1. Introduction

East Coast Hospitals (“Hospital”, “ECH”, “we”, “our”, or “us”) is committed to protecting the privacy and confidentiality of every patient, visitor, caregiver, employee, consultant, business partner, and user of our digital services.

Healthcare requires a high degree of trust. We understand that your medical records and personal information deserve the highest standards of protection. Accordingly, East Coast Hospitals adopts administrative, technical, organisational, and physical safeguards designed to protect your personal information against unauthorised access, disclosure, alteration, misuse, loss, or destruction.

This Privacy Policy applies to information collected through:

• East Coast Hospitals Website, Mobile Applications, and Patient Portal
• Online Appointment Booking, Telemedicine Services, Diagnostic Services, Laboratory Services, and Pharmacy Services
• Emergency Registration, Inpatient Admissions, and Outpatient Consultations
• Corporate Health Programs, Health Check Packages, and Customer Support
• WhatsApp Communication (where consent has been provided), Email Communication, and SMS Services
• Social Media Pages administered by East Coast Hospitals

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Our Privacy Principles

East Coast Hospitals is committed to the following privacy principles:

Patient First

Your health information will always be handled with respect, dignity, and confidentiality.

Transparency

We explain clearly what information we collect, why we collect it, and how we use it.

Security

We implement appropriate security measures designed to protect your information.

Limited Collection

We collect only the information reasonably necessary to provide healthcare services, operate our facilities, comply with legal obligations, and improve patient care.

Accountability

Every employee, consultant, doctor, nurse, and authorised representative is expected to handle personal information responsibly and in accordance with applicable policies.

3. Legal Basis

This Privacy Policy has been prepared in accordance with applicable Indian laws, including, where relevant:

• Digital Personal Data Protection Act, 2023
• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Telemedicine Practice Guidelines issued by the Government of India
• Clinical Establishments and other applicable healthcare regulations
• Any other applicable statutory or regulatory requirements

Nothing contained in this Privacy Policy shall limit any rights available under applicable law.

4. Definitions

For the purposes of this Privacy Policy:

• “Hospital” means East Coast Hospitals and all its departments, centres, clinics, branches, employees, consultants, doctors, healthcare professionals, contractors, authorised representatives, and affiliates.
• “Patient” means any individual seeking or receiving medical consultation, diagnosis, treatment, preventive healthcare, emergency care, laboratory services, pharmacy services, surgery, rehabilitation, or any other healthcare service.
• “Personal Information” means any information capable of identifying an individual directly or indirectly.
• “Sensitive Personal Information” includes medical records, health information, diagnostic reports, prescriptions, biometric information where applicable, and other information recognised under applicable law.
• “Processing” includes collection, recording, storage, organisation, retrieval, consultation, use, disclosure, transfer, sharing, analysis, deletion, destruction, or any other operation performed on personal information.

5. Information We Collect

Depending upon the services you use, East Coast Hospitals may collect the following categories of information.

5.1 Personal Information

This may include full name, date of birth, age, gender, photograph (where applicable), mobile number, alternate contact number, email address, residential address, nationality, passport number (where applicable), visa details (for international patients where required), Aadhaar number or other government-issued identification where legally required, marital status, occupation, employer details (where relevant), and emergency contact details.

5.2 Medical Information

To provide healthcare services, we may collect medical history, family medical history, present illness, previous diagnoses, current symptoms, allergies, current and previous medications, surgical history, immunisation records, laboratory reports, radiology reports, ECG reports, MRI/CT scan reports, pathology reports, consultation notes, nursing notes, treatment plans, prescriptions, discharge summaries, follow-up notes, and clinical images where medically necessary.

5.3 Appointment Information

We collect information relating to doctor selected, department, appointment date and time, consultation type, appointment status, follow-up appointments, and visit history.

5.4 Payment Information

Where you make payments through our website or authorised payment systems, we may collect billing name, transaction ID, payment reference number, payment amount, date and time of payment, and payment status.

East Coast Hospitals does not store complete debit card numbers, credit card numbers, CVV details, UPI PINs, internet banking passwords, or similar financial credentials. Payment processing is carried out through authorised third-party payment gateway providers.

East Coast Hospitals shall not be responsible for delays, interruptions, transaction failures, or other issues attributable to banks, payment gateway providers, payment networks, or other third-party financial institutions.

5.5 Technical Information

When you visit our website or mobile applications, we may automatically collect IP address, device type, operating system, browser type and version, device identifier, language preference, website usage statistics, session duration, referral source, cookies, analytics information, error logs, crash reports, and security logs.

