Privacy Policy

Who we are

HKC Hospital (Hyderabad Kidney Centre) is a super-speciality hospital for urology, nephrology, dialysis and kidney transplant services, with an in-house pharmacy. It is a unit of JVP SUPER SPECIALITY HOSPITALS PVT LTD, a company incorporated in India, which is the entity responsible for your personal information (the “data fiduciary”).

Laws this policy follows

We handle personal information in line with Indian law, including:

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force;
• the Drugs and Cosmetics Act, 1940 and the Drugs Rules, 1945, and the Narcotic Drugs and Psychotropic Substances Act, 1985, for our pharmacy;
• medical record-keeping and confidentiality duties that apply to registered medical practitioners and clinical establishments;
• the Consumer Protection Act, 2019; and
• CERT-In directions on reporting cyber security incidents.

Information we collect

Identity and contact details: name, age or date of birth, gender, address, phone number, email address, emergency contact, and government ID (such as Aadhaar, PAN or passport) where needed for registration, insurance or legal requirements.

Health information: medical history, symptoms, diagnoses, examination findings, test and imaging results, prescriptions, treatment and surgery records, dialysis and transplant records, and discharge summaries. Under the SPDI Rules this is “sensitive personal data or information”, and we treat it with the highest level of care.

Pharmacy information: prescriptions you present, medicines dispensed, prescriber details, and the entries the law requires us to keep in pharmacy registers for certain medicines (for example, Schedule H1 and narcotic or psychotropic drugs).

Insurance and billing information: insurer or TPA details, policy and claim numbers, scheme eligibility (such as PMJAY, CGHS or ESI), bills, receipts and GST details.

Payment information: when you pay online, payment details are collected and processed by our payment gateway, Cashfree Payments India Private Limited. We do not see or store your full card number, CVV, UPI PIN or net-banking password. We receive only the transaction reference, amount, status, payment method type and the last digits of the card where the gateway provides them.

Communications: messages, call records and attachments you send us by WhatsApp, email or phone, for example to book an appointment or share reports.

Website information: this website does not have user accounts and does not set advertising or tracking cookies. When you visit, our hosting provider and Google Fonts (which supplies the typefaces) may receive technical data such as your IP address, browser type and the pages requested, as part of serving the site.

How we use your information

• To register you as a patient, schedule appointments and procedures, and send reminders.
• To diagnose, treat and care for you, including coordination between our doctors, nurses, laboratory, dialysis and transplant teams.
• To dispense medicines against valid prescriptions and maintain the records the Drugs and Cosmetics Act and NDPS Act require.
• To bill you, collect payments, issue receipts, and process refunds.
• To process insurance claims and government health scheme claims with your insurer, TPA or scheme authority.
• To share reports and respond to your questions by phone, email or WhatsApp.
• To meet our legal duties, including record retention, notifiable-disease reporting, medico-legal reporting, tax and audit requirements.
• To maintain quality and patient safety, using de-identified information wherever possible.

We do not sell your personal information, and we do not use your health information for advertising.

Legal basis and consent

We process your information with your consent, which you give when you register, book an appointment, share information with us, or pay us. Where the law allows, we also process information without separate consent: in a medical emergency, to comply with a law or court order, for legal and regulatory reporting, and for other legitimate uses permitted by the Digital Personal Data Protection Act, 2023.

You may withdraw consent at any time by writing to us (see “Contact and grievances” below). Withdrawal does not affect processing already carried out, and it does not affect records we must keep by law. If you withdraw consent for information we need to treat you safely, we may not be able to continue providing that service.

Who we share information with

We share information only as needed for the purposes above, and only with:

• Doctors and clinical staff involved in your care, including visiting consultants and external laboratories or imaging centres we refer samples or scans to.
• Insurers, TPAs and government health schemes, to process claims you ask us to make.
• Payment service providers: Cashfree Payments and the banks and card networks involved in your transaction, to process payments and refunds.
• Communication providers: WhatsApp (operated by Meta Platforms), email and SMS providers, to send the messages you ask for.
• Technology and professional service providers such as hosting, IT support, auditors and legal advisers, who are bound to keep the information confidential and use it only for us.
• Government and regulatory authorities, courts and law enforcement, where the law requires it, for example for notifiable diseases, medico-legal cases, drug regulators, tax authorities or a valid legal order.
• Organ transplant authorities, as required under the Transplantation of Human Organs and Tissues Act, 1994 for transplant cases.

Some service providers (for example WhatsApp, email and cloud providers) may store information on servers outside India. Where this happens, we rely on their contractual and security commitments, and we follow any restrictions the Government of India places on transfers.

How long we keep information

• Medical records are kept for at least the minimum periods required for clinical establishments and medical practitioners, and for longer where needed for continuing care or where a case is medico-legal or under dispute.
• Pharmacy records, including prescription registers for Schedule H1 and narcotic or psychotropic drugs, are kept for the periods set by the Drugs Rules, 1945 and the NDPS Act, 1985.
• Billing, payment and tax records are kept for the periods required by the Companies Act, 2013, the Income-tax Act and GST law (generally up to eight years).
• Enquiries and messages that do not become part of a medical or billing record are deleted when no longer needed, normally within 12 months.

When these periods end, we delete or anonymise the information securely.

How we protect information

We follow reasonable security practices and procedures as required by Rule 8 of the SPDI Rules. These include access controls so that only authorised staff see patient information, confidentiality obligations for all staff, encrypted connections for online payments, secure storage of paper and electronic records, and staff training. No system is completely secure. If a personal data breach affects you, we will inform you and report it to CERT-In, the Data Protection Board of India and other authorities as the law requires.

Your rights

You can ask us to:

• access a summary of the personal information we hold about you and how we use it, and obtain copies of your medical records;
• correct, complete or update information that is inaccurate or incomplete;
• delete information we no longer need, subject to the legal retention duties above (see our Data Deletion page);
• withdraw consent for processing based on consent;
• nominate another person to exercise your rights if you die or become unable to do so; and
• raise a grievance about how we handle your information.

To make a request, email contact@hkchospitals.co.in or visit the hospital front office. We may ask you to confirm your identity before acting on a request. We acknowledge requests within 48 hours and respond within 30 days.

Children

We treat patients of all ages. For anyone under 18, we collect and use information with the consent of a parent or lawful guardian, except where the law allows otherwise (for example, in an emergency). We do not use children’s information for tracking, profiling or advertising.

Meta, WhatsApp and Facebook

If you contact us on WhatsApp or through our Facebook or Instagram pages, Meta Platforms processes those messages under its own privacy policy. We receive the information you send us (such as your name, phone number and message content) and use it only to respond to you and manage your appointment. We do not use Facebook Login and we do not receive your Facebook profile data. To have us delete messages and information you shared through these channels, follow the steps on our Data Deletion page.

Contact and grievances

For any question, request or complaint about your personal information, contact our Grievance Officer:

We acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force, or other authorities available under law.

Changes to this policy

We may update this policy when our practices or the law change. The latest version will always be on this page, with the date it was last updated at the top.