Data Deletion Request

01 What this page covers

This page explains how to ask DermaVue Skin & Hair Clinics to delete the personal data we hold about you. It covers data we have received through our clinics, the dermavue.com website, our WhatsApp business numbers, and the internal patient-enquiry system our staff use to reply to those conversations.

Your right to erasure is set out in India's Digital Personal Data Protection Act, 2023 (section 12), and, where applicable, the EU/UK GDPR. The process below is the same for all three. The law that applies to you depends on where you were when the data was collected.

02 How to submit a request

Use any of the three channels below. All three are equivalent. Choose whichever is easiest for you.

03 What to include in your request

So that we can find the right record and verify it is yours, please tell us:

• Which identifiers to search against: the phone number, email address, or WhatsApp number the data is linked to. The more of these you provide, the more completely we can locate your data.
• Which data you want deleted: everything we hold, or a specific category (for example, "only my WhatsApp messages", or "only my website enquiry from March 2026"). You can also ask us to tell you what we hold before deciding.
• A government-issued photo ID (Aadhaar, passport, voter ID, or driving licence) that matches the name on the clinic record, if you are a registered patient and the request is to delete clinical data. This is to protect you from someone else impersonating you to erase your medical record. Scanned copies by email are accepted; we may ask you to present the original in person for high-sensitivity records.

If you are asking on behalf of someone else, we will need written authorisation from that person. For a minor, or for a person who cannot give consent, we will need documentation of your parental or guardianship status.

04 What data is in scope

These are the systems a deletion request can reach. If data exists in a system that is not listed here, a request still covers it. This table is for clarity, not limitation.

05 WhatsApp messages specifically

When you message DermaVue on WhatsApp, your messages, your WhatsApp profile name and phone number, and delivery status are received through Meta's WhatsApp Business Platform and stored in our patient-enquiry system so our staff can reply and follow up. This is described in §9 of our Privacy Policy.

Where a DermaVue clinic number also runs on the WhatsApp Business app, we may import up to the last six months of one-to-one chats and the contact list from that app into the same system, once, when the number is connected to the WhatsApp Cloud API. Group chats are not imported.

A deletion request removes those messages from our system. We cannot delete the copy held on your own phone, and we cannot delete the copy held by Meta. You can delete the message on your side from the WhatsApp app, and Meta's own data policy covers the copy it holds.

06 Our response and timeline

1. Within 7 working days: we acknowledge your request by email and confirm which identifiers we matched.
2. Within 30 days: we either complete the deletion and send you a written confirmation, or explain in writing which specific records we must retain under law (see §07) and for how long.
3. If the request is complex, for example where we need to coordinate with a third-party processor, we may extend the window once by up to 30 further days and will tell you before the first 30 days are up.

This is the same response window stated in §13 of our Privacy Policy, applied specifically to deletion. There is no fee for a deletion request.

07 Records we are required to keep by law

Indian law requires us to retain some categories of record for a defined period even after you ask us to delete them. During that period we restrict access to the record and do not use it for any purpose other than the legal one.

When the retention period ends, the record is deleted or irreversibly anonymised by the owning clinic.

08 Other rights you may want instead

Deletion is one of several rights set out in §13 of our Privacy Policy. If one of these fits your situation better, tell us in your email which one you want:

• Access: ask for a copy of the data we hold about you.
• Correction: ask us to correct data that is wrong or out of date.
• Withdraw consent: stop marketing calls, SMS, or WhatsApp broadcasts without deleting your clinical record.
• Nominate: under DPDPA §14, nominate another individual to exercise these rights on your behalf if you are unable to.