Privacy Policy

1. Introduction

This Privacy Policy applies to Sufia Healthcare Super Specialty Hospital (operated under Sufia Healthcare Pvt. Ltd. / Sufia Memorial Hospital), located at Hussaini More, Bindusar, Siwan, Bihar - 841277, India, together with its official digital channels including https://sufiahealthcare.in/, patient portals, mobile appointment desk, and telemedicine services.

This document outlines our protocols regarding the collection, handling, storage, transfer, and safeguarding of patient information in accordance with the Digital Personal Data Protection (DPDP) Act 2023, the Information Technology Act, 2000 (and its SPDI Rules), National Medical Commission (NMC) regulations, and applicable Clinical Establishments laws.

2. Information We Collect

In order to provide comprehensive clinical consultations, emergency care, inpatient/outpatient treatments, and surgical procedures, we may collect the following categories of information:

• Personal Identifiers: Full legal name, date of birth, age, gender, guardian/attendant name, residential address, telephone number, email address, and government identification (such as Aadhaar, Voter ID, or Ayushman Bharat Health Account - ABHA ID where provided).
• Clinical & Health Data: Medical history, allergies, chronic ailments, previous surgeries, vital signs, physical examination records, doctors' clinical case notes, nursing logs, prescriptions, and immunisation history.
• Diagnostic & Laboratory Records: Blood reports, pathology results, microbiology cultures, radiological images (X-rays, CT Scans, Ultrasound reports), ECG, and echocardiography records.
• Billing & Insurance Information: TPA insurance cards, cashless policy approval documents, government healthcare scheme eligibility details, payment transaction IDs, and receipt history.
• Digital & Technical Data: When you access our website or online appointment scheduling module, we may log browser type, IP address, device specifications, and page interaction timestamps for security and quality optimization.

3. Purpose of Processing (How We Use Your Data)

Sufia Healthcare processes patient information strictly for legitimate medical and hospital administrative purposes:

1. Direct Medical Care & Diagnosis: Enabling doctors, surgeons, nursing staff, and consultants to accurately evaluate, treat, monitor, and manage your health condition.
2. Appointment Scheduling & Confirmation: Sending appointment reminders, token slips, OPD schedule updates, and emergency triage communications via SMS, phone call, or WhatsApp.
3. Diagnostics & Lab Dispatch: Processing clinical samples, generating laboratory reports, and securely making them available to you and your primary treating physician.
4. Inpatient Admission & Discharge: Facilitating bed allotment, ICU/NICU/PICU monitoring, surgery scheduling, and issuing official discharge summaries.
5. Insurance & Cashless Claim Processing: Coordinating with Third-Party Administrators (TPAs) and health insurers with your explicit consent to settle cashless hospital claims.
6. Statutory Compliance: Complying with mandatory public health notifications, infectious disease reporting to municipal/district health authorities, and medico-legal reporting as required by Indian law.

4. Data Security & Storage

We implement comprehensive technical, physical, and administrative security measures aligned with National Accreditation Board for Hospitals & Healthcare Providers (NABH) guidelines:

• Role-Based Access Control (RBAC): Only licensed medical officers, authorized nurses, and designated medical records personnel have authenticated access to patient health files.
• Encrypted Digital Infrastructure: Web communications are secured using SSL/TLS 256-bit encryption. Stored electronic medical records (EMR) are protected behind firewalls with regular automated backups.
• Physical Records Security: Physical files, OPD registers, and clinical case sheets are stored in access-controlled Medical Records Departments (MRD) protected against unauthorized entry, fire, and water damage.
• Staff Confidentiality Agreements: All doctors, nurses, paramedical staff, and administrative personnel sign binding non-disclosure and patient privacy undertakings.

5. Information Sharing & Disclosure

Sufia Healthcare maintains an absolute policy: We do not sell, rent, monetize, or trade patient personal or clinical information to marketing agencies or commercial third parties.

Information is disclosed solely under the following defined conditions:

• Treating Medical Team: Multi-disciplinary doctors, visiting super specialists, pathologists, and nursing teams directly involved in your care.
• Accredited Diagnostic Partners: External specialized referral laboratories for rare or high-precision tests not performed in-house, with strict confidentiality safeguards.
• Insurance Companies & TPAs: Diagnostic reports and billing records sent to verify and authorize cashless or reimbursement claims authorized by the patient.
• Legal & Regulatory Mandates: Judicial orders, police inquiries in medico-legal cases (MLC), or public health reporting (e.g., epidemic disease control notifications) under Indian law.

6. Patient Rights (Under DPDP Act 2023)

As a patient or legal guardian at Sufia Healthcare, you are entitled to specific legal rights regarding your personal and healthcare data:

• Right to Access: You may request copies of your medical records, diagnostic reports, and discharge summaries upon submitting written verification.
• Right to Correction & Updating: You have the right to request correction of inaccurate or outdated contact or demographic information.
• Right to Grievance Redressal: You can submit privacy concerns or complaints directly to our designated Hospital Data Protection & Grievance Officer.
• Right to Nominate: You may designate a legal representative or next-of-kin to exercise these rights in the event of incapacity.

7. Retention of Health Records

In accordance with National Medical Commission (NMC) regulations, Clinical Establishments standards, and Indian medico-legal statutes, Sufia Healthcare retains inpatient and outpatient medical records for the minimum legally mandated retention periods (typically 3 to 10 years depending on the nature of the case, paediatric records until adulthood, and indefinitely for specific critical surgical archives).

8. Cookies & Digital Tracking

Our website uses strictly necessary cookies to ensure smooth navigation, preserve user preferences (such as language selection), and protect against malicious cyber attacks. We do not use third-party tracking cookies to serve targeted advertisements. You can configure your browser to reject cookies, though certain online booking features may function with reduced convenience.

9. Children & Minors

Healthcare services for children and minors under the age of 18 are provided strictly with the informed consent of a parent or verified legal guardian. We do not collect digital information from minors without parental consent.

10. Grievance Redressal & Contact Information

If you have any questions, clarifications, or complaints regarding this Privacy Policy or the handling of your medical records, please contact our hospital administration: