1. PURPOSE OF THIS PRIVACY POLICY
Mahavir Hospital respects the privacy and confidentiality of patients, attendants, visitors, website users and other individuals whose personal information is processed by the Hospital. This Privacy Policy explains how Mahavir Hospital collects, receives, uses, stores, processes, discloses and protects personal information obtained through the Hospital website, appointment and enquiry forms, telephone, email, WhatsApp and other communication platforms, hospital registration/admission processes, medical records, diagnostic and laboratory services, insurance and TPA processes, billing and payment systems, CCTV and security systems, and other legitimate hospital operations. This policy is intended to operate consistently with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and applicable rules, notifications and amendments as and when the relevant provisions become applicable.
2. INFORMATION WE MAY COLLECT
Depending upon the nature of your interaction with Mahavir Hospital, we may collect identity information such as name, age/date of birth, gender where clinically/administratively required, photograph where required, and government identification details where legally or operationally required. We may collect contact information such as mobile number, telephone number, email address, residential/correspondence address and emergency contact details. Where required for healthcare delivery, we may process medical history, symptoms and complaints, diagnoses, clinical notes, prescriptions, investigation reports, laboratory results, imaging reports, treatment information, surgical/procedure information, medication information, allergies, vital signs, discharge summaries, insurance-related medical documentation and other information reasonably necessary for patient care.
3. WEBSITE INFORMATION
When you use our website, technical information may be automatically collected, including IP address, browser type, device type, operating system, approximate location derived from technical information, pages visited, date and time of access, referral information, website interaction information and technical/security logs. Such information may be used for website operation, security, analytics, troubleshooting and service improvement.
4. INFORMATION SUBMITTED THROUGH WEBSITE FORMS
When you submit an enquiry or appointment request, we may collect name, phone/mobile number, email address,enquiry, preferred appointment information, doctor/specialist preference and other information voluntarily supplied by you. Please do not submit unnecessary sensitive medical information through a general website enquiry form
5. PURPOSES FOR WHICH INFORMATION IS USED
Mahavir Hospital may use personal information for legitimate healthcare, administrative and operational purposes, including processing appointment requests; responding to enquiries; providing medical treatment; maintaining medical records; coordinating healthcare services; communicating with patients and attendants; conducting investigations and diagnostics; billing and accounting; insurance and TPA processing; government healthcare schemes; regulatory compliance; patient safety; emergency care; hospital administration; quality improvement; audit; legal compliance; fraud prevention; cybersecurity; website operation; analytics; internal reporting; and other purposes permitted by applicable law.
6. MEDICAL RECORDS AND CONFIDENTIALITY
Mahavir Hospital recognises the confidential nature of medical information. Access to patient information is restricted according to professional responsibilities, legitimate hospital requirements, applicable law and authorized purposes. Medical information may be shared where reasonably necessary for treatment, continuity of care, referral, emergency medical management, diagnostic services, insurance/TPA processing, government schemes, legal/regulatory requirements, public-health requirements where legally required, or other circumstances permitted by applicable law. The Hospital shall not treat patient medical information as ordinary marketing data.For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
7. DOCTORS, CONSULTANTS AND HEALTHCARE PROFESSIONALS
Patient information may be made available to treating doctors, visiting consultants, specialists, nurses, technicians and other authorized healthcare personnel where necessary for patient care or legitimate hospital operations. Where a consultant operates independently or under a separate professional arrangement, information may be shared as reasonably necessary for treatment, coordination and legal/administrative purposes.
8. LABORATORIES, DIAGNOSTIC PROVIDERS AND OTHER SERVICE
PROVIDERS
The Hospital may share relevant information with laboratories, diagnostic service providers, pharmacies, blood banks, ambulance providers, specialist consultants and other healthcare service providers where reasonably necessary for patient care. Only information reasonably necessary for the relevant purpose should be disclosed.
9. INSURANCE, TPA AND GOVERNMENT SCHEMES
Where a patient seeks insurance, cashless treatment, reimbursement or government healthcare benefits, the Hospital may process and disclose relevant personal and medical information to insurance companies, TPAs, government authorities, government healthcare schemes, authorized auditors and other entities involved in claim processing. Such disclosure shall be limited to information reasonably necessary for the relevant process, subject to applicable law
10. LEGAL AND REGULATORY DISCLOSURES
The Hospital may disclose personal or medical information where disclosure is required or permitted by applicable law, court order, governmental authority, regulatory requirement, law-enforcement requirement, public-health obligation or other lawful process.
11. EMERGENCY DISCLOSURES
In emergencies, information may be disclosed where reasonably necessary to protect the life, health or safety of the patient or another person, subject to applicable law.
12. CHILDREN’S DATA
Where services involve children, information may be collected and processed through parents, guardians or other legally authorized persons as required by applicable law. The Hospital shall implement safeguards applicable to children’s personal data as required under the applicable data-protection framework.
13. PATIENT PHOTOGRAPHS, VIDEOS AND IMAGES
Mahavir Hospital may collect photographs, videos or other images for patient identification, medical documentation, clinical records, hospital security, training or education where appropriately authorized, research where legally permissible, and communication/awareness activities where appropriate authorization has been obtained. Patient photographs or identifiable medical information shall not ordinarily be used for public advertising, social media, promotional campaigns or similar purposes without appropriate authorization/consent, where required.
