Privacy Policy

1. Overview & Applicability

Prayag Hospital & Research Centre Private Limited ("Prayag Hospital", "We", "Us", or "Our"), operating hospitals at Sector 41 Noida and Delta III Greater Noida, is the Data Fiduciary responsible for processing your personal and health data.

This Privacy Policy applies to all patients, visitors, guardians, applicants, healthcare practitioners, and users who access our website (prayaghospital.in), use our online appointment bookings, interact with our diagnostic portals, submit career applications, or utilize digital hospital services.

2. Personal Data We Collect

We only collect personal data that is strictly necessary, adequate, and relevant for providing healthcare, diagnostic, clinical, and administrative services:

• Identity & Contact Data: Patient full name, age, date of birth, gender, address, email address, mobile number, emergency contact details, and government identification (Aadhaar/PAN/Passport where statutory required for admission or insurance).
• Health & Clinical Data: Medical symptoms, past medical history, clinical notes, diagnostic lab test results, imaging reports (X-Ray, CT, MRI, Ultrasound), prescription details, surgical history, and discharge summaries.
• Financial & Insurance Data: TPA insurance policy details, cashless approval numbers, billing records, transaction receipts, and payment mode identifiers (processed via PCI-DSS compliant secure gateways).
• Employment & Career Data: Professional qualifications, CV/Resume, medical council registration number, work history, and reference checks for job applicants.
• Technical & Website Data: IP address, device type, browser specifications, page view analytics, and cookie preferences (subject to your explicit consent).

3. Purpose of Processing

Under Section 4 and Section 7 of the DPDP Act, 2023, your personal data is processed solely for lawful and specified purposes:

• Scheduling and managing in-person doctor consultations, diagnostics, and telehealth appointments.
• Providing clinical care, in-patient admission (IPD), surgical treatments, and intensive care services.
• Facilitating cashless medical insurance claims with Third Party Administrators (TPAs) and Government Panels (CGHS, ECHS, PMJAY, etc.).
• Delivering lab investigation results, radiology reports, and follow-up medical guidance.
• Responding to patient queries, feedback, and medical opinions (including international patient inquiries).
• Fulfilling legal, statutory, and regulatory mandates under the Clinical Establishments Act, National Medical Commission (NMC), and Bio-Medical Waste rules.
• Evaluating candidate suitability for clinical, nursing, and administrative vacancies.

4. Lawful Consent & Notice

Prayag Hospital follows the principle of free, specific, informed, unconditional, and unambiguous consent.

• Notice at Point of Collection: Whenever you submit data through forms on this website, an itemized notice is provided detailing the purpose of data collection.
• Unbundled Checkboxes: We never use pre-ticked checkboxes. You have the right to grant or deny consent freely.
• Right to Withdraw Consent: You have the right to withdraw your consent at any point in time by submitting a request via our Data Rights Portal or emailing dpo@prayaghospital.in. Withdrawal of consent does not affect the legality of processing carried out prior to the withdrawal, nor does it impact statutory record-keeping required by healthcare laws.

5. Your Data Principal Rights (DPDP Act, 2023)

As a Data Principal, you possess statutory rights enforceable under Indian law:

To exercise any of the above rights, please submit an official request through our Data Principal Rights Form.

6. Protection of Minors & Children's Data

Under Section 9 of the DPDP Act 2023, personal data of individuals under the age of 18 years ("Children") receives specialized protections:

• We mandate verifiable parental or lawful guardian consent prior to processing personal data of any child for pediatric consultations, tests, or hospital admission.
• We strictly do not engage in behavioral tracking, profiling, or targeted advertisements directed at children or utilizing children's data.
• We do not undertake any processing of children’s data that is likely to cause detrimental effect on the well-being of a child.

7. Data Processors & Third-Party Disclosures

We do not sell or rent your personal data. Personal data may only be shared with authorized Data Processors bound by strict confidentiality agreements:

• Hospital Information Management System (HIMS) & Lab Partners: For processing diagnostic samples, electronic health records (EHR), and imaging scans.
• Insurance TPAs & Government Panels: For cashless pre-authorization, patient verification, and claims settlement.
• Payment Gateways: For processing secure digital consultation payments and billing transactions.
• Statutory & Law Enforcement Authorities: When mandated by court order, public health reporting mandates (e.g., infectious disease reporting), or legal compliance.

8. Security Measures & Data Retention

Prayag Hospital implements robust administrative, physical, and technical safeguards including:

• End-to-End 256-bit SSL encryption for data in transit and encryption for sensitive records at rest.
• Role-based access controls ensuring clinical files are accessible exclusively to authorized treating doctors and nursing staff.
• Regular vulnerability assessments and automated cyber security auditing.

Data Retention Period: Personal data is retained only as long as necessary to fulfill the specified healthcare purpose or as required under applicable statutory laws (such as National Medical Commission norms and Medical Council of India guidelines mandating in-patient medical record retention for minimum 3 years or longer for Medico-Legal Cases).

9. Designated Data Protection Officer (DPO)

In compliance with Section 8 and Section 12 of the DPDP Act, 2023, Prayag Hospital has designated a Data Protection Officer / Grievance Officer:

10. Grievance Redressal & DPBI Escalation

Internal Redressal: If you have any concerns regarding how your personal data is handled, you may submit a formal complaint to our DPO. We commit to acknowledging all complaints within 48 hours and providing a detailed resolution within 30 days.

Data Protection Board of India (DPBI): If you are not satisfied with the resolution provided by our Data Protection Officer, you have the statutory right under the DPDP Act 2023 to escalate your complaint to the Data Protection Board of India (DPBI) in the manner prescribed by the Central Government.