Privacy policy

Effective date: 14 November 2026 (version 2). This policy explains what information the Dietitian Sandhi Shimu website (dtsandhi.com) collects, why, who can see it, how long it is kept, and your choices.

Who we are

The website and the information it holds are the responsibility of the practice of Dietitian Sandhi Shimu, 178–179, Two Star Tower (2nd Floor), East Tejturi Bazar, Farmgate, Dhaka 1215, Bangladesh. For any privacy question or request: info@dtsandhi.com, +8801894-443736.

What we collect

• Contact form: your name, email and message.
• Accounts: name, email, password (stored only as a secure hash, from which the password cannot be recovered), an optional phone number, your preferred language, and your confirmation at registration that you are 18 or older and consent.
• Patient records: appointment requests and their notes, diet charts your dietitian prepares, the progress (such as weight) and food diary entries you add, and notices in your account inbox.
• Orders: delivery name, phone number and address, products, payment method, and the payment record staff enter. For digital products, a record of each download (which file, which order, when). We never ask for a card number, PIN or password.
• Messages we send: a list of the emails and SMS sent about appointments and orders, so we can see what was delivered.
• Security: a scrambled (hashed) code of your network address to stop abuse, which deletes itself within an hour; and a log of security events such as sign-ins and account changes, which holds no health information.
• Visit statistics: cookie-free daily totals that cannot identify you.

Health information and your consent

Health information is sensitive. When you create an account you give explicit consent for the information you add, including health information, to be used to provide your care; an account cannot be created without it. We ask only for what your care needs. It is never used for advertising or analytics, and never sold. You can withdraw your consent at any time: tell us and we erase your records (see "Your rights"); this does not affect care already given. Please do not put detailed health information in the contact form or on WhatsApp unless you choose to.

Why we use it

• To answer your questions and arrange consultations.
• To provide care through consultations, diet charts and follow-up.
• To process orders and deliveries and keep payment records.
• To send emails about your appointments or orders; SMS only with your consent.
• To keep the website secure and prevent abuse.

For each purpose we use only the information it needs.

Who can see it

Each kind of work has its own role, and each person sees only what their work needs: the dietitian sees patient records, support staff see appointments and contact messages, store staff see orders, and administrators see everything in order to run the website. Account holders see only their own records, never anyone else’s.

Service providers and where information is kept

• Server: the website and its database run on a rented server from Contabo, in Singapore.
• Off-site backups: Backblaze B2 storage (Backblaze, Inc., USA). Backups are encrypted on our server with a key that only the practice holds; Backblaze cannot read them.
• Email: account, appointment and order emails, and contact form alerts, are sent through the practice’s email hosting service.
• SMS: only with your consent, and only while SMS updates are switched on, through a Bangladeshi SMS service (BD Bulk SMS).
• Analytics: only if you allow it, and only on general information pages: Google Analytics through Google Tag Manager (Google LLC), and Microsoft Clarity (Microsoft Corporation).
• WhatsApp: if you contact us on WhatsApp, the conversation is handled by WhatsApp (Meta) under its own terms; we use it only to reply and arrange your care.

We do not sell your information, and we disclose it to no one else unless the law requires it.

Cookies and analytics

Visitors who do not sign in get no cookies, except one that remembers your privacy choice if you make one. Signing in needs a login cookie. Only if you allow it, and only on general information pages, the site uses the analytics services above; never on account, booking, health record, calculator, cart or checkout pages. You can change your choice at any time with "Cookie settings" at the bottom of the page.

How long we keep it

• Contact messages: kept by the practice until the practice decides to delete them or you ask us to; none is deleted automatically.
• Accounts and patient records (appointments, diet charts, progress, food diary, inbox): kept as the record of your consultations and care, and never deleted automatically. They are deleted only after we have reviewed your request, or with the practice’s authorization; every deletion is recorded in the security log.
• Orders, payment records and download records: kept as accounting records, and never deleted automatically. On an erasure request, the delivery name, phone and address are removed.
• The list of messages sent: with the appointment or order it belongs to.
• Anti-abuse codes: they delete themselves within an hour.
• Backups: the server’s copy of each daily encrypted backup is kept for about one day once its off-site copy has been verified. Off-site encrypted copies are kept to recover from data loss, and only the practice itself can delete them; none is deleted automatically. Information you asked us to erase can therefore remain in these encrypted copies. They are never restored except to recover from data loss, and if one is restored, your erasure is carried out again.

The practice deletes nothing automatically. Information is deleted only with the practice’s authorization (only an administrator can do it, and every deletion is recorded) or on your verified request. The practice reviews what it keeps and whether it is still needed for your care, for accounting or for legal reasons, and deletes information where the law of Bangladesh requires it.

Security

Access is limited by role, passwords are stored only as secure hashes, backups are encrypted and restoring them has been tested, and once the website is public every connection is encrypted with HTTPS.

If something goes wrong

If a security incident may affect your information, we act at once to contain it, tell you by email without undue delay what happened and what you can do, and inform the authorities where Bangladeshi law requires it.

Email and WhatsApp

We send emails about your account, appointments and orders. We never ask for your password, PIN or card details by email, phone or WhatsApp. Contacting us on WhatsApp is optional.

Your rights

• A copy: account holders can download a copy of their information from the account page with "Download my data"; anyone else can write to us.
• Correction: you can change your details on the account page. To correct or remove a progress or food diary entry you added, ask us.
• Erasure and closing your account: write to info@dtsandhi.com from your account’s email address. A person at the practice confirms it is you, reviews the request and replies within 30 days, saying what was done. Once it is approved, we delete your appointments, diet charts, progress and food diary entries, inbox and the list of messages sent, and delete your account. If you have orders, they stay as accounting records without the delivery name, phone and address, and the account is closed for good and made anonymous. Only what the law requires us to keep is kept, and the reply says so.
• Withdrawing consent: you can switch off SMS updates and analytics at any time; to withdraw consent for health information, ask for erasure.
• Complaints: please tell us first; you may also use any rights you have under the law of Bangladesh.

Children

Accounts are for people aged 18 or older, which you confirm when you register. A child’s or teenager’s nutrition care is arranged by a parent or guardian, from their own account, who gives the information needed. We do not knowingly keep an account of anyone under 18, and close one if we learn of it.

Law, changes and contact

This policy is governed by the laws of Bangladesh. If it changes, the new version is published on this page with its date, and account holders are told of significant changes by email. For any question, write to info@dtsandhi.com.