1 Scope & Commitment

Sri Hasanamba Multispeciality Hospital & Gastroenterology Center Pvt. Ltd. ("the Hospital", "we", "us", or "our"), situated in Hassan, Karnataka, is committed to safeguarding the confidentiality, privacy, and integrity of all medical, personal, and diagnostic information entrusted to us by our patients, their legal guardians, and visitors.

This Privacy Policy outlines the standards and procedures governing the collection, storage, utilization, transfer, and protection of personal data and electronic health records (EHR) in compliance with the Digital Personal Data Protection Act (DPDP Act, 2023), the Information Technology Act, 2000, and ethical directives issued by the National Medical Commission (NMC).

2 Types of Information We Collect

To deliver safe, effective clinical diagnosis and treatment, we collect necessary categories of demographic and sensitive personal health data, including:

• Patient Demographic Data: Full legal name, date of birth, age, biological gender, residential address, personal mobile number, alternate contact details, and emergency contact nominee.
• Clinical & Health History: Outpatient consultation records, presenting medical complaints, past medical/surgical history, documented drug allergies, current medications, vital sign recordings, and immunisation charts.
• Diagnostic & Imaging Records: Video endoscopy footage, colonoscopy imaging, ultrasound scans, digital X-rays, ECG recordings, blood/biochemistry laboratory reports, and histopathological biopsy analyses.
• Government Scheme & Insurance Data: Ayushman Bharat Health Account (ABHA) ID, PMJAY card numbers, Arogya Karnataka beneficiary records, Yeshasvini Scheme card, ESI insurance numbers, and private Mediclaim TPA policy numbers.
• Billing & Payment Data: Transaction references, UPI transaction IDs, card payment receipts, invoice statements, and bank account numbers for cashless claim reimbursements.

3 How We Collect Health Data

Personal and health information is obtained strictly through transparent, authorized clinical and administrative touchpoints:

• In-Person Hospital Registration: When registering at our Outpatient Department (OPD) desk, emergency casualty reception, or during planned inpatient admission.
• Direct Clinical Consultations: Provided voluntarily during clinical interviews with treating consultants, surgeons, anaesthetists, and duty nursing staff.
• Diagnostic Examinations: Generated during laboratory blood draws, gastrointestinal endoscopic procedures, and radiological imaging examinations.
• Digital Web Interactions: When submitting forms on our website for online doctor appointment scheduling, patient inquiries, or helpline interactions.

4 Purpose of Data Processing

All data processed by Sri Hasanamba Hospital is utilized exclusively for genuine healthcare operations and statutory legal requirements:

• Providing accurate diagnosis, medical intervention, surgical procedures, and post-operative recovery monitoring.
• Generating computerized prescriptions, discharge summaries, medical certificates, and diagnostic investigation reports.
• Verifying eligibility and facilitating cashless pre-authorisation and claim settlements with government schemes (Ayushman Bharat, Yeshasvini) and private insurance TPAs.
• Complying with mandatory public health notifications (such as reportable communicable illnesses, births, deaths, and medico-legal trauma logs).
• Internal clinical audits, hospital infection control analysis, and healthcare quality assurance.

5 Confidentiality & Information Sharing

Access to sensitive medical data is restricted strictly on a "need-to-know" basis. Information is shared only under the following defined circumstances:

• Multidisciplinary Care Team: Consulting doctors, visiting super-specialists, intensivists, nursing officers, and pharmacists directly participating in the patient's care.
• Government Healthcare Bodies & TPAs: Authorized scheme administrators and Third-Party Administrators (TPAs) strictly for verifying and adjudicating cashless medical claims.
• Accredited Reference Laboratories: Specialized external pathology or genetic reference laboratories when specialized second-opinion testing is required.
• Statutory & Legal Compliance: Law enforcement agencies or judicial courts only upon formal written summons or mandatory medico-legal reporting protocols.

6 Electronic Health Records (EHR) & Physical Security

We employ multi-layered technical, physical, and administrative safeguards to protect your personal and medical information against unauthorized access, loss, alteration, or disclosure:

• Digital Cryptographic Protection: Industry-grade 256-bit SSL/TLS encryption for all digital health communication and web portal traffic.
• Role-Based Access Controls: Hospital management system software requires two-factor authentication, ensuring staff can only view records pertinent to their clinical duty.
• Secure Physical Medical Record Department (MRD): Physical patient charts and case sheets are archived in secure, climate-regulated, fire-protected storage with 24/7 CCTV surveillance and access logging.
• Automated Disaster Backups: Daily encrypted offsite backups ensuring patient medical records remain safe against hardware malfunction or natural disruptions.

7 Retention of Medical Records

In strict alignment with the National Medical Commission (NMC) regulations and the Clinical Establishments Act, inpatient case sheets and clinical records are securely retained for a minimum of 3 years from the date of discharge. Medico-legal case (MLC) records, paediatric documents, and major surgical archives are preserved for 10 years or until the conclusion of all legal proceedings as mandated by Indian law.

8 Your Patient Rights

Under applicable Indian data protection principles and medical ethics, every patient has enforceable rights regarding their personal information:

• Right to Access: You are entitled to receive authenticated physical or digital copies of your discharge summary, operative notes, and diagnostic test reports upon application to the MRD.
• Right to Correction: You may request the rectification of any inaccurate personal demographics, contact telephone numbers, or insurance policy details.
• Right to Nominate: You have the right to nominate an immediate family member or trusted individual to make medical decisions and access records on your behalf if incapacitated.
• Right to Grievance Redressal: You may register concerns regarding data privacy or record handling directly with our designated Grievance Officer.

9 Cookies & Website Use

Our website (hasanambahospital.com) utilizes essential session cookies solely to preserve user navigation states, ensure form security, and measure aggregate visitor traffic to improve loading speeds. We do not place third-party behavioural tracking cookies that follow users across external websites. You can modify your browser settings to decline cookies at any time without impacting fundamental appointment booking capabilities.

10 Data Protection & Grievance Officer

If you have inquiries regarding our data handling policies, wish to exercise your patient rights, or wish to report a privacy concern, please contact our designated Grievance Officer: