Privacy Policy

Effective date: 18 October 2026  ·  Last updated: 25 October 2026

TERN IVF and Fertility Centre ("TERN IVF", "we", "us") is a clinic run by its owners, Dr Sateesh Muppasani and Dr Radhika Priyadarshini, at Gayatri Enclave, Kokapet, Hyderabad. We operate the TERN IVF mobile app for iPhone and Android (the "App") and the website ternivf.com (the "Website"). Fertility care involves some of the most personal information you will ever share. This policy explains what we collect, why, where it is stored, who can see it, how long we keep it and your rights.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), TERN IVF is the Data Fiduciary for personal data processed through the App and Website. In-person care is also covered by your treatment consent forms.

1. Information we collect

• Identity and contact details: name, date of birth or age, mobile number, email address, address, patient ID, and partner or spouse details where they are part of your treatment.
• Appointments: bookings, visit history and reminders.
• Treatment cycles: medical and fertility history, cycle stage and timeline, medications and schedules, clinical notes.
• Lab results and files: laboratory, scan, semen analysis and embryology reports, and files uploaded by clinic staff.
• Bills and payments: invoices and payment records. Payments are not taken in the App at present; you pay at the clinic.
• Consents: records of treatment and data-processing consents you give.
• Video consultations: session metadata (time, participants, duration). Video consultations are not offered in the App at present; if they are introduced, calls will not be recorded.
• Device and technical data: a push-notification token, app version, device type, and security logs (sign-in times, actions taken on records).
• Website enquiries: details you send through the contact form or by email.

2. How we use your information

• To provide and manage your fertility care, appointments, cycles, reports, bills and video consultations.
• To sign you in securely and send you reminders and updates.
• To keep medical records as required by law, including the ART (Regulation) Act, 2021 and ICMR guidelines.
• To keep the App secure, detect misuse and investigate incidents.

We do not sell your data. We do not show advertising in the App or use advertising or cross-app tracking tools, and we do not use your data for marketing profiles.

3. Legal basis and consent

We process your data on the basis of your consent, given in the App and in clinic consent forms, and where the law permits processing without consent, such as compliance with legal record-keeping duties and medical emergencies. You may withdraw consent at any time (see section 7); withdrawal does not affect records we are legally required to keep.

4. Who we share it with

Inside the clinic, only the doctors and staff involved in your care can see your records. Partner or spouse access is only given as set out in your treatment consents, and only when the clinic has linked your accounts with both partners' agreement. We use these service providers (Data Processors), bound by contract to process data only on our instructions:

We keep health details out of notification text; medicine reminders say only "Medicine reminder from TERN IVF". We may disclose data where required by law, court order or a regulator, including the ART National and State Registry and Boards.

5. Where and how long we store it

Patient records and files are stored in India, in Supabase's Mumbai region (ap-south-1). Some limited technical data handled by Firebase, Cloudflare and Google Workspace may be processed outside India, as permitted under the DPDP Act.

Medical records are kept for at least 10 years after your last treatment, as the ART Act, 2021 requires. Records are "soft deleted": when removed from view they are retained securely and only permanently erased once the retention period ends. Website enquiries not linked to treatment are kept only as long as needed to respond to them.

6. How we protect it

• Sign-in: patients sign in with a one-time code sent to their email; no password is stored.
• Staff MFA: clinic staff must use multi-factor authentication.
• Row-level access controls: the database enforces that each patient can see only their own records, and staff only what their role allows.
• Audit logs: access and changes to records are logged.
• Encryption: data is encrypted in transit and at rest; lab files are kept in private storage.

If a personal data breach occurs, we will notify affected people and the Data Protection Board of India as required by law.

7. Your rights

Under the DPDP Act you have the right to:

• Access a summary of your personal data and how it is processed;
• Correct or complete inaccurate data;
• Erase your data, where the law allows; medical records we must keep under the ART Act or other law will be retained for the required period;
• Withdraw consent;
• Nominate another person to exercise your rights in case of death or incapacity;
• Grievance redressal through our Grievance Officer, and then the Data Protection Board of India.

To exercise these rights, email [email protected]. We will respond within 30 days.

8. Children

The App is intended for adults. We do not knowingly accept accounts from people under 18. Any data about a child (for example after a pregnancy) is processed only with verifiable parental consent as the DPDP Act requires.

9. Changes to this policy

If we make significant changes we will tell you in the App before they take effect and, where required, ask for your consent again.

10. Contact and Grievance Officer