14. CCTV AND SECURITY MONITORING
Mahavir Hospital may operate CCTV and other security systems within appropriate hospital premises for patient and visitor safety, staff safety, prevention and investigation of theft or misconduct, security, incident investigation and protection of Hospital property. CCTV shall not ordinarily be installed in areas where individuals have a legitimate expectation of medical privacy, such as examination rooms, consultation rooms, toilets and changing areas, subject to lawful security requirements. CCTV recordings shall be retained for an appropriate period based on security, operational, legal and evidentiary requirements.
15. COOKIES AND ANALYTICS
The website may use cookies and similar technologies for website functionality, security, analytics, performance monitoring, understanding website usage, improving user experience and advertising/marketing measurement where implemented. Third-party analytics or advertising providers may process technical information in accordance with their respective policies. The Hospital may use services such as Google Analytics, Google Tag Manager, Meta-related technologies, reCAPTCHA or other third-party technologies where installed on the website.
16. MARKETING COMMUNICATIONS
The Hospital may communicate information about healthcare services, health-awareness activities, camps, preventive-health initiatives and Hospital announcements through appropriate channels where permitted by law. Where consent is legally required, the Hospital shall seek appropriate consent. Recipients may request cessation of promotional communications through the available opt-out mechanism.
17. WHATSAPP, EMAIL, SMS AND ELECTRONIC COMMUNICATION
Patients should understand that electronic communication platforms may carry inherent privacy and cybersecurity risks. Mahavir Hospital may use telephone, email, SMS, WhatsApp or similar platforms for appointment, administrative, healthcare coordination, billing, insurance and other legitimate communications. The Hospital shall take reasonable precautions, but cannot guarantee absolute security of information transmitted through third-party communication platforms.
18. PAYMENT INFORMATION
Where online payments are enabled, payment transactions may be processed through third-party payment gateways. The Hospital may receive transaction-related information such as payment status, transaction reference, amount and other information necessary for reconciliation. Complete card credentials should not ordinarily be submitted through general website forms.
19. THIRD-PARTY SERVICE PROVIDERS
Mahavir Hospital may use vendors and service providers for website hosting, IT support, software/HMIS, cloud services, SMS, email, WhatsApp/communications, payment processing, analytics, cybersecurity, data backup, insurance administration, billing, diagnostic services and other legitimate hospital functions. Such providers may process information on behalf of the Hospital to the extent necessary for the relevant service and subject to appropriate contractual, legal and security requirements.
20. DATA SECURITY
Mahavir Hospital shall take reasonable technical, organizational and administrative measures appropriate to the nature of the information being processed. Such measures may include access controls, authentication, role-based access, password controls, backup procedures, security monitoring, staff confidentiality obligations, physical security, secure systems and communications where appropriate, and incident-response procedures. No electronic system or internet transmission can be guaranteed to be completely secure.
21. DATA RETENTION
Personal and medical information shall be retained for as long as reasonably necessary for patient care, medical-record requirements, legal obligations, regulatory requirements, insurance/TPA requirements, accounting, dispute resolution, audit, patient safety or other legitimate purposes. Records shall be securely disposed of or anonymized when retention is no longer required, subject to applicable law and Hospital record-retention requirements.
22. DATA BREACHES AND SECURITY INCIDENTS
Mahavir Hospital shall maintain reasonable processes for identifying, assessing and responding to personal-data security incidents. Where applicable law requires notification to affected individuals, authorities or other entities, such notification shall be undertaken in accordance with the applicable legal requirements.
23. DATA TRANSFERS
Information may be processed using technology, service providers or infrastructure located outside the physical premises of Mahavir Hospital. Where personal data is transferred or processed outside India, the Hospital shall follow restrictions and requirements applicable under Indian law.
24. PATIENT/DATA PRINCIPAL RIGHTS
Subject to applicable law, patients and other individuals whose personal data is processed may have rights relating to their personal data, including access to information regarding processing, correction of inaccurate information, erasure where legally permissible, withdrawal of consent where processing is based upon consent, grievance redressal and other rights provided under applicable law. The exercise of a right may be subject to legal, medical-record, regulatory, contractual or other lawful limitations.
25. WITHDRAWAL OF CONSENT
Where processing is based upon consent, an individual may withdraw consent through an appropriate mechanism, subject to applicable law. Withdrawal of consent shall not automatically invalidate processing already lawfully undertaken before withdrawal. Where information is necessary for medical treatment, legal compliance, billing, patient safety or another lawful purpose, withdrawal may not prevent such processing where permitted by law.
26. MEDICAL RECORD ACCESS
Requests for medical records or copies shall be handled according to applicable law, professional requirements, Hospital procedures and record-retention policies. Requests may require verification of identity and, where applicable, authorization from the patient, legal representative or other person lawfully entitled to make the request.
27. DATA ACCURACY
Patients and website users should provide accurate information and notify the Hospital of material changes where appropriate. The Hospital may rely upon information supplied by the patient or authorized representative unless there is reason to believe it is inaccurate or incomplete.
28. FRAUD AND MISUSE
Personal information may be processed to detect, prevent or investigate fraud, identity misuse, unauthorized access, payment fraud, insurance fraud, cybersecurity incidents, misuse of Hospital services or other unlawful activities.
29. PRIVACY OF WEBSITE USERS
Website visitors who merely browse the website may not be required to provide personally identifiable information. Technical information, cookies and analytics information may nevertheless be collected as described above. Users should not submit unnecessary medical information through public/general contact forms.By using the website and voluntarily submitting personal information, you acknowledge that you have read this Privacy Policy and understand the manner in which Mahavir Hospital may process personal information as described herein, subject to applicable law and the circumstances of the particular interaction.