Privacy Policy

1. Introduction

At Pragma Medical Institute, located in Bathinda, Punjab, we are committed to protecting your privacy and ensuring you have a positive experience on our website and at our healthcare facility. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information.

We comply with applicable healthcare and data protection regulations, including:

• Health Insurance Portability and Accountability Act (HIPAA) - U.S. healthcare privacy standards
• General Data Protection Regulation (GDPR) - European data protection requirements
• Personal Data Protection Bill (PDPB) - Indian data protection framework
• Medical Council of India (MCI) Regulations
• Information Technology Act, 2000

2. Information We Collect

A. Personal Information

We collect various types of personal information from patients, website visitors, and other individuals who interact with our hospital:

• Identity Information: Name, date of birth, gender, nationality, passport/government ID number
• Contact Information: Phone number, email address, postal address, emergency contact details
• Financial Information: Insurance details, billing address, payment method information, bank account details (for refunds only)
• Professional Information: Occupation, employment details, business information

B. Healthcare Information (Protected Health Information - PHI)

This is highly sensitive information that we handle with utmost care:

• Medical history and previous diagnoses
• Current symptoms and complaints
• Clinical examination findings
• Laboratory and diagnostic test results
• Imaging reports and radiology films
• Pathology reports
• Prescriptions and medication details
• Immunization records
• Surgical reports and operative notes
• Nursing notes and vital signs
• Mental health and psychiatric information (if applicable)
• Genetic information (if collected)
• Disability information
• Biometric data (fingerprints, facial recognition for security purposes)

C. Information Collected Automatically

When you visit our website, we automatically collect certain information:

• Device Information: Device type, operating system, browser type, IP address, device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, search queries, referral sources
• Location Data: Approximate location based on IP address (with your consent)
• Cookies & Tracking: Cookies, pixels, and similar tracking technologies
• Performance Data: Error logs, crash reports, performance analytics

D. Information from Third Parties

• Insurance companies and TPAs (Third Party Administrators)
• Employers and government health schemes
• Referral physicians
• Public records and government databases
• Business partners and service providers

3. How We Use Your Information

A. Primary Healthcare Purposes

• To provide medical diagnosis, treatment, and patient care
• To create and maintain your medical records
• To schedule appointments and manage your healthcare visits
• To dispense medications and medical devices
• To conduct necessary medical procedures
• To coordinate care with other healthcare providers
• To manage your hospital stay and discharge planning
• To provide follow-up care and monitoring

B. Administrative & Operational Purposes

• To process and manage payments and insurance claims
• To verify insurance coverage and benefits
• To generate bills and statements
• To manage appointment reminders and notifications
• To manage patient communication
• To maintain hospital records and compliance

C. Research & Quality Improvement

• To conduct clinical research (with separate informed consent)
• To perform quality assurance and improvement activities
• To analyze treatment outcomes and effectiveness
• To develop medical education materials
• To improve our healthcare services
• To train medical staff (de-identified information)

D. Marketing & Communication (with consent)

• To send appointment reminders and health updates
• To inform you about new departments and services
• To send health tips and wellness information
• To conduct patient satisfaction surveys
• To send newsletters (only if you opt-in)
• To inform about special health programs and camps

E. Legal & Compliance

• To comply with legal and regulatory requirements
• To respond to government authorities and subpoenas
• To prevent fraud and unauthorized access
• To protect hospital security and patient safety
• To enforce our terms and policies

4. Information Sharing & Disclosure

A. When We Share Information

We may share your information in the following circumstances:

B. Authorized Healthcare Providers

• Treating physicians and medical specialists at Pragma Medical Institute
• Referring and consulting doctors outside our hospital
• Nurses, technicians, and paramedical staff involved in your care
• Medical laboratories and diagnostic centers
• Pharmacies and pharmaceutical suppliers
• Blood banks and transfusion services
• Emergency medical services (ambulance providers)

C. Insurance & Payment Processing

• Insurance companies and TPAs (Third Party Administrators)
• Government health schemes (Ayushman Bharat, ECHS, etc.)
• Credit card processors and payment gateways
• Bank and financial institutions
• Medical coding and billing specialists

D. Legal Requirements

• Law enforcement and government authorities (court orders, subpoenas)
• Public health authorities during disease outbreaks
• Regulatory bodies (Medical Council of India, State Medical Council)
• Quality assurance and accreditation bodies (NABH, JCI, etc.)

