Privacy Policy

Effective Date: 01-01-2026
Last Updated: 01-04-2026

Ashok Super Specialty Hospital (“ASH,” “we,” “us,” or “our”) is committed to protecting the privacy and confidentiality of our patients and website visitors. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.ashokhospital.in, or avail of our medical services.

We comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) , the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, and all applicable healthcare privacy standards.

1. Information We Collect

We may collect personal information in various ways, including:

A. Personal Identification Information

Demographics: Name, age, date of birth, gender, marital status.
Contact Details: Address, email address, phone number, emergency contact details.
Government Identifiers: Aadhaar number, Passport, Voter ID (only where required for admission or cashless insurance processing).

B. Protected Health Information (PHI)

Medical history, past surgeries, allergies.
Current medications, lab reports, radiology images (X-rays, MRIs, CT scans).
Diagnosis, treatment plans, discharge summaries, and billing records.
Genetic data or biometric data (where applicable).

C. Digital & Technical Data

Usage Data: IP address, browser type, device ID, pages visited on our website, and time spent.
Cookies: We use cookies to enhance user experience. You can manage cookie preferences via your browser settings.

D. Financial Data

Insurance details, payment card information, billing history, and payment records.

2. How We Collect Information

We collect information in the following ways:

Directly from you: During registration, consultations, admissions, or via our website/app forms.
Automatically: Through website cookies and server logs.
From Third Parties: Referring doctors, insurance companies, diagnostic labs, or government health schemes (e.g., Ayushman Bharat).

3. Legal Basis for Processing (Under DPDP Act, 2023)

We process your personal data only when we have a lawful basis to do so:

Consent: When you voluntarily provide data for treatment or marketing.
Contractual Necessity: To provide medical treatment, admission, and discharge services.
Legal Obligation: To comply with statutory requirements, court orders, or health authority reporting (e.g., infectious disease notifications).
Vital Interest: In emergency situations where consent cannot be obtained but treatment is necessary to save a life.

4. How We Use Your Information

We use the collected information for:

Healthcare Delivery: Diagnosis, treatment, nursing care, and rehabilitation.
Administration: Appointments, admissions, billing, insurance claims, and discharge processes.
Communication: Sending reminders (SMS/WhatsApp/Email) for appointments, health check-up camps, or reports.
Quality & Safety: Internal audits, clinical research (with anonymized data), and improving patient safety protocols.
Legal Compliance: Responding to regulatory authorities, courts, or law enforcement as required by law.

5. Sharing and Disclosure of Information

We do not sell your personal data. We may share your data in the following circumstances:

Healthcare Providers: With treating doctors, specialists, nurses, and other hospital staff involved in your care.
Third-Party Service Providers: With diagnostic partners, pharmacy vendors, and IT service providers who assist us in operations (under strict confidentiality agreements).
Insurance Companies: To process cashless treatment claims.
Legal Authorities: If required by law, court order, or to prevent fraud or imminent harm.
Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred.

6. Data Retention

We retain your medical records for a minimum of 3 years from the date of last discharge, or longer if required by law (e.g., medico-legal cases, minors’ records, or specific contractual obligations). After the retention period, data is securely anonymized or destroyed.

7. Data Security

We implement robust security measures to protect your data, including:

Physical Security: 24/7 surveillance, restricted access to medical records rooms.
Technical Security: Encrypted storage (AES-256), firewalls, and role-based access control to our Hospital Information System (HIS).
Administrative Security: Non-disclosure agreements with staff, regular training on data privacy.

While we strive to protect your data, no transmission over the internet is 100% secure.

8. Your Rights

Under the DPDP Act, 2023, you have the following rights:

Right to Access: You can request a summary of your personal data and medical records.
Right to Correction: You can request correction of inaccurate or incomplete data.
Right to Withdraw Consent: You may withdraw consent for non-treatment related communications (e.g., marketing) at any time.
Right to Grievance Redressal: You have the right to lodge a complaint regarding the processing of your data.
Right to Nominate: You have the right to appoint a nominee to exercise your rights in the event of death or incapacity.

To exercise these rights, please contact our Grievance Officer (details below).

9. Cookies and Tracking Technologies

Our website uses cookies to improve functionality and analyze traffic. You can set your browser to refuse cookies, but this may limit some features of the website.

10. Third-Party Links

Our website may contain links to external sites (e.g., insurance portals, government schemes). We are not responsible for the privacy practices of those sites.

11. Children’s Privacy

We do not knowingly collect data from minors without parental or guardian consent. If a child is admitted for treatment, all communication and data processing will involve the parent or legal guardian.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. Significant changes will be notified via SMS, email, or a notice on our website.

13. Grievance Officer (Data Protection Officer)

In compliance with the DPDP Act, 2023, any grievances related to the processing of personal data should be addressed to:

Name: [Insert Name of Officer]
Designation: [e.g., Medical Superintendent / IT Head]
Address: Ashok Super Specialty Hospital, [Insert Full Address]
Email: [Insert Email]
Phone: [Insert Phone Number]

Timeframe: We endeavor to resolve all grievances within 30 business days of receipt.

14. Consent

By using our services or providing us with your information, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. For medical treatment, a separate Consent to Treatment Form will be signed at the time of admission.