6. How We Collect Information

Information may be collected directly from you through hospital registration, online appointment booking, walk-in registration, emergency registration, admission forms, telemedicine consultations, laboratory requests, pharmacy purchases, health check registrations, insurance documentation, customer support, contact forms, feedback forms, surveys, email communication, telephone calls, WhatsApp communication (where consent has been provided), mobile applications, and website forms.

We may also receive information from referring doctors, insurance companies, corporate clients, family members or caregivers (where authorised), and government authorities where legally required.

7. Information Relating to Children

East Coast Hospitals provides healthcare services to patients of all age groups, including children. Where personal information relates to a minor, consent shall be obtained from the child’s parent or lawful guardian in accordance with applicable law. Parents or legal guardians may exercise applicable privacy rights on behalf of minors, subject to legal and medical record requirements.

8. International Patients

East Coast Hospitals welcomes patients from outside India. International patients acknowledge and agree that their personal information and medical records may be collected, processed, stored, and used within India in accordance with applicable Indian laws and this Privacy Policy. Where legally required, East Coast Hospitals shall implement appropriate safeguards for the protection of personal information relating to international patients.

9. Purposes for Which We Use Your Information

We process personal information only for lawful and legitimate purposes, including:

Healthcare Delivery

• Patient registration, identity verification, appointment scheduling, medical consultations, diagnosis, and treatment planning
• Laboratory investigations, radiology services, pharmacy services, surgical procedures, emergency care, follow-up consultations, and rehabilitation services

Hospital Operations

We may use information to maintain medical records, coordinate patient care, manage admissions and discharges, process insurance claims, generate invoices, collect payments, prevent fraud, improve healthcare quality, conduct internal audits, comply with accreditation standards, and ensure patient safety.

Communication

We may contact you regarding appointment confirmations and reminders, diagnostic reports, prescription availability, admission information, billing information, follow-up consultations, emergency notifications, and health campaigns where consent has been provided.

Appointment reminders and certain service communications may also be sent through WhatsApp where you have provided your consent. Patients may opt out of promotional communications at any time without affecting healthcare-related communications necessary for treatment, patient safety, billing, or legal compliance.

10. Legal Basis for Processing Personal Information

East Coast Hospitals processes personal information only where there is a lawful basis to do so. Depending on the circumstances, processing may be carried out on one or more of the following grounds:

• Your consent
• Performance of healthcare services requested by you
• Compliance with legal and regulatory obligations
• Protection of your vital interests or the interests of another individual
• Public health obligations
• Establishment, exercise, or defence of legal claims
• Legitimate operational interests of East Coast Hospitals, provided such interests do not override your rights under applicable law

Where consent is the basis for processing, you may withdraw your consent at any time, subject to applicable legal obligations, medical record retention requirements, and the Hospital’s ability to continue providing healthcare services.

11. Disclosure of Personal Information

East Coast Hospitals values patient confidentiality and does not sell, rent, or trade your personal information to third parties for commercial marketing purposes. Your personal information may be shared only where necessary and appropriate with:

Healthcare Professionals

Treating doctors, specialists, nurses, pharmacists, physiotherapists, dieticians, clinical psychologists, laboratory personnel, radiologists, and emergency care teams.

Hospital Departments

Billing department, medical records department, insurance desk, patient relations, customer care, quality department, and administration.

Third-Party Service Providers

Payment gateway providers, SMS and email service providers, cloud infrastructure providers, IT vendors, appointment management platforms, telemedicine technology providers, diagnostic partners, and courier services for medical records where authorised. All such providers are expected to maintain appropriate confidentiality and security standards.

Insurance Providers

Where you request cashless treatment or reimbursement, we may disclose relevant medical and billing information to your insurer, Third Party Administrator (TPA), employer-sponsored health program, or authorised representative.

Legal and Regulatory Authorities

We may disclose information where required by law, court order, government authority, during regulatory inspections, for public health reporting, for law enforcement investigations, or to protect life or public safety.

12. Data Security

East Coast Hospitals employs reasonable administrative, technical, organisational, and physical safeguards designed to protect your information. Security measures may include secure server environments, encrypted communication where appropriate, role-based access controls, password-protected systems, multi-factor authentication for authorised personnel where implemented, firewall protection, network monitoring, anti-malware protection, intrusion detection systems, audit logs, CCTV monitoring of sensitive operational areas, employee confidentiality agreements, regular security assessments, and controlled access to medical records.

