01Purpose of this notice
This notice supplements our Privacy Policy and is presented at the point we collect personal data, as the laws require. It applies to clinic customers and patients whose data is processed on a clinic's instructions.
02Data fiduciary / controller
For your account and website data: EaseHawk Technologies Private Limited, Gurugram, India. For patient records: the clinic you attend is the data fiduciary (India) or controller (UAE/KSA); QivoClinic is its data processor.
03Personal data and purposes
| Data | Purpose | Basis |
|---|---|---|
| Identity and contact details | Account creation, appointment booking, confirmations and reminders | Consent · contract |
| Health and consultation records | Clinical care by the clinic, prescriptions, lab and billing workflows | Clinic's lawful basis · your consent to the clinic |
| Messages and replies | Two-way communication, follow-up care, review requests | Consent (opt-out any time) |
| Payment information | Invoicing and collection | Contract · legal obligation |
| Usage data | Security, service improvement | Legitimate use |
04Consent and withdrawal
Where processing rests on consent, it is requested in clear language at the time of collection. You may withdraw consent as easily as you gave it — reply STOP to any message, use the portal settings, or contact your clinic or privacy@qivoclinic.com. Withdrawal does not affect processing already carried out.
05Your rights
- India (DPDP Act): access to a summary of your data; correction and erasure; grievance redressal; nomination of another person to exercise rights in case of death or incapacity.
- UAE (PDPL): access, rectification, erasure, restriction, objection, portability, and the right not to be subject to solely automated decisions with legal effect.
- Saudi Arabia (PDPL): to be informed, access, obtain a copy, correction, destruction, and withdrawal of consent.
Requests are answered within the period set by the applicable law.
06Cross-border processing
Clinic data is stored in the region chosen by the clinic. Transfers outside India, the UAE or KSA occur only to sub-processors under contractual safeguards and where the applicable law permits, including any required approvals in Saudi Arabia.
07Retention and deletion
Personal data is erased when the purpose is served and retention is no longer required by law, or on a valid erasure request, unless the clinic must keep the record under medical-record rules.
08Grievance and complaints
India: Grievance Officer (info@easehawk.com); if unresolved, the Data Protection Board of India. UAE: the UAE Data Office. Saudi Arabia: the Saudi Data & AI Authority (SDAIA).
09Updates
This notice will be revised when the law or our processing changes. The version and effective date appear at the top of the page.