E. Who We Don't Share Information With

• Employers (unless you authorize for occupational health)
• Life insurance companies (unless required by law)
• Marketing and advertising companies
• Social media platforms
• Any third party without your explicit consent

F. Service Providers

We may share information with third-party service providers who assist us in:

• Website hosting and maintenance
• Email and communication services
• IT infrastructure and cybersecurity
• Medical records management systems
• Patient appointment scheduling
• Analytics and reporting

All service providers are contractually obligated to maintain confidentiality and use information only as necessary.

5. Data Security & Protection

A. Security Measures

We implement comprehensive technical, administrative, and physical security measures:

B. Technical Security

• Encryption: AES-256 encryption for data at rest and TLS/SSL for data in transit
• Firewalls: Multi-layer firewalls protecting our systems
• Intrusion Detection: Real-time monitoring for suspicious activities
• Backup Systems: Redundant data backups with secure storage
• Access Controls: Role-based access control (RBAC) and authentication
• Multi-Factor Authentication (MFA): Two-factor authentication for staff
• Secure APIs: Secure interfaces for third-party integrations
• Vulnerability Scanning: Regular security audits and penetration testing

C. Administrative Security

• Comprehensive staff privacy training and HIPAA awareness programs
• Strict access policies limiting information to authorized personnel
• Background checks for employees handling sensitive data
• Regular security awareness campaigns
• Incident response procedures and contingency plans
• Business associate agreements with all third parties

D. Physical Security

• Controlled access to facilities with security personnel
• CCTV surveillance in sensitive areas
• Secure storage of physical medical records
• Document destruction procedures (shredding/incineration)
• Visitor management and ID verification
• Secured server rooms with climate control

E. Incident Response

In case of a data breach or security incident, we will:

• Immediately investigate and contain the breach
• Notify affected individuals within 30 days (as required by law)
• Report to regulatory authorities as mandated
• Implement corrective measures to prevent recurrence
• Provide credit monitoring or identity theft protection services if necessary

6. Your Rights & Choices

A. Right to Access Your Medical Records

You have the right to request and obtain copies of your medical records within 30 days. We may charge a reasonable fee for copying and postage. Medical records are maintained for a minimum of 7 years from the date of last treatment.

B. Right to Correct or Amend Records

If you believe your medical information is inaccurate or incomplete, you can request corrections. We will review your request and make necessary amendments within 30 days.

C. Right to Request Confidentiality

You can request that we maintain extra confidentiality regarding your treatment. This may include:

• Restricting which family members can access your information
• Requesting that certain procedures or diagnoses remain confidential
• Requesting alternative contact methods

D. Right to Opt-Out of Communications

You can opt-out of:

• Marketing communications and newsletters (click unsubscribe)
• Appointment reminders (alternative arrangements can be made)
• Patient satisfaction surveys
• Health education materials

E. Right to Withdraw Consent

You can withdraw consent for specific uses of your information at any time, except where we are legally required to maintain the information.

F. Right to Data Portability

You have the right to receive your medical records in a standard electronic format (PDF, XML) for transfer to another healthcare provider.

G. Right to Grievance Redressal

If you have concerns about how we handle your privacy, you can file a complaint with our Privacy Officer or the relevant regulatory authority.

H. Right to Know Data Usage

You can request information about how your personal data is being used and who has accessed it.

