Skip to main content

Legal · Data Rights

Data Deletion and Your Rights

Last updated: 2 June 2026 · Under the Digital Personal Data Protection Act 2023

Your rights under DPDP

The Digital Personal Data Protection Act, 2023 (DPDP Act) gives you the following rights over your personal data held by Kyros Clinic:

  • Right to access: request a complete copy of all personal data we hold about you.
  • Right to correction: request correction of inaccurate or outdated personal data.
  • Right to erasure: request deletion of your account and personal data, subject to legal retention requirements.
  • Right to grievance redressal: raise a complaint with our Data Protection Officer.

How to request data deletion

Option 1: From the Kyros app

  1. Open the Kyros app and go to Profile.
  2. Tap Privacy & Data.
  3. Tap "Delete my account and data".
  4. Confirm with your OTP.

Your account will be deactivated immediately. Data deletion completes within 30 days.

Option 2: By email

Email dpo@kyrosclinic.com from the email address registered on your account, with the subject line "Data deletion request".

We will verify your identity and confirm receipt within 3 business days. Deletion completes within 30 days of verification.

What is deleted

  • Your account and login credentials.
  • Profile information (name, contact details, date of birth).
  • Health profile (conditions, allergies, medications).
  • Consultation history, notes, prescriptions, and lab reports stored on Kyros.
  • Uploaded files (lab reports, documents) stored in Kyros's S3 storage.
  • Notification preferences and app settings.

What is retained after deletion

The following data is retained after account deletion for the legally required retention periods:

  • Medical records: retained for 7 years under Indian healthcare law. Retained in anonymised form where possible.
  • Payment records: retained for 7 years as required under the Companies Act and GST law.
  • Consent records: retained for the duration of the legal retention requirement to demonstrate regulatory compliance.
  • Audit logs: retained for 3 years for security and fraud prevention purposes.

Where data must be retained by law, it is retained in anonymised form where possible and is not used for any purpose other than the legally required one.

Data access and correction requests

To request a copy of your data or to correct inaccurate data, email dpo@kyrosclinic.com with the subject line "Data access request" or "Data correction request". We will respond within 7 business days.

Grievance redressal

If you believe your rights under the DPDP Act have not been honoured, you may:

  1. First, contact our DPO at dpo@kyrosclinic.com.
  2. If not resolved within 30 days, you may escalate to the Data Protection Board of India at dpb.gov.in.