While we strive to protect your information using commercially reasonable safeguards, no system connected to the internet can be guaranteed to be completely secure. Accordingly, East Coast Hospitals cannot guarantee absolute security of information transmitted electronically.

13. CCTV Surveillance

For the safety of patients, visitors, staff, and Hospital property, CCTV surveillance may be in operation within hospital premises. CCTV recordings may be used for patient safety, security monitoring, prevention of unlawful activities, incident investigations, quality improvement, regulatory compliance, and legal proceedings where required. CCTV footage shall be retained only for as long as reasonably necessary or as required under applicable law.

14. Data Retention

East Coast Hospitals retains personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy. Medical records shall be retained in accordance with applicable statutory requirements, professional medical guidelines, accreditation standards, legal obligations, and clinical requirements. Following expiry of applicable retention periods, records may be securely archived, anonymised, or destroyed in accordance with Hospital policies and applicable law.

15. Medical Research, Quality Improvement, and Education

East Coast Hospitals is committed to advancing healthcare through research, education, and continuous quality improvement. The Hospital may use anonymised or aggregated information for clinical research, medical education, healthcare analytics, quality improvement initiatives, public health reporting, statistical analysis, and service planning. Such information shall not identify individual patients. Where identifiable information is required for research, appropriate approvals and legal requirements shall be followed.

16. Laboratory and Diagnostic Information

Laboratory reports, imaging studies, and diagnostic investigations form only one part of the overall clinical assessment. Patients are advised not to interpret laboratory reports independently. Laboratory reports should always be reviewed and interpreted by qualified healthcare professionals together with the patient’s symptoms, medical history, examination findings, and other clinical information. East Coast Hospitals shall not be responsible for medical decisions made solely on the basis of laboratory reports without professional medical consultation.

17. Telemedicine and Online Prescriptions

Where permitted by applicable law, East Coast Hospitals may provide teleconsultation services. Online prescriptions shall be issued only where legally permissible and shall comply with the applicable Telemedicine Practice Guidelines and professional standards. Doctors reserve the right to decline teleconsultation or online prescriptions where physical examination is clinically necessary, emergency care is required, applicable laws prohibit remote prescribing, or patient identity cannot be reasonably verified. Final clinical decisions shall always remain the responsibility of qualified healthcare professionals.

18. Pharmacy Services

Where pharmacy services are provided: medicine availability is subject to stock availability; certain medicines may require valid prescriptions; controlled medicines shall be dispensed only in accordance with applicable law; and prices may change without prior notice due to regulatory or supplier revisions. East Coast Hospitals does not guarantee continuous availability of every medicine.

19. Artificial Intelligence and Automated Technologies

East Coast Hospitals may utilise artificial intelligence (“AI”), machine learning, automation, or similar digital technologies to assist with appointment scheduling, administrative workflows, patient communication, clinical documentation support, decision support tools, service quality improvement, and operational efficiency. These technologies are intended to assist healthcare delivery and administrative functions. Final medical diagnosis, treatment decisions, prescriptions, and clinical judgments shall always remain the responsibility of qualified healthcare professionals. Patients should not rely solely upon automated outputs when making healthcare decisions.

20. Cookies and Website Technologies

Our website may use cookies, web beacons, analytics tools, and similar technologies to maintain secure sessions, remember user preferences, improve website performance, analyse visitor behaviour, enhance security, detect fraud, and improve user experience. Users may configure their browsers to reject cookies. However, certain features of the website may not function correctly if cookies are disabled.

21. Website Availability

East Coast Hospitals makes reasonable efforts to maintain uninterrupted availability of its website and digital services. However, we do not guarantee continuous or uninterrupted availability. The website or any digital service may be suspended, interrupted, restricted, or discontinued temporarily due to scheduled maintenance, software upgrades, security updates, technical failures, cybersecurity incidents, internet disruptions, epidemic outbreaks, natural disasters, government directives, or other unforeseen operational circumstances. East Coast Hospitals shall not be liable for temporary interruptions beyond its reasonable control.

22. Marketing Communications

East Coast Hospitals may periodically communicate with patients and users regarding healthcare services, wellness programs, health awareness initiatives, preventive health campaigns, vaccination drives, health packages, and other Hospital-related updates. Where required by applicable law, such communications will be sent only after obtaining the necessary consent.

