Privacy Notice (Draft for Legal Review)
Notice issued pursuant to Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act).
This document is prepared to align with Digital Personal Data Protection Act (DPDP Act 2023) provisions. Formal review by qualified legal counsel is pending.
1. Personal Data Collected
We collect personal identifying information (full name, email, mobile phone number, date of birth, gender), account credentials, ABHA address/number (Ayushman Bharat Digital Mission), appointment history, and clinical records (diagnoses, prescriptions, test reports, vaccination logs) submitted by you or your healthcare providers.
2. Specified Purposes of Processing
Your personal data is processed strictly for: (a) authenticating your user account, (b) enabling appointment scheduling with healthcare consultants, (c) providing longitudinal health record storage, (d) facilitating care coordination among your authorized providers, and (e) complying with statutory healthcare reporting requirements.
3. Data Retention
Personal data and clinical records are retained for as long as your account is active, or as mandated by applicable Indian medical regulations (such as NMC/MCI clinical records retention guidelines). Upon verified account deletion, personal records are permanently erased, subject to statutory retention requirements.
4. Data Principal Rights (DPDP Act 2023)
Under Section 6, 11, 12, and 13 of the DPDP Act 2023, you have the right to: (a) access a summary of your personal data processed, (b) request correction or updating of inaccurate data, (c) erase personal data no longer necessary for the specified purpose, (d) withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal, and (e) nominate another individual in the event of death or incapacity.
5. Grievance Redressal Officer
Designated Grievance Officer: [GRIEVANCE_OFFICER_NAME_PLACEHOLDER]
Email: grievance@harfindia.org (Placeholder - Pending Legal)
Address: Health Assistant India, Compliance & Grievance Cell, New Delhi, India
Timelines: Grievances are acknowledged within 24 hours and resolved within the statutory period under DPDP rules.
6. Incident & Breach Response
In the event of a personal data breach impacting your data, notification will be provided to the Data Protection Board of India and affected data principals without undue delay, in accordance with Section 8(6) of the DPDP Act 2023.
Reporting: security@harfindia.org / breach-response@harfindia.org