7. Cookies & Tracking Technologies

A. What Are Cookies?

Cookies are small text files stored on your device that help us recognize you and improve your browsing experience. We use the following types:

B. Types of Cookies

C. Managing Cookies

You can control cookies through your browser settings:

• Enable or disable cookies
• Delete existing cookies
• Set preferences for specific websites
• Enable "Do Not Track" signals

Note: Disabling essential cookies may impact website functionality.

D. Other Tracking Technologies

• Pixels: Invisible images that track page views and conversions
• Web Beacons: Technology for sending information when you visit pages
• Local Storage: Browser-based storage for user preferences
• Analytics: Tools like Google Analytics to understand usage patterns

E. Third-Party Tracking

We use third-party services that may place cookies on your device:

• Google Analytics (analytics.google.com)
• Facebook Pixel (facebook.com)
• Google Ads (google.com/ads)

You can opt-out of these services through their privacy dashboards.

8. Third-Party Links & Services

A. External Links

Our website may contain links to external websites including:

• Government health authority websites
• Medical research databases
• Insurance provider portals
• Health information websites
• Social media platforms

B. Disclaimer

We are not responsible for the privacy practices of external websites. We recommend reviewing the privacy policies of any third-party sites you visit. Pragma Medical Institute is not liable for:

• How third parties handle your information
• Content on external websites
• Security practices of third-party sites
• Terms and conditions of third-party services

C. Embedded Content

Our website may embed content from:

• YouTube videos
• Google Maps
• Social media feeds
• Analytics services

These embedded services may collect information independently. Check their privacy policies.

D. Social Media Integration

If you connect your social media accounts to our services, we may receive:

• Profile information
• Email address
• List of friends/followers
• Public posts (if shared)

You can revoke access anytime through your social media account settings.

9. Children's Privacy

A. Our Policy

Pragma Medical Institute does not knowingly collect personal information from children under 13 years of age without parental consent.

B. Pediatric Patients

For pediatric patients (under 18 years), we follow these practices:

• Parental/guardian consent is required for treatment and information sharing
• Parents/guardians have the right to access their child's medical records
• We protect children's privacy even more strictly than adults
• Special care is taken with sensitive pediatric information

C. Parental Rights

Parents/guardians can:

• Request copies of their child's medical records
• Consent or refuse specific treatments
• Request amendments to medical information
• Opt their child out of non-essential communications

D. Age of Consent

Upon reaching 18 years (or as per local law), patients can manage their own medical information and make independent decisions about privacy.

10. Data Retention

A. Medical Records Retention

B. Data Deletion Procedures

After the retention period expires:

• Physical records are shredded or incinerated
• Electronic records are securely deleted using data destruction methods
• Digital records are overwritten multiple times to prevent recovery
• De-identified data may be retained for research purposes

C. Legal Hold

If there is ongoing litigation or investigation, records may be retained longer as required by law.

D. Website Data Retention

• Contact Form Inquiries: 1 year
• Appointment Requests: 1 year after appointment
• Website Analytics: 2 years
• Server Logs: 90 days

11. International Data Transfers

A. Localization of Healthcare Data

As a healthcare provider operating in India, we comply with the following:

• Medical records are primarily stored and maintained in India
• Healthcare data is not transferred to servers outside India without explicit consent
• International transfers comply with the Personal Data Protection Bill, 2023
• We follow Reserve Bank of India guidelines for financial data

B. When International Transfer May Occur

Data may be transferred internationally only when:

• Required for patient care (consultation with international specialists)
• For participation in international clinical trials (with separate consent)
• For international insurance claims
• Required by law or court order

C. Safeguards for International Transfers

• Data is encrypted during transit
• Recipient countries must have adequate data protection laws
• Business associate agreements are signed with international partners
• Data transfer is limited to what is absolutely necessary

D. Your Rights Regarding International Transfers

• You have the right to know if your data is being transferred internationally
• You can restrict international transfers of your personal information
• You can request that sensitive medical data remain within India