Patients may receive communications through SMS, email, telephone, mobile application notifications, WhatsApp (where consent has been provided), or other officially authorised digital communication channels. Patients may opt out of promotional or marketing communications at any time by using the unsubscribe mechanism provided or by contacting the Hospital.

Please note that opting out of promotional communications will not affect essential communications relating to appointment confirmations, appointment reminders, diagnostic reports, prescription notifications, billing information, treatment updates, emergency notifications, legal or regulatory communications, or patient safety alerts.

23. Email Communication

Email is not always a secure method of communication. Patients are advised not to send highly sensitive personal or medical information through unsecured email unless specifically requested by East Coast Hospitals. Where patients voluntarily choose to communicate through email, they acknowledge the inherent security risks associated with electronic communication. The Hospital will take reasonable steps to protect email communications within its control but cannot guarantee the security of messages transmitted over public internet infrastructure.

24. Third-Party Websites

The East Coast Hospitals website may contain links to third-party websites, healthcare partners, payment gateways, insurance providers, government portals, or other external resources. These websites operate independently of East Coast Hospitals. We are not responsible for their privacy practices, security measures, content, availability, policies, or services. Users are encouraged to review the privacy policies of third-party websites before providing personal information.

25. Your Privacy Rights

Subject to applicable law, you may have the following rights regarding your personal information:

• Request access to your personal information
• Request correction or updating of inaccurate or incomplete information
• Request deletion of personal information where legally permissible
• Withdraw consent where processing is based upon consent
• Request information regarding how your personal information is processed
• Request restriction of processing where applicable
• Request review of certain automated processing decisions where provided by law
• Lodge a complaint regarding the handling of your personal information

Certain requests may be subject to identity verification and may be limited where East Coast Hospitals is required by law to retain records or continue processing information for legitimate healthcare, legal, regulatory, or public interest purposes.

26. Withdrawal of Consent

Where processing of your personal information is based on your consent, you may withdraw such consent at any time by contacting East Coast Hospitals. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal. Please note that withdrawal of consent may limit or prevent the Hospital from providing certain healthcare or digital services where the processing of personal information is necessary for those services. Medical records already created may continue to be retained where required by applicable law, professional obligations, accreditation standards, or legitimate healthcare purposes.

27. Intellectual Property

The names “East Coast Hospitals”, “ECH”, associated logos, service marks, trade names, taglines, designs, graphics, website content, medical illustrations, publications, software, and other intellectual property displayed on our digital platforms are proprietary assets of East Coast Hospitals or its licensors. No person may copy, reproduce, modify, distribute, publish, transmit, display, sell, licence, or otherwise exploit any intellectual property without prior written permission from East Coast Hospitals, except where permitted under applicable law.

28. Changes to This Privacy Policy

East Coast Hospitals reserves the right to amend or update this Privacy Policy from time to time to reflect changes in applicable laws, regulatory requirements, advances in technology, operational improvements, new healthcare services, security enhancements, or organisational changes. The revised Privacy Policy shall become effective from the date specified in the updated version published on the Hospital’s official website. Your continued use of our services after such changes constitutes your acknowledgement of the revised Privacy Policy.

29. Force Majeure

East Coast Hospitals shall not be liable for any delay, interruption, or failure in fulfilling its obligations under this Privacy Policy where such delay or failure results from events beyond its reasonable control, including but not limited to natural disasters, floods, earthquakes, cyclones, fires, epidemic outbreaks, pandemics, public health emergencies, war, terrorist acts, civil unrest, labour disputes, government restrictions, internet failures, power outages, cybersecurity incidents despite reasonable safeguards, or failure of third-party service providers.

30. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Republic of India. Subject to applicable law, the competent courts at Puducherry shall have exclusive jurisdiction over any dispute arising out of or relating to this Privacy Policy. Nothing in this Privacy Policy shall limit any statutory rights available to patients under applicable law.

32. Privacy Complaints and Grievance Redressal

If you believe that your personal information has been handled inconsistently with this Privacy Policy or applicable law, you may submit a privacy-related complaint to our designated Grievance Officer.

Grievance Officer: Mrs. Tajunisha
East Coast Hospitals
Email: pro@eastcoasthospitals.com
Mobile: +91 6385-130201
Postal Address: East Coast Hospitals, No 1, Paris Nagar, Moolakulam, Puducherry – 605 010, India

The Hospital will acknowledge receipt of your complaint and make reasonable efforts to respond within 30 days of receiving all necessary information. Where additional time is reasonably required due to the complexity of the matter or applicable legal requirements, you will be informed accordingly.