Advix Physio is operated by Advix Technology, the Data
Fiduciary under India's Digital Personal Data Protection Act, 2023. This policy explains how we collect,
use, store and protect personal data.
AES-256 Encryption
Stored in India
Effective 01 July 2026
Information We Collect
Clinics using Advix Physio record personal data of their patients (Data Principals) in order to
provide physiotherapy care and manage the clinic relationship. This may include:
Clinical records — diagnosis, treatment, visit notes
Billing & payment information
How We Use Your Data
Personal data is processed on the basis of the patient's consent
and for the legitimate purpose of treatment, appointment scheduling, billing, and
legally-required record-keeping. Consent is recorded at registration and may be withdrawn at
any time. We do not use personal data for advertising or profiling.
Information Sharing & Disclosure
We do not sell personal data or share it for advertising.
Personal data is only accessed or shared in these limited situations:
Within your clinic — Authorised staff, according to their role.
Service providers — Trusted infrastructure (e.g. hosting) strictly to operate the service, under confidentiality obligations.
Legal requirements — Where required by law, court order, or lawful authority request.
With consent — Any other sharing only with the patient's explicit consent.
Each clinic's data is logically isolated — one clinic cannot access another clinic's patient data.
How We Protect Your Data
Encrypted at rest
Sensitive fields use AES-256 encryption in the database.
Encrypted in transit
All traffic is protected with industry-standard TLS.
Role-based access
Staff see only what their role permits.
Audit logging
Access and changes to personal data are logged.
Your Rights
Under the DPDP Act, a Data Principal has the right to:
Access — Obtain a copy of the personal data held about them.
Correct or update — Fix inaccurate or incomplete data.
Withdraw consent — Stop processing at any time.
Erasure — Once the purpose is served and no legal duty requires retention.
Grievance redressal — Through the contact in Section 09.
To exercise these rights, please contact your clinic or our Grievance Officer.
Data Retention
Personal data is retained only as long as necessary for the stated purposes or as required by
law. When a record is deleted, personal data is irreversibly anonymised after the applicable
retention period, while anonymised financial and audit records are retained for legal compliance.
Cookies & Tracking
Advix Physio uses only essential cookies required to keep
you securely signed in and to operate the application (for example, session and security
cookies). We do not use third-party advertising or cross-site tracking cookies. You can control
cookies through your browser settings, though disabling essential cookies may prevent you from
signing in.
Children's Privacy
Advix Physio is intended for use by physiotherapy clinics and their staff, not directly by
children. Where a patient is a minor, their personal data is provided and managed by the clinic
with the consent of a parent or lawful guardian, in accordance with the DPDP Act. We do not
knowingly allow children to create accounts on the platform.
Grievance Officer
In accordance with the DPDP Act, you may contact the designated Grievance Officer at
Advix Technology:
