Privacy Policy & DPDP Act 2023 Compliance Statement

Last Updated: October 2026

This Privacy Policy governs the collection, processing, and erasure of personal and clinical data by medicolegalexpert.in and Dr. Himanshu Vats (hereinafter referred to as the "Data Fiduciary").

Because we process highly sensitive medical records, our data architecture is built on a "Zero-Trust," asymmetric minimization framework. We are strictly compliant with the mandates of the Digital Personal Data Protection (DPDP) Act, 2023 of India.

1. Classification of Data Collected

To execute our forensic audits, we collect two distinct categories of data from Instructing Counsel or the Client (the "Data Principal"):

Administrative Data: Name, Bar Council Enrollment Number (if applicable), billing address, email, and phone number required for invoicing and communication.
Clinical Data: Hospital Bed-Head Tickets (BHTs), Medico-Legal Case (MLC) papers, diagnostic imaging, operative notes, and hospital Standard Operating Procedures (SOPs) uploaded to our secure vault for the purpose of the forensic audit.

2. Strict Purpose Limitation

We operate under a doctrine of absolute purpose limitation.

Clinical data is processed exclusively for the purpose of conducting a chronological deconstruction, standard-of-care deviation mapping, and the generation of a Medico-Legal Assessment Report.
We do not use your data for marketing, we do not run analytical profiling on client files, and we absolutely do not sell, rent, or distribute clinical files to third-party data brokers.

3. Data Storage, Vaulting & Security

General consumer cloud storage is insufficient for clinical forensics.

All ingested case files are stored in an end-to-end encrypted digital vault.
Access to the clinical file is strictly restricted on a need-to-know basis directly to Dr. Himanshu Vats.
Our systems utilize advanced encryption protocols to prevent unauthorized interception during file transit and at rest.

4. Data Retention and Mandatory Erasure (Purging)

We do not hoard clinical data. In compliance with the data minimization obligations of the DPDP Act, 2023:

Once the Medico-Legal Assessment Report is delivered and the commercial engagement (Tier 1 to Tier 4) is concluded, the raw clinical data is retained for a maximum "cooling-off" period of 30 days to address any immediate technical clarifications.
Upon the expiration of 30 days, the raw clinical files are securely and permanently purged from our active vault, unless a specific legal mandate or ongoing Retainer Agreement dictates otherwise. Administrative billing data is retained solely for statutory tax compliance.

5. Rights of the Data Principal

Under the DPDP Act, 2023, the Client retains the following rights regarding their data:

Right to Access: To request confirmation of what administrative data is being stored.
Right to Correction & Erasure: To request the immediate deletion of files before the 30-day purge cycle (Note: Requesting erasure before an audit is complete will immediately terminate the engagement without a refund).
Right of Grievance Redressal: To have data privacy concerns addressed promptly by our designated officer.

6. Mandatory Disclosure Exceptions

medicolegalexpert.in maintains strict confidentiality, subject only to statutory exceptions.

We will only disclose records if compelled by a valid subpoena, court order, or binding directive from a competent law enforcement agency or judicial authority under the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023.

7. Grievance Redressal Officer

In accordance with the DPDP Act, 2023, any concerns regarding data privacy, file purging, or unauthorized access must be directed to our Grievance Officer:

Officer Name: Dr. Himanshu Vats
Email: legal@medicolegalexpert.in
Physical Address: Alipur, Delhi, India
Response Time: Grievances will be acknowledged within 48 hours and resolved within the statutory limit of 30 days.