Privacy Policy

Who this policy covers

This policy applies to drdhanrajchavan.com (the site) and to the Google-connected application described under Google account data below, which is registered with Google under the name Dhanraj Chavan. Both are operated by Dr Dhanraj D Chavan, a dermatologist practising in Pune, Maharashtra, India (referred to below as the operator).

The clinic sites clearskin.in and hairmdindia.com are separate properties with their own privacy notices. This policy does not cover them, and it does not cover clinical records held by those clinics.

Do not send medical information

This site is not a channel for patient care. Do not send symptoms, photographs of a condition, medical history, prescriptions, or any other health information through the contact form. Nothing you send here becomes part of a medical record, and no reply through this site is medical advice.

For treatment, appointments, or anything clinical, use clearskin.in or hairmdindia.com. Those teams handle patient contact directly and hold records under clinical confidentiality.

What the site collects

Contact form

The form on the contact page asks for a name, an email address, a subject, and a message. Phone number and organisation are optional. The form also carries a hidden field that spam robots fill in and people do not; a submission with that field filled is discarded.

A submitted message is turned into an email and delivered to one private mailbox through Resend, a transactional email service. The recipient address is not published on this site and is not stored in the site's public source code. Nothing is written to a database, a customer-relationship system, or a mailing list. The information is used only to read and answer the message.

Analytics

The site uses two measurement tools, and only on the live domain. Preview and local builds send nothing.

• Google Analytics 4. First-party cookies that count page views, referrers, approximate location by country or city, device type, and browser. Google Signals and advertising personalisation are switched off, so this site does not feed advertising profiles and does not build cross-device identity.
• Cloudflare Web Analytics. Injected by the hosting edge. It sets no cookies, does not fingerprint the browser, and reports aggregate traffic only.

Neither tool is used to identify an individual visitor, and the operator does not try to link analytics data to a person who later writes through the contact form.

Hosting and security logs

The site is hosted on Cloudflare Pages. Cloudflare processes a request log containing the IP address, the user agent, and the requested URL. This is needed to deliver the page and to block attacks. The operator does not mine those logs and does not export them.

Cookies

The only cookies this site sets are the first-party Google Analytics cookies described above. There are no advertising cookies, no social-media pixels, and no cross-site trackers.

You can refuse or delete them in your browser settings, or install Google's opt-out add-on. A browser that sends "do not track" or blocks scripts loses nothing on this site: every page works without JavaScript.

Google account data — the Google-connected application

The operator runs a private command-line application, registered with Google under the name Dhanraj Chavan, that signs in with Google to read and manage the operator's own Google properties. It is internal working tooling. It is not a consumer product, there is no public sign-up, and it stores no data about visitors to this website.

Who may sign in

Only the operator, and staff acting for the operator, sign in to this application, and only with Google accounts that the operator owns or administers. The application never asks a member of the public for access to their Google account.

What it reads, and why

• Google Analytics and Search Console — traffic and search performance for the operator's own websites.
• Site Verification — proving ownership of those same domains.
• Google Cloud and BigQuery — the operator's own cloud projects and datasets.
• Where enabled for a particular task: Tag Manager, Google Business Profile, YouTube and YouTube Analytics, and Google Ads — again, only accounts the operator owns or administers.

Access is requested at the narrowest scope that does the job, and read-only wherever a read-only scope exists.

Where the credentials live

The OAuth tokens are held on the operator's own computers, in the local credential store. There is no shared server, no hosted database, and no copy held by any third party other than Google itself.

What is never done with it

• It is not sold, rented, or licensed.
• It is not transferred to any other person, company, or application.
• It is not used for advertising, profiling, or audience building.
• It is not used to train, develop, or improve any artificial-intelligence or machine-learning model. This includes the operator's clinical-AI work described on the Building page, which uses none of it.
• It is not read by a human except where the account owner asks for it, or the law requires it.

Withdrawing access

Any account holder who has signed in can revoke the application at myaccount.google.com/permissions. Revoking makes the stored token useless immediately. Local copies of the token are deleted when access is withdrawn or when the tooling is no longer needed.

How long information is kept

• Contact-form messages — kept in the mailbox for as long as the correspondence is useful, then deleted. Write through the form to ask for earlier deletion.
• Analytics — Google Analytics holds user-level and event-level data for the retention period set on the property, up to a maximum of 14 months. Aggregate reports survive longer. Cloudflare Web Analytics keeps aggregate counts only.
• Hosting logs — kept on Cloudflare's own retention schedule.
• Google OAuth tokens — kept until access is revoked or the tooling is retired.

Who else processes this information

The operator uses a small number of established service providers, each acting only on instruction:

• Cloudflare, Inc. — hosting, edge delivery, and cookieless analytics.
• Resend (Plus Five Five, Inc.) — delivery of contact-form email.
• Google LLC — analytics, and the Google APIs described under Google account data.

These providers operate globally, so information may be processed on servers outside India, including in the United States and the European Union. No information is sold or shared for anyone else's marketing.

Your rights

You can ask what the operator holds about you, ask for it to be corrected, or ask for it to be deleted. If you are in the European Economic Area or the United Kingdom, you also have the rights the GDPR gives you, including the right to object to processing and to complain to your supervisory authority. If you are in India, the Digital Personal Data Protection Act, 2023 gives you equivalent rights.

Send any of those requests through the contact form. In practice the only thing the operator is likely to hold about you is an email you sent, which can be deleted on request.

Security

The site is served over HTTPS only. The contact form validates its input and escapes it before it is put into an email. Delivery credentials are held as encrypted secrets on the hosting platform and are not present in the site's public source code. No health information, payment information, or account passwords are collected anywhere on this site.

Children

This site is written for clinicians, researchers, and other professional readers. It is not directed at children, and the operator does not knowingly collect information from anyone under 18. If a child has sent something through the form, write in and it will be deleted.

Links to other sites

Pages here link to clinic sites, professional networks, video channels, journals, and conference pages. Once you follow such a link you are on someone else's site, under their privacy policy. The operator does not control them.

Changes to this policy

Changes are published on this page, and the date at the top is updated. Where a change materially affects what is collected or how it is used, the change is described here rather than made silently.

Contact

Privacy questions, access requests, and deletion requests all go through the contact form. There is no published email address or phone number on this site — the form is the route, and it reaches the operator directly.

See also the Terms of Service for this site.