1. Data Fiduciary Identity & Contact

The entity responsible for processing your personal and health data (Data Fiduciary) is:

2. Categories of Personal & Sensitive Data Collected

We only collect information necessary to deliver clinical care, dialysis treatment, emergency ambulance dispatch, and administrative support:

• Patient Demographic Data: Full name, age, date of birth, gender, residential address, primary phone number.
• Emergency Contact / Next of Kin: Attender name, relationship, and contact telephone number.
• Sensitive Personal Data (Clinical & Health Data): Blood group, clinical diagnosis, hemodialysis parameters, treatment history, doctor consultation notes, prescription orders, and informed consent records.
• Public Website Inquiries: Name, email address, phone number, and query description submitted through our website contact form.

3. Legal Purpose for Processing

Your data is processed strictly for the following lawful purposes:

1. To provide medical diagnosis, routine hemodialysis treatments, and clinical consultations by certified medical practitioners.
2. To record informed consent for high-risk medical procedures (Dialysis Ongoing Consent).
3. To coordinate 24/7 emergency ambulance dispatch and patient transit.
4. To maintain statutory medical records under the Clinical Establishments (Registration and Regulation) Act.
5. To respond to patient inquiries and community care requests submitted through our website.

4. Medical Records Retention Policy

In accordance with Indian medical council standards and state healthcare regulations:

• Clinical Consultation & Dialysis Records: Retained for a mandatory period of at least 3 to 5 years from the date of the last treatment session.
• Informed Consent Forms: Retained permanently as part of the patient's primary medical file.
• Website Contact Inquiries: Retained for up to 12 months after resolution of the query.

5. Your Statutory Rights under DPDP Act, 2023

As a Data Principal (patient or user), you have the following legally recognized rights:

6. Technical & Operational Data Security

We implement robust technical and organizational security controls to protect Sensitive Personal Data:

• Role-Based Access Controls (RBAC): Strict separation of roles; medical files are accessible solely to licensed doctors, registered nurses, and authorized clinic staff.
• Full Audit Logging: Every creation, modification, archive, and export of patient data is automatically recorded in an immutable audit log.
• Encrypted Communications: Enforced TLS / HTTPS encryption across all web interfaces.
• Medicolegal Validation: Doctor consultations are linked to certified Doctor Medical Council Registration Numbers (MCI / NMC).

7. Contact the Grievance Redressal Officer

For any inquiries, requests for data export, or privacy grievances: