PRIVACY POLICY
Introduction
"DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED", "Dr Humayun Speciality Hospital", "DHS Hospital", "We", "Us", or "Our" refers to DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED, having its registered/office address at:
Floor No.: Ground Floor Building No./Flat No.: 33/1 Road/Street: Kannadasan Salai City/Town/Village: T Nagar District: Chennai State: Tamil Nadu PIN Code: 600017
We are committed to protecting the privacy, confidentiality, and integrity of your personal data. We recognize that when you choose to interact with us—whether through our website, digital platforms, or by accessing our healthcare services—you place your trust in us.
This Privacy Policy ("Privacy Policy") applies to the collection, storage, processing, disclosure and transfer of personal information (as defined below) that we may collect from you during your interactions with us through our website, mobile applications, appointment booking platforms, call centres, social media/messaging platforms and offline interactions at the hospital, as applicable and in accordance with applicable laws.
This Privacy Policy also explains the legal basis for collecting such data, the purposes for which it is used, with whom it may be shared, and your rights concerning your personal data under applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act), and rules made thereunder, as applicable.
By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.
This policy does not apply to third-party websites or services that may be linked through our platform. We strongly encourage you to review the privacy policies of such third-party websites or services, as we are not responsible for their data practices.
Note: This Privacy Policy does not constitute a legal, contractual, or fiduciary obligation between DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED and any party and does not confer any enforceable rights on any individual, unless otherwise provided under applicable law.
Scope
This Privacy Policy applies to personal and non-personal data that we collect from:
Individuals accessing or using our digital platforms and services.
Patients availing treatment or diagnostic services at the hospital.
Visitors, bystanders, dependents, caregivers, or representatives interacting with our healthcare services.
Job applicants, employees, contractors, trainees, apprentices, service providers and professional advisers engaging with us digitally or physically.
Users submitting enquiries, making appointments or payments, participating in surveys, workshops, counselling or marketing initiatives.
Guardians, caregivers, or authorized representatives providing consent on behalf of minors or individuals who are legally unable to provide consent.
Research participants enrolled in clinical trials, medical studies, or academic research conducted by or in collaboration with the hospital, where applicable.
Telemedicine users accessing remote consultations, virtual appointments, or digital health monitoring services, where such services are offered.
International patients and medical tourism coordinators utilizing our healthcare services, where applicable.
Individuals enrolled in academic, clinical training, internship, residency, or other healthcare education programmes conducted by or in affiliation with the hospital, where applicable.
This Privacy Policy encompasses data collected through digital platforms owned or operated by us, including, where applicable, websites, help desks, social media/messaging platforms, patient portals, appointment booking tools, teleconsultation platforms, and electronic health record (EHR) systems.
This Privacy Policy does not cover:
Third-party websites or services that are linked from or accessible through our platforms.
Information collected through non-affiliated entities that we do not own or control.
Practices of third parties not governed or operated by us, including partner hospitals, laboratories, insurance companies or other service providers, unless data is shared with them under an applicable contractual or legal arrangement.
Definitions
For the purposes of this Privacy Policy:
"DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED", "Dr Humayun Speciality Hospital", "We", "Us", or "Our"
Refers to DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED, including its authorized healthcare professionals, employees, contractors, service providers and authorized representatives acting on its behalf.
"You", "Your", "User" or "Data Principal"
Refers to any individual accessing, browsing, or using our website, digital platforms, appointment booking tools, teleconsultation platforms, social media/messaging platforms, electronic health record systems or healthcare services, including patients, visitors, caregivers, job applicants, employees, or legal representatives.
"Personal Data / Personal Information"
Means any information that relates to an identified or identifiable natural person and is capable of identifying such person either directly or indirectly. This may include name, contact information, identification details, health records, financial details and government-issued documents.
"Sensitive Personal Data"
Refers to personal data requiring enhanced protection under applicable law and may include health information, medical history, biometric information, genetic information, financial information and government-issued identifiers, to the extent applicable under law.
"Non-Personal Data"
Refers to information that does not directly or indirectly identify an individual, such as anonymized usage data, IP address, device type, browser information and similar technical information collected for analytics and website improvement purposes.
"Cookies"
Small text files stored on your device by our website or third-party services to collect information and enhance your browsing experience.
"Guardian"
A person legally authorized to act on behalf of a minor patient or an individual who is legally incapable of providing consent, including a parent or legal representative.
"Data Fiduciary"
Refers to DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED, to the extent it determines the purpose and means of processing personal data, in accordance with applicable law.
