

• Normally we send a one-time code to the email address or phone number already on the record.
• Where that is not possible we may ask one or two questions only the account holder could answer.
• Do not send identity documents unless we specifically ask. If we do ask, we say exactly what to send and delete it as soon as verification is complete.
• If you are acting for someone else, we will ask for the nomination, guardianship or authorisation in writing before we act.

Data held by our customers, not by us

If you are a patient of a clinic, a resident of a PG, a member of a housing society or a customer of a business that uses Vedatricks software, that organisation is the Data Fiduciary for your records. Contact it directly — it can act immediately, and we cannot act on its data without its instruction.

Send the request to us anyway and we will acknowledge it, forward it to that organisation without undue delay, and tell you who they are. See section 9 of the Data Processing Agreement.

When we can refuse, or comply only in part

• Where we cannot verify your identity after reasonable attempts.
• Where the law requires us to keep the data — accounting and tax records, access logs, and records needed for a live dispute or investigation.
• Where complying would reveal another person’s personal data; we redact and give you the rest.
• Where a request is manifestly excessive or repetitive.
• Where the data has already been deleted or de-identified and cannot be linked back to you.

We always tell you which part we declined and why, so that you can challenge it.

Escalating

If you are unhappy with the outcome, reply on the ticket and ask for it to be escalated to our Grievance Officer. If you are still unhappy, or we do not respond in time, you may complain to the Data Protection Board of India under section 13(3) of the DPDP Act 2023.