Privacy Policy

Hospital Bed - Compliant with the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

This Privacy Policy explains how [Platform Legal Name] ("Company", "we") collects, uses, discloses, and protects personal data of Users of the Platform, in its capacity as Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").

1. PERSONAL DATA WE COLLECT

• Identity and contact data: name, phone number, email, address;
• Health-related data voluntarily submitted by you: medical condition description, uploaded reports, prescriptions, diagnostic history (submitted solely for the purpose of obtaining a quote, booking, or second opinion);
• Booking and transaction data: services booked, Service Provider selected, payment status (payment card/account details are processed directly by our payment aggregator and are not stored by the Company);
• Technical data: device identifiers, IP address, log data, cookies.

2. PURPOSE AND LAWFUL BASIS OF PROCESSING

2.1  We process personal data only for the specified purpose for which you have given consent, namely: enabling comparison and booking of healthcare-related services, facilitating communication with your chosen Service Provider, processing payments, and complying with legal obligations.

2.2  Consent Notice: Prior to or at the time of collecting personal data, we will provide an itemised notice, in clear and plain language, of the personal data being collected and the purpose of processing, as required under Section 5 of the DPDP Act, and will seek your free, specific, informed, unconditional and unambiguous consent.

2.3  You may withdraw consent at any time with effect on future processing, without affecting the lawfulness of processing carried out prior to withdrawal, by writing to the Grievance Officer/Data Protection contact below.

3. DISCLOSURE TO THIRD PARTIES

3.1  We disclose your health-related data only to the specific Service Provider(s) you choose to engage with, strictly for the purpose of enabling the service requested, and to our payment aggregator solely for payment processing.

3.2  We do not sell personal data to any third party. Any data processor engaged by us (cloud hosting, analytics, customer support tooling) operates under a written Data Processing Agreement obligating it to process data only on our instructions and to implement reasonable security safeguards.

4. DATA RETENTION

4.1  Personal data is retained only for as long as necessary for the purpose for which it was collected, or as required by applicable law (including limitation periods under the Indian Limitation Act, 1963 relevant to potential claims), after which it will be erased or anonymised, in accordance with Section 8(7) of the DPDP Act.

5. YOUR RIGHTS AS A DATA PRINCIPAL

• Right to access a summary of personal data processed and the processing activities undertaken;
• Right to correction and updating of inaccurate or incomplete personal data;
• Right to erasure of personal data that is no longer necessary for the purpose for which it was collected;
• Right to grievance redressal;
• Right to nominate another individual to exercise these rights in the event of death or incapacity.

Requests may be sent to the Data Protection contact below and will be addressed within the timelines prescribed under the DPDP Rules.

6. DATA SECURITY

6.1  We implement reasonable security safeguards, including encryption in transit and at rest, access controls, and periodic security review, to prevent personal data breach, and maintain logs to enable detection and investigation of any breach as required under the DPDP Rules.

6.2  In the event of a personal data breach, we shall notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Rules.

7. CROSS-BORDER TRANSFER

7.1  Personal data may be stored or processed on servers located outside India through our cloud infrastructure provider, subject to any restrictions on transfer to specific countries as may be notified by the Central Government under the DPDP Act from time to time.

8. CHILDREN'S DATA

8.1  Where a booking is made on behalf of a minor, verifiable consent of the parent or lawful guardian will be obtained, and the Platform will not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in accordance with Section 9 of the DPDP Act.

9. GRIEVANCE / DATA PROTECTION CONTACT

Data Protection/Grievance Officer: [Name] | Email: [dpo@platform.com] | Address: [Registered Address]

If you are not satisfied with our response, you may approach the Data Protection Board of India.

10. CHANGES TO THIS POLICY

10.1  We may update this Policy from time to time. Material changes will be notified through the Platform or by email.