Privacy Policy & Data Protection Notice

1. Personal Data We Collect

We collect personal and health data only to the extent necessary to deliver safe, effective clinical consultations and aesthetic treatments:

• Identity & Contact Details: Full name, mobile number, email address, physical address, and government identification where required for clinical admission.
• Clinical & Health Records (PHI): Medical history, allergies, diagnostic reports, ongoing treatments, and clinical photographs captured during virtual or in-person assessments.
• Digital Interaction & Technical Data: IP address, device type, browser specifications, UTM referral parameters, and cookie-derived preferences.

2. Purpose of Data Processing

In accordance with the principle of Purpose Limitation under the DPDP Act, your data is processed strictly for the following lawful purposes:

• Scheduling, managing, and confirming medical, surgical, and aesthetic consultations.
• Providing specialized clinical evaluations, operative care, and post-procedure recovery support.
• Communicating appointment reminders, diagnostic updates, and care instructions via Phone, SMS, Email, or WhatsApp.
• Fulfilling statutory medical record retention mandates prescribed by the National Medical Commission (NMC) and State Health Authorities.
• Optimizing website performance and analyzing clinical service demand with your consent.

3. Consent & Withdrawal of Consent

Your consent is obtained through clear affirmative actions on our appointment forms and digital interfaces. You have the right to withdraw your consent at any time for non-essential communications (such as marketing updates) by contacting our Grievance Officer or using the opt-out links provided in our communications. Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal or processing required under clinical statutory mandates.

4. Data Security & Access Controls

We implement stringent technical and organizational security safeguards, including Role-Based Access Controls (RBAC), end-to-end data encryption in transit and at rest, automated audit logs, and restricted access protocols. Access to clinical records is strictly limited to authorized medical practitioners and coordinators directly involved in your care.

5. Data Processors & Third-Party Disclosures

We do not sell, rent, or trade your personal data. We engage vetted third-party Data Processors under strict confidentiality and data protection agreements:

• Cloud & Hosting Providers: Secure cloud infrastructure (Cloudflare, AWS) with enterprise data protection controls.
• Diagnostic & Laboratory Partners: NABL-accredited pathology and imaging centers directly involved in your diagnostic workup.
• Communication Platforms: Official WhatsApp Business API providers and verified SMS gateways for transactional appointment alerts.
• Legal & Regulatory Authorities: Government or judicial bodies when strictly mandated by applicable law.

6. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you hold the following statutory rights:

• Right to Access: Request a summary of your personal data processed by us and identities of data processors shared with.
• Right to Correction & Erasure: Request the correction of inaccurate or misleading data, or erasure of data no longer required for clinical or legal purposes.
• Right of Grievance Redressal: Register complaints regarding data processing with our designated Grievance Officer.
• Right to Nominate: Nominate an individual to exercise your data protection rights in the event of death or incapacity.

To exercise any of these rights, please email our team at [email protected] with your registered contact details and specific request.

7. Protection of Children's Data

Cosmo Radiance does not knowingly process personal data of individuals under the age of 18 without verifiable consent from their parent or lawful guardian. We do not engage in behavioral tracking or targeted advertising directed at minors.

8. Communication & DND Authorization

When you submit an inquiry or appointment request, you authorize our medical coordination team to contact you regarding your clinical inquiry:

“I authorize Sunders Cosmo Radiance Hospitals Private Limited and its representatives to Call, SMS, Email or WhatsApp me about its updates and notifications. This consent overrides any registration for DND / NDNC.”

9. Patient Privacy & Data Protection Desk

In compliance with the DPDP Act 2023 and IT Rules, our patient privacy and data support contact details are published below. All inquiries and requests will be acknowledged promptly and resolved within 30 calendar days: