Privacy Policy

This Policy is intended to be read with any service-specific consent form, patient notice, contract or terms of use. It is designed to support compliance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and rules brought into force under it, the Information Technology Act, 2000 and applicable healthcare and telemedicine requirements. If a mandatory legal requirement conflicts with this Policy, that requirement will prevail.

1. Scope and Our Role

This Policy applies to personal data processed by Hithalaya in digital form, including data collected digitally and non-digital data subsequently digitized. It also describes our confidentiality practices for patient and medical records more generally.

For personal data for which we determine the purpose and means of processing, SCASCI Healthcare Private Limited acts as the Data Fiduciary. Where we process data solely on behalf of a hospital, doctor or other organization, that organization may be the Data Fiduciary and its privacy notice may also apply.

2. Personal Data We Collect

Depending on your interaction with us, we may collect:

2.1 Identity and Contact Data

• Name, age or date of birth, gender, address, phone number and email address.
• Patient, family member, guardian, caregiver and authorized-representative details.
• Identity or authority documents where reasonably required to verify a request, consent or relationship.

2.2 Health and Care Data

• Medical history, diagnosis, prescriptions, treatment, hospital discharge information, allergies and test reports voluntarily provided or lawfully received.
• Rehabilitation needs, therapy and nursing assessments, recovery progress, monitoring data and care plans.
• Information required to coordinate post-ICU, post-surgery, post-hospitalization, dialysis, palliative, transition, restorative, home-care or related services.

2.3 Service, Billing and Communication Data

• Enquiries, callback requests, appointments, facility visits, complaints, feedback and correspondence.
• Service, transaction, billing, invoice and payment-status information. We do not intentionally retain complete card or banking credentials unless necessary and lawfully permitted.

2.4 Technical and Usage Data

• IP address, device and browser information, log data, website activity, approximate location inferred from technical data, security events, cookies and similar technologies, where applicable.

Please provide only data that is accurate, necessary and relevant. If you provide another person’s data, you confirm that you are authorized to do so and have provided any required notice or obtained any required consent.

3. Purposes and Legal Basis

We process personal data only for a lawful purpose. Depending on the circumstances, processing may be based on your free, specific, informed and unambiguous consent; your voluntary provision of data for a specified purpose; compliance with law or an order; a medical emergency or threat to life or health; or another use permitted by applicable law.

We may process data to:

• Respond to enquiries and callback requests and provide requested information.
• Assess needs; deliver and coordinate healthcare, rehabilitation and support services; prepare and monitor care plans; arrange appointments, consultations, therapy, nursing, diagnostics, transport and facility visits.
• Communicate with patients and authorized family members, guardians or caregivers.
• Maintain medical, clinical, operational, billing, consent, complaint and regulatory records.
• Protect patients, staff, systems and facilities; prevent fraud or misuse; investigate incidents; establish, exercise or defend legal claims; and comply with law.
• Improve our website, care quality, patient experience, safety and internal processes using appropriately limited or de-identified information where feasible.

We will not process personal data for a new incompatible purpose unless permitted by law or after giving an appropriate notice and obtaining consent where required. Refusing or withdrawing optional consent will not affect unrelated services, but we may be unable to provide a service that genuinely requires the relevant data.

4. Consent and Your Choices

Where processing is based on consent, our notice will describe the personal data sought, the specified purpose and how to withdraw consent, exercise rights and raise a grievance. Consent may be withdrawn through the same or a comparably easy method by contacting us. Withdrawal does not affect processing already undertaken lawfully.

We will separately seek consent where required for optional marketing, non-essential cookies, testimonials, photographs, recordings, research or another purpose not necessary to provide requested care. You may opt out of promotional communications using the method stated in the message or by contacting us.

5. Medical Confidentiality

Health information is confidential. Access is limited according to role and need. We disclose it only to authorized personnel and recipients who require it for care, administration, payment, safety, legal compliance or another lawful purpose. Clinical decisions remain with appropriately qualified healthcare professionals.

Disclosure to a family member or caregiver normally requires patient authorization or other lawful authority. We may act without prior consent where necessary in a medical emergency, to protect life or health, or where disclosure is required or permitted by law.

6. Sharing and Data Processors

We do not sell personal data. Subject to necessity, proportionality and applicable law, we may share relevant data with:

• Doctors, nurses, therapists and other authorized healthcare professionals.
• Hospitals, laboratories, pharmacies, ambulance providers, insurers or payers where applicable, and healthcare partners involved in care.
• Technology, hosting, communications, payment, records-management, security, and professional-service providers that process data under our instructions.
• Authorized representatives, family members, guardians or caregivers.
• Regulators, courts, law-enforcement or government authorities, or other parties where legally required or necessary to protect lawful interests.
• A successor in a merger, reorganization or transfer, subject to confidentiality and applicable law.