"Data Processor"
Refers to any third party that processes personal data on our behalf under contractual agreements and confidentiality obligations, such as IT service providers, payment gateways, software providers, diagnostic laboratories, insurance claim processing service providers and other authorized vendors.
"Digital Personal Data Protection Act (DPDP Act)"
Refers to the Digital Personal Data Protection Act, 2023, and applicable rules and regulations made thereunder.
"Processing"
Means any operation performed on personal data, including collection, recording, organization, storage, updating, use, sharing, restriction, erasure or destruction.
"Third Party"
Means any entity other than DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED involved in the processing of personal data, including service providers, business partners, affiliates or regulatory authorities.
"Consent"
Means the voluntary, specific, informed and unambiguous indication by which you signify agreement to the processing of your personal data for one or more specified purposes, wherever consent is the applicable lawful basis.
Information We Collect
We collect personal and non-personal information through our website and other applicable data collection channels for purposes including healthcare delivery, service management, patient communication, improvement of healthcare services and outreach.
Data may be collected directly from users or indirectly through interactions with authorized third-party services.
The types of information we may collect include, but are not limited to:
Personal Information
Full name, date of birth, gender and contact details such as phone number, email address and postal address.
Health information including medical history, current medical conditions, treatment details and diagnostic reports.
Patient registration and admission information.
Guardian, caregiver, bystander or authorized representative details, where applicable.
Financial and payment information relating to healthcare services.
Responses, reviews and feedback provided during or after hospital visits.
Information obtained through referrals and physician networks.
Consent records for the collection and processing of personal data.
Information provided for employment, recruitment, training or other professional purposes, where applicable.
Digital and Non-Personal Information
IP address, browser type and device information.
Usage data, including pages visited, time spent and interaction patterns on our digital platforms.
Cookies and tracking technology data from website visits, social media engagement and online campaigns.
Other technical information generated through the use of our digital services.
Sources of Collection
Personal data may be collected through:
Patient registration and admission forms.
Feedback and survey forms.
Appointment booking platforms.
Enquiries submitted through our website.
Social media and messaging platforms.
Health programmes, workshops and community initiatives.
Referrals and physician networks.
CRM systems and chatbots, where applicable.
CCTV surveillance systems.
Telephone calls and call-centre recordings, where applicable.
Medical devices and diagnostic equipment that generate patient-related data.
Telemedicine, remote healthcare, homecare or ambulance services, where applicable.
Photographs and video recordings taken during hospital events, patient interactions, promotional activities or other activities, subject to applicable consent requirements.
[UPDATE REQUIRED – Confirm which of the above systems/services are actually used by Dr Humayun Speciality Hospital and remove those that are not applicable.]
Personal Information of Beneficiaries, Dependents and Other Individuals
If you provide personal information of beneficiaries, dependents or other individuals to us, you agree to:
Inform the individual about the contents of this Privacy Policy and any other applicable privacy notice.
Obtain any legally required consent for providing their personal information to us.
Obtain or provide necessary consent from the legal guardian of children or individuals who are legally unable to provide consent, where applicable.
Children's Personal Data
We handle the personal data of individuals under 18 years of age with appropriate care and in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023, where applicable.
Personal data of minors is collected and processed only with the required consent from a parent or legal guardian.
Such data is used for healthcare and related legitimate purposes.
Access to such data is restricted to authorized personnel.
Parents or guardians may exercise applicable rights concerning their child's personal data, subject to legal and medical record-keeping requirements.
We apply appropriate safeguards when processing personal data relating to children.
Purpose for Which We Collect Your Data
The personal data collected may be used for purposes including, but not limited to:
Delivering healthcare services, including diagnosis, treatment, follow-ups and management of patient health records.
Managing appointments, admissions, billing and payments.
Communicating with patients, guardians, caregivers and healthcare professionals regarding appointments, test results, treatment plans, health alerts and other healthcare-related matters.
Conducting patient satisfaction surveys and collecting feedback to improve service quality.
Conducting health awareness programmes, community initiatives, workshops and campaigns.
Processing personal data for clinical research, medical studies or publication of testimonials, subject to applicable consent and legal requirements.
Maintaining physical security through CCTV surveillance.
Sending promotional materials, newsletters and information about hospital services or events, where permitted and subject to applicable consent requirements.
Improving our website and digital platforms through analysis of usage data.
Investigating and preventing fraud, unauthorized access or unlawful activities.
Complying with legal, regulatory and governmental requirements.
Using anonymized or de-identified data for research, medical audits, quality improvement, epidemiological analysis and related purposes.
Facilitating telemedicine and remote healthcare services, where offered.
Emergency response and critical care, including contacting emergency contacts, family members or legal representatives where necessary.
Insurance coordination and claims processing, where applicable.
Using technology, including artificial intelligence or machine-learning tools, where applicable, to support healthcare operations or clinical decision-making, subject to applicable law and appropriate safeguards.
Voice analytics or call-quality monitoring, where applicable.
Voice-to-text transcription of clinical consultations, where applicable and subject to applicable requirements.
Videography and multimedia documentation for medical training, education, documentation or promotional purposes, subject to applicable consent.
Biometric identification or authentication, where applicable and permitted by law.
Managing recruitment, employment, payroll, benefits, attendance, workplace safety, system access and other employment-related activities.
Verifying candidate qualifications and eligibility during recruitment.
Managing vendors and service providers necessary for hospital operations.
[UPDATE REQUIRED – Confirm whether AI/ML, AI Scribe, voice analytics, telemedicine, biometric systems, homecare, ambulance services and other technology-specific activities are currently used by the hospital. Remove any services that are not applicable.]
Lawful Reasons for Processing Your Personal Data
We process personal data on lawful grounds applicable under the DPDP Act, 2023 and other relevant laws, which may include:
Consent
Where applicable, we process personal data based on your freely given, specific, informed and unambiguous consent.
Legal Compliance
Processing may be undertaken where necessary to comply with applicable laws, regulations, court orders or governmental requirements.
Healthcare and Service Provision
Processing may be necessary to provide healthcare and related services, including treatment, billing, appointment management, insurance coordination and patient care.
Legitimate or Other Lawful Purposes
Where permitted under applicable law, personal data may be processed for legitimate operational, administrative, safety, security, research or healthcare-related purposes, subject to applicable safeguards.
Sharing of Information
We respect your privacy and are committed to protecting your personal data.
We do not sell or rent your personal information except where permitted by law and subject to applicable consent or legal requirements.
Your personal data may be shared only for lawful purposes and with appropriate safeguards.
1. With Your Consent
We may share your personal data where you have provided the required consent, particularly where consent is required for sensitive personal data or the personal data of minors.
2. With Healthcare Providers
To provide appropriate healthcare, we may share relevant information with doctors, specialists, laboratories, nurses, allied healthcare professionals and other healthcare providers directly involved in your treatment.
3. With Service Providers and Third-Party Vendors
We may engage trusted third parties to support our healthcare and operational activities. Such parties may include:
Medical professionals and diagnostic laboratories.
Payment gateway providers and banking partners.
IT service providers and software providers.
Cloud and technology service providers.
Patient communication and appointment platforms.
Insurance companies and Third-Party Administrators (TPAs).
Other service providers necessary for hospital operations.
All such service providers are expected to maintain appropriate confidentiality and data security obligations.
4. With Regulatory or Legal Authorities
We may disclose personal data where required or permitted by law to:
Government and health authorities.
Law enforcement agencies.
Courts and judicial authorities.
Insurance and healthcare regulators.
Public health authorities.
Accreditation and quality-certification organizations, where applicable.
5. With Auditors, Legal Advisors and Compliance Professionals
Personal information may be shared with authorized auditors, legal advisors, claims handlers, compliance professionals and consultants where required for legitimate operational, legal or regulatory purposes.
6. With Investigators or Risk Consultants
In cases involving suspected fraud, legal disputes, security incidents or regulatory investigations, relevant data may be shared for investigation and compliance purposes.
7. To Safeguard Vital Interests
In medical emergencies or life-threatening situations, relevant personal information may be shared with:
Ambulance or emergency services.
Referred hospitals or healthcare providers.
Family members or legal representatives.
Such disclosure will be limited to what is reasonably necessary to protect health, safety or life.
8. Marketing and Outreach
Where required by applicable law, we may use personal data for marketing, awareness campaigns, preventive healthcare programmes and community initiatives only after obtaining the required consent.
You may opt out of promotional communications through the available communication channels.
9. Business Transfers
In the event of a merger, acquisition, restructuring, sale or other corporate transaction, personal data may be transferred to the relevant successor or authorized entity, subject to applicable legal and data protection requirements.
10. Employee and Candidate Data
Employee and candidate data may be shared with authorized service providers, recruitment partners, verification agencies, payroll providers, statutory authorities, insurers, auditors and regulators where necessary for employment, recruitment, legal, contractual or operational purposes.
Data Storage, Processing, Retention and Disposal
We are committed to protecting personal data in accordance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023, as applicable.
Personal data will be stored and processed through our internal systems and/or authorized third-party service providers, subject to applicable legal, contractual and security requirements.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or as required under applicable laws and regulations.
Retention may be based on:
Healthcare and treatment requirements.
Medical record retention requirements.
Billing and payment requirements.
Insurance claims and settlement.
Legal and regulatory obligations.
Audit and dispute-resolution requirements.
Internal data-retention policies.
When personal data is no longer required, it may be securely deleted, destroyed or anonymized in accordance with applicable law and our data-retention policies.
Security Controls
We take appropriate technical, administrative and physical measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction.
These measures may include:
Secure data transmission using appropriate encryption technologies.
Access controls and authentication mechanisms.
Role-based access to personal data.
Secure servers and network protections.
Employee awareness and privacy training.
Physical security controls at hospital premises.
CCTV and access monitoring, where applicable.
Periodic security reviews and audits.
While we take reasonable measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.
Use of Cookies
We may use cookies and similar technologies on our website to improve user experience, understand website usage, support website functionality and, where applicable, assist with analytics and marketing.
You may choose to accept, reject or delete cookies through your browser settings. If you reject cookies, certain features of the website may not function properly.
Third-party services used on our website may also place cookies or similar technologies on your device. We encourage you to review the privacy policies of the relevant third parties.
Data Principal Rights
Subject to applicable law, you may have rights concerning your personal data, including:
Right to confirmation and access.
Right to correction of inaccurate or incomplete information.
Right to withdraw consent where processing is based on consent.
Right to request erasure/deletion where applicable.
Right to raise a grievance or complaint concerning processing of personal data.
Right to approach the Data Protection Board or other competent authority where provided under applicable law.
The exercise of these rights may be subject to applicable legal, medical record-keeping and regulatory requirements.
If you choose not to provide required personal data or withdraw consent where applicable, our ability to provide certain healthcare services, maintain medical records, process billing or insurance claims, or comply with legal requirements may be affected.
How to Raise a Data Principal Request
If you wish to request access to, correction of, or deletion of your personal data, you may submit a written request through the contact details provided below.
1. Submit Your Request
Send your request by email or post to:
Please include your name, contact information and details of the request.
2. Verify Your Identity
For security purposes, we may request appropriate identity verification before processing your request.
3. Request Acknowledgement
We will acknowledge receipt of the request and inform you about the next steps, subject to applicable requirements.
4. Processing
We will review and process your request within the timeframes prescribed by applicable law.
5. Response
We will communicate the outcome or any action taken in response to your request through appropriate communication channels.
Where to Send Your Data Principal Request
Postal Address:
DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED Floor No: Ground Floor Building No./Flat No.: 33/1 Kannadasan Salai T Nagar Chennai Tamil Nadu – 600017
Changes to the Privacy Policy
DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED reserves the right to modify or update this Privacy Policy from time to time.
Where significant changes are made, appropriate notice may be provided through our website or other suitable communication channels.
We encourage you to review this Privacy Policy periodically to remain informed about how we collect, use and protect your personal data.
Communication
We may communicate with you using the contact information you provide, including phone numbers, email addresses, SMS, WhatsApp or other messaging platforms, where applicable.
Communications may include:
Appointment confirmations and reminders.
Test results and treatment-related updates.
Billing and payment information.
Insurance-related communications.
Health programmes, workshops and surveys.
Hospital service information.
Emergency or important hospital updates.
Promotional communications, where permitted and where applicable consent has been obtained.
You may opt out of marketing or promotional communications at any time through the available communication channels or unsubscribe options.
[UPDATE REQUIRED – Confirm official hospital communication channels, WhatsApp numbers, SMS provider and marketing communication process.]
Contact Us
If you require clarification regarding this Privacy Policy or wish to raise a query regarding your data protection rights, please contact:
Data Protection Officer / Privacy Officer
Grievance Office Information
Address:
DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED Floor No: Ground Floor Building No./Flat No.: 33/1 Kannadasan Salai T Nagar Chennai Tamil Nadu – 600017
Hospital Address
DR HUMAYUN SPECIALITY HOSPITAL PRIVATE LIMITED
Floor No: Ground Floor Building No./Flat No.: 33/1 Kannadasan Salai T Nagar Chennai Tamil Nadu – 600017