Privacy Policy
at Dermis 365

Overview & Scope

Dermis 365 ("Dermis 365", "we", "us", "our"), a premium aesthetic dermatology clinic operating under NDV Group and located at NDV Towers, 22 Kanakapura Main Road, Raghuvanahalli, Bengaluru, Karnataka, is committed to protecting the privacy and confidentiality of every visitor to dermis365.com (the "Website") and every patient who avails of our clinical and aesthetic services (the "Clinic"). This Privacy Policy explains what personal data and health data we collect, why we collect it, how we use and protect it, and the rights available to you under applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules issued thereunder.

By using the Website, booking a consultation, or receiving treatment at Dermis 365, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Website or share personal data with us.

1. Who We Are

Dermis 365 is operated as part of NDV Group, which also includes Style 365 Studio Salon, NDV Infra, NDV Tech, and NDV Angels. For the purposes of this Policy, Dermis 365 is the Data Fiduciary in respect of personal data collected through the Website and in the course of clinical care.

2. Personal Data We Collect

As an aesthetic dermatology clinic, we may collect sensitive personal data such as health records, treatment photographs, and medical history. This data is treated with the highest level of confidentiality and is used strictly for clinical assessment, treatment planning, and continuity of care under the supervision of our qualified dermatologists.

• Name, age/date of birth, gender, phone number, email address, and residential address
• Appointment and consultation booking details
• Medical and health information you share before, during, or after treatment, including medical history, allergies, skin/hair condition details, photographs of treatment areas, and consultation notes
• Payment and billing information (processed via secure third-party payment gateways; we do not store full card details)
• Messages, queries, or feedback submitted via contact forms, WhatsApp, or phone
• Reviews or testimonials you choose to share publicly or with us
• IP address, browser type, device information, and operating system
• Pages visited, time spent on the Website, referring URLs, and click behaviour
• Cookies and similar tracking technologies (see Section 6)
• Data collected through Google Ads and Google Tag Manager conversion tracking when you interact with our advertisements or landing pages

3. How We Use Your Information

• To schedule, confirm, and manage appointments and consultations
• To assess your suitability for treatments (such as laser hair removal) and to plan and deliver safe, personalised clinical care
• To maintain accurate medical records as required under applicable healthcare regulations
• To communicate with you regarding appointments, treatment follow-ups, billing, and clinic updates via call, SMS, WhatsApp, or email
• To respond to enquiries submitted through the Website or contact channels
• To process payments and maintain billing records
• To improve our Website, services, and patient experience
• To run marketing campaigns (including Google Ads and Meta Ads) and measure their effectiveness, in each case only using data you have consented to share for marketing purposes
• To comply with legal, regulatory, and biomedical waste/clinical documentation obligations
• To prevent fraud and ensure the safety and security of our patients and staff

4. Legal Basis for Processing

We process your personal data on the basis of: your consent (for marketing communications, cookies, and non-essential processing); the performance of services you have requested (appointment booking and treatment); compliance with legal obligations applicable to healthcare providers; and our legitimate interest in operating and improving the Clinic and Website.

5. Sharing of Information

We do not sell your personal data. We may share information with:

We do not share identifiable medical records or treatment photographs with any third party for marketing purposes without your explicit, separate consent.

• Clinical staff — our dermatologists, cosmetologists, and clinic personnel directly involved in your care
• Service providers — our EMR/clinic management platform (Clinicea), scheduling and CRM tools (Zoho One), WhatsApp communication platform (AiSensy), and payment processors, each bound by confidentiality and data-protection obligations
• Advertising and analytics partners — Google (Ads, Analytics, Tag Manager) and Meta, for limited, aggregated, or pseudonymised marketing measurement purposes, where you have consented to cookies/tracking
• Legal and regulatory authorities — where required by law, court order, or to protect the rights, safety, or property of Dermis 365, our patients, or the public
• Group entities — within NDV Group, only where necessary for administrative or operational purposes, under equivalent confidentiality standards

6. Cookies and Tracking Technologies

The Website uses cookies and similar technologies (including Google Tag Manager and conversion tracking pixels) to operate the site, remember preferences, analyse traffic, and measure the performance of our advertising campaigns, including laser hair removal campaigns run across South Bengaluru. You can control or disable cookies through your browser settings; disabling cookies may affect certain Website features.

7. Data Retention

We retain personal and medical data for as long as necessary to provide our services, maintain clinical records as mandated by applicable healthcare recordkeeping requirements, and fulfil the purposes outlined in this Policy, after which it is securely deleted or anonymised, unless a longer retention period is required by law.

8. Data Security

We implement appropriate technical and organisational measures — including restricted access controls, secure storage within our EMR and CRM systems, and staff confidentiality obligations — to protect your personal and medical data against unauthorised access, alteration, disclosure, or destruction. While we take reasonable steps to protect your data, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights

Subject to applicable law, including the DPDP Act, you have the right to:

• Access the personal data we hold about you
• Request correction or updating of inaccurate or incomplete data
• Request erasure of your data, subject to our legal and clinical recordkeeping obligations
• Withdraw consent for marketing communications at any time
• Obtain information about the third parties with whom your data has been shared
• Lodge a grievance with our designated contact point (Section 11) or, if unresolved, with the relevant data protection authority

10. Children's Privacy

The Website and our services are not directed at children under 18. We do not knowingly collect personal data from minors without verifiable parental or guardian consent, as required for any treatment involving a minor.

11. Grievance Redressal / Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or services. The "Last Updated" date at the top of this page indicates when the Policy was last revised. We encourage you to review this page periodically.

Real Science. Real Results. Real You. — Dermis 365