Privacy Policy
How MediCare Plus Hospital collects, uses, protects, and honours your rights over personal data — in plain language.
Data Fiduciary Statement
Under the Digital Personal Data Protection Act, 2023
MediCare Plus Healthcare Pvt. Ltd. is the Data Fiduciary for the personal data described in this policy, under the DPDP Act, 2023 and the DPDP Rules, 2025.
Every consent you give produces a consent receipt with a reference ID, viewable in the Privacy Center.
1. Information we collect — and why we tell you
Section 5 · Rule 3
We give you a clear notice, in English or any Eighth Schedule language you choose, before or at the time we ask for your data. The notice lists the data we collect, the specific purpose of each use, and how to withdraw consent or raise a complaint.
| Category | Data elements | Collected at |
|---|---|---|
| Identification | Name, date of birth, gender | Registration, appointment booking |
| Contact | Email, mobile number | Registration, appointment booking |
| Health | Medical history, appointment details, diagnostic reports, prescriptions | Consultation, diagnostics |
| Technical | IP address, browser type, device identifiers, cookies | Website use |
Cookies. Strictly necessary cookies (session, security, load balancing) are set without consent because the service cannot run without them. Analytics and communication cookies are set only if you accept them, and you can change that choice at any time from the Privacy Center.
2. How we use your data
Section 4 and Section 6
| Purpose | Basis | Can you decline? |
|---|---|---|
| Providing medical diagnosis, treatment and care | Consent — necessary purpose | Yes, but we cannot provide clinical care without it |
| Managing appointments and scheduling | Consent — necessary purpose | Yes, but we cannot manage your appointments without it |
| Appointment reminders and health communications | Consent — optional | Yes, with no effect on your care |
| Service improvement using de-identified analytics | Consent — optional | Yes, with no effect on your care |
| Meeting legal, clinical and regulatory obligations | Legal obligation (Section 7(b)) | No — required by law, continues after withdrawal |
| Responding to a medical emergency | Legitimate use (Section 7(e)–(f)) | Not applicable — no consent required by law |
Where a purpose is described as a necessary purpose, your consent is still free and voluntary — declining simply means we cannot deliver that specific service.
3. Your rights as a Data Principal
Sections 11–14 · Rule 14
| Right | Section | What you can do |
|---|---|---|
| Right to information / access | 11 | Get a summary of your personal data, the purposes it is processed for, and the identities of processors and other fiduciaries |
| Right to correction, completion, updating and erasure | 12 | Correct inaccurate data, complete incomplete data, update outdated data, or erase consent-based data |
| Right to grievance redressal | 13 | Raise a complaint with our Grievance Officer |
| Right to nominate | 14 | Nominate individuals to exercise your rights if you die or become incapacitated |
| Right to withdraw consent | 6(4)–6(6) | Withdraw any consent at any time, as easily as you gave it |
How to exercise them
Use the Privacy Center or write to privacy@medicareplus-eight.vercel.app. We verify your identity before acting — for the Privacy Center, we send a secure single-use link to your registered email. We never ask for your password, OTP or full patient record over email or phone.
Our response times
| Request type | We respond within |
|---|---|
| Consent withdrawal | 1 hour of confirmed request |
| Erasure of consent-based data | 24 hours, subject to legal retention (see §6) |
| Access, correction, completion, updating | 15 days |
| Nomination | 15 days |
| Grievance | 30 days (statutory ceiling: 90 days) |
4. Consent
Section 6
Your consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.
- Every purpose is presented separately. Nothing is pre-ticked or bundled.
- You may accept some purposes and reject others.
- You may withdraw any consent at any time, through the same Privacy Center you used to give it, with no penalty and no more effort than giving it took.
- Withdrawal does not make past processing unlawful. Processing carried out before withdrawal remains valid (Section 6(4)).
- After withdrawal we stop that processing, and we require our processors to stop as well, within a reasonable time (Section 6(6)).
- Every consent, change and withdrawal is timestamped and versioned. You can download the receipt.
If we change a purpose or materially change a notice, we ask for fresh consent against the new version rather than relying on the old one.
5. Children's and persons with disability data
Section 9 · Rule 10
For a patient under 18, or a person with disability who has a lawful guardian, we obtain verifiable consent from the parent or guardian before processing personal data, and we verify that the adult is an identifiable adult using reliable identity details or a virtual token issued by an authorised entity.
For these patients we do not undertake tracking, behavioural monitoring or targeted advertising, and we do not carry out processing likely to cause a detrimental effect on their well-being. Clinical care of a child, and processing restricted to health services for a child, fall within the exemptions notified under Rule 11 and the Fourth Schedule.
6. Data retention and erasure
Section 8(7) · Rule 8
We keep personal data only as long as the purpose it was collected for is still being served, or as long as a law requires us to keep it.
| Data | Retained for | Because |
|---|---|---|
| Clinical and diagnostic records | 1 years from last consultation | Medical record retention obligations for clinical establishments |
| Consent artefacts, receipts and access logs | 1 year after the consent lifecycle closes | Rule 6(1)(f) log retention and audit evidence |
| Marketing and communication data | Until withdrawal, then deleted | Purpose no longer served |
| Website analytics (de-identified) | 12 months | Purpose no longer served |
When the retention period ends, or when you withdraw consent and no legal ground for retention remains, the data is erased and we instruct our Data Processors to erase their copies. Where a record is under legal hold (litigation, statutory inspection, insurance claim), we retain it until the hold is released and tell you so.
8. How your data is processed, end to end
9. Security
Section 8(5) · Rule 6
10. Contact and grievances
Section 13 · Rule 14
We acknowledge grievances on receipt and respond within 30 days. If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India through the channel notified by the Board.
11. Changes to this policy
We publish the version number and effective date at the top of this page and keep previous versions available on request. Where a change materially affects the purposes for which we process your data, we notify you and seek fresh consent rather than relying on continued use of the site.
Have questions about your data?
Visit the Privacy Center to exercise your rights, download consent receipts, or file a grievance.