Privacy Notice

Version 1.0 · Effective 19 October 2026 · Written for the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).

This notice explains what personal data HospitalMitra collects, the purpose of each use, how long we keep it, who we share it with and how you can use your rights. It applies to this website, our enquiry channels (WhatsApp, phone and email) and our NABH consulting and training services.

This notice is also available in Tamil and Hindi in the summary below. On request we will provide it in any language listed in the Eighth Schedule to the Constitution.

1. Who we are

HospitalMitra (hospitalmitra.in) is a NABH and NABH Digital Health consulting practice and a DPOfficer.in group company. For the personal data described here, HospitalMitra is the Data Fiduciary: we decide the purpose and means of processing.

Registered office

No. 189, Moorthy Nagar Main Road, Thirumullaivoyal, Chennai, Tamil Nadu 600062

Branch office

1/161 A 50, Mani Nagar, Paramakudi, Tamil Nadu 623707

Email

hello@hospitalmitra.in

Phone / WhatsApp

+91 89395 53536

2. Personal data we collect and why

We collect only the personal data needed for each purpose below. We do not sell personal data, and we do not use it for advertising or profiling.

We do not collect sensitive information such as financial account passwords, Aadhaar numbers or health records of you as an individual through this website. Please do not send patient information through the enquiry form or WhatsApp.

3. Consent, and how to withdraw it

Where we rely on consent, we ask for it clearly and separately for each purpose, before we process your data. Boxes are never pre-ticked, and you can refuse without losing access to the website.

To withdraw or change your consent at any time, use any of these. Each is as easy as giving consent:

• Click Manage consent in the footer of any page, or the button below, and switch off any purpose.
• Send "WITHDRAW CONSENT" on WhatsApp to +91 89395 53536.
• Email hello@hospitalmitra.in with the subject "Withdraw consent".

Manage consent

What happens when you withdraw. We record the withdrawal with its date and time, stop processing the data for that purpose within 7 days, tell our Data Processors to stop as well, and erase the data unless a law requires us to keep it. Processing done before you withdrew remains lawful. If you withdraw consent for enquiry sharing, we will not be able to reply to new enquiries through WhatsApp, but you can still contact us by phone.

4. Your rights

As a Data Principal under the DPDP Act, you have these rights. To use any of them, write to our Grievance Officer (section 5). We will verify your identity and respond within 90 days, and sooner wherever we can.

• Right to access information (S.11): a summary of the personal data we hold about you, the processing we carry out, and the Data Fiduciaries and Data Processors we have shared it with.
• Right to correction, completion, updating and erasure (S.12): ask us to correct inaccurate data, complete or update it, or erase data that is no longer needed, unless the law requires us to keep it.
• Right to grievance redressal (S.13): raise a complaint with our Grievance Officer about how we handle your data.
• Right to nominate (S.14): nominate another person to exercise your rights if you die or become unable to do so. Send us the nominee's name and contact details.

The Act also asks Data Principals to give accurate information and not to file false or frivolous complaints (S.15).

5. Grievance Officer and Data Protection Officer

6. Complaints to the Data Protection Board of India

If you are not satisfied with our response, or we do not respond within 90 days, you have the right to complain to the Data Protection Board of India under the DPDP Act. Complaints are filed through the Board's digital platform as notified by the Government of India. You are asked to use our grievance process first, as section 13(3) of the Act requires.

7. Sharing and Data Processors

We share personal data only with these parties, only for the purposes above, and under written contracts that require them to protect it:

• Cloudflare, Inc.: website hosting, content delivery and security (technical data).
• WhatsApp (Meta Platforms): carrying enquiry messages you choose to send us.
• Our email service provider: sending and receiving email.
• DPOfficer.in: our group company, when its certified auditors or trainers deliver part of your engagement.
• Professional advisers such as auditors and lawyers, and government authorities when the law requires it.

Data Processors may only process data on our instructions, must keep it secure, and must delete it when the work ends or consent is withdrawn.

8. Transfers outside India

Cloudflare and WhatsApp operate global networks, so technical data and messages may be processed on servers outside India. We transfer personal data outside India only as section 16 of the DPDP Act allows, and never to a country the Government of India has restricted.

9. How long we keep data

We keep each category only for the period shown in the table in section 2. When the purpose is served, or you withdraw consent, we erase the data, unless a law requires us to keep it longer. Before erasing data for inactivity, we will tell you at least 48 hours in advance, as Rule 8 requires, so you can get in touch if you want us to keep it.

10. Security safeguards

We protect personal data with reasonable security safeguards, as section 8(5) of the Act and Rule 6 require:

• Encryption in transit: the whole site is served only over HTTPS with HSTS, so browsers never connect without encryption.
• Encryption at rest: client files are kept in encrypted storage.
• Access control: role-based access, unique accounts and multi-factor authentication for the systems that hold personal data.
• Browser protections: Content Security Policy, frame protection, a strict referrer policy and no third-party trackers.
• Monitoring and logs: access to systems holding personal data is logged and reviewed, and logs are kept for at least one year.
• Backups and continuity: regular backups so data can be restored after an incident.
• People and vendors: confidentiality agreements, privacy training for staff, and data protection clauses in every processor contract.

Our group's lead auditors are certified for ISO/IEC 27001:2022 and ISO/IEC 27701:2025.

11. Personal data breaches

If a personal data breach occurs, we will inform affected Data Principals without delay, in plain language, describing what happened, the likely consequences, what we are doing about it and what you can do to protect yourself. We will also inform the Data Protection Board of India without delay and send it a detailed report within 72 hours of becoming aware of the breach, as Rule 7 requires.

12. Children's data

Our services are meant for hospitals and healthcare professionals, not for children. Under the DPDP Act, anyone under 18 is a child. We do not knowingly collect a child's personal data. If we need to, for example for a student intern in a training programme, we will first obtain verifiable consent from a parent or lawful guardian, as section 9 and Rule 10 require. We do not track children, monitor their behaviour or target advertising at them. If you believe a child has sent us personal data, contact the Grievance Officer and we will erase it.

13. Patient data seen during engagements

During on-site work we may see patient records held by your hospital, for example during record audits. In that work your hospital is the Data Fiduciary and we act only as its Data Processor. We review records on your premises, do not copy identifiable patient data, and follow the data processing terms in our engagement agreement.

14. Cookies and browser storage

This website sets no cookies and uses no analytics or advertising trackers. It stores only your consent record in your browser's local storage, so the site remembers your choice. You can clear it at any time through your browser settings; the consent request will then appear again.

15. Consent records and logs

We keep records of consent given, refused and withdrawn, as section 6(10) of the Act requires. Each record carries a unique consent ID, the date and time, the notice version, the language shown and your purpose-wise choices. When you send an enquiry, your consent is recorded at that moment. You can ask the Grievance Officer for a copy of your consent records at any time.

16. Changes to this notice

If we change this notice, we will update the version and date at the top. If a change affects how we use data you have already given us, we will ask for your consent again before applying it.

17. Summary in Tamil and Hindi