We require processors and service providers to use personal data only for authorized purposes, maintain confidentiality and reasonable security, assist with lawful requests and incidents, and delete or return data as agreed, subject to law.

7. Security and Personal Data Breaches

We maintain reasonable technical, organizational and administrative safeguards appropriate to the nature and risk of processing. Measures may include access controls, authentication, encryption or masking where appropriate, logging and monitoring, backups, secure disposal, vendor controls, staff confidentiality and training, and periodic review.

No system is completely secure. You should use secure channels, protect account credentials, and avoid sending unnecessary medical data through open or shared communications.

If a personal data breach occurs, we will take reasonable steps to contain and remediate it, preserve relevant records, and notify affected individuals and the competent authority in the form and manner required by applicable law.

8. Retention and Deletion

We retain personal data only for as long as necessary for the stated purpose, continuity of care, legal and professional record-keeping, billing, audit, dispute resolution and other lawful requirements. Retention periods vary by record type and applicable law.

When retention is no longer required, we will take reasonable steps to securely delete, anonymize or render data inaccessible. Data may remain temporarily in protected backups or archives until overwritten under normal cycles, and may be preserved where a legal hold applies.

9. Teleconsultation and Digital Health

Remote consultations, monitoring, therapy follow-ups and digital communications may involve collection of identity, consultation, health and device-generated data. Teleconsultation will be conducted by or under the responsibility of appropriately authorized professionals and handled in line with applicable telemedicine and professional requirements.

Your consent may be express or implied where legally permitted; express consent will be recorded where the consultation is initiated by a healthcare professional or otherwise required. Relevant consultation and prescription records may be retained. Digital services have limitations and do not replace emergency care. In an emergency, contact local emergency services or attend the nearest suitable healthcare facility.

10. Cookies and Analytics

We may use essential cookies for functionality, security and session management. With consent where required, we may use analytics or other non-essential technologies to understand use and improve performance. You can manage cookies through our available controls or your browser settings; disabling some cookies may affect functionality.

11. Cross-Border Processing

Some authorized service providers may process personal data outside India. Where this occurs, we will apply contractual and security safeguards and comply with restrictions or requirements notified under Indian law. We will not transfer personal data to a country or territory prohibited by the Central Government.

12. Third-Party Services

Our website or communications may link to independent third-party services. Their privacy practices are governed by their own notices. We encourage you to review those notices before providing data. This does not limit any responsibility that cannot lawfully be excluded.

13. Your Rights and Duties

Subject to applicable law and any valid exemption, you may:

• Request a summary of personal data being processed and the processing activities.
• Request the identities of other Data Fiduciaries and processors with whom personal data has been shared, where the law requires disclosure.
• Request correction, completion, or updating of inaccurate or incomplete data.
• Request erasure of data that is no longer necessary, unless retention is legally required.
• Withdraw consent where processing relies on consent.
• Raise a grievance and, after using our grievance process, complain to the Data Protection Board of India when applicable.
• Nominate another individual to exercise applicable rights in the event of death or incapacity.

To protect confidentiality, we may verify your identity and authority before acting. We may decline or limit a request where permitted by law and will explain the reason where required. You must not impersonate another person, suppress material information, submit false or frivolous grievances, or provide inauthentic documents.

14. Children and Persons Requiring Lawful Guardianship

For a person under 18 years of age, or a person with disability who has a lawful guardian acting on their behalf, we will obtain verifiable consent from the parent or lawful guardian where required before processing personal data.

We do not knowingly undertake tracking, behavioral monitoring, or targeted advertising directed at children, except to the extent a lawful exemption applies. Guardians should provide only data necessary for care and may contact us about a child’s data.

15. Grievance Redressal

Questions, rights requests and grievances may be submitted using the contact details below with sufficient information for us to identify the matter. We will acknowledge, investigate and respond within the period required by applicable law. If you remain dissatisfied after our response, you may pursue remedies available under applicable law.

16. Changes to This Policy

We may update this Policy to reflect legal, technological or service changes. The revised version will display an updated effective date. Where a change materially affects consent-based processing, we will provide an appropriate notice and seek fresh consent where required.

17. Contact and Grievance Officer

For urgent medical assistance, do not use privacy-request channels. Contact emergency services or the nearest suitable healthcare facility.