Privacy Policy

1. Who this applies to

This policy covers personal data YHC Hospital at Home ("YHC", "we") collects through yhchospital.com, the YHC app, and phone/WhatsApp bookings, from patients, family members, and site visitors in India.

2. What we collect

Identity and contact data: name, phone number, address, family member details.

Health data: vitals, medical history, prescriptions, and records you or your care team upload. The DPDP Act 2023 does not create a separate "sensitive personal data" category — all personal data is treated uniformly under it — but health data is exactly the kind of information YHC applies additional safeguards to as our own standard: role-restricted access, encryption, and logging (see Section 7).

Booking and payment data: service history, booking status, and payment confirmation (card/UPI details are handled directly by our payment processor — YHC does not store them).

Device and usage data: IP address, app/browser type, and pages visited, for security and service reliability.

3. Why we collect it, and our legal basis

To provide the booked service (contract performance): dispatching staff, tracking a visit, billing.

With your consent: Care Copilot vitals logging, marketing communications, and any use beyond what a booking strictly requires.

To meet a legal obligation: tax records, grievance handling, and requests from authorities under applicable law.

4. Who we share it with

Assigned care staff, to the extent needed to deliver the booked service.

Payment processing (Razorpay), SMS/WhatsApp delivery, and cloud hosting providers, acting as processors under contract — never sold.

Authorities, only where legally required.

5. Your rights as a Data Principal

Access: request a copy of your personal data — /me/privacy/export in your account, or by contacting the grievance officer below.

Correction and erasure: request correction of inaccurate data, or deletion — /me/privacy/delete in your account.

Withdraw consent: for anything collected on a consent basis (e.g. Care Copilot), at any time, without affecting past processing.

Grievance redressal: raise a complaint with our grievance officer before escalating to the Data Protection Board of India.

6. Retention

Booking and billing records are retained as required by Indian tax and healthcare recordkeeping law. Health data is retained only as long as needed for care continuity or a legal obligation, then deleted or anonymised.

7. Security

Data is encrypted in transit and at rest. Access to health data is role-restricted and logged.

8. Children’s data

Where a booking is made on behalf of a minor family member, consent is given by the adult account holder, whose declared relationship to the patient (parent, guardian, or other family member) is recorded against the booking.

YHC does not use a minor’s data for behavioural tracking or to build a marketing or advertising audience of any kind, and never targets advertising at a child directly.

9. Grievance officer

Umed Yadav, CEO and Founder — Umed.yhc@gmail.com. Complaints are acknowledged within 48 hours and resolved within one month, in line with the Consumer Protection (E-Commerce) Rules 2020. Data-related grievances may be escalated to the Data Protection Board of India if unresolved.

10. If personal data is breached

If a personal data breach occurs, affected Data Principals are notified without delay, and a report is filed with the Data Protection Board of India within 72 hours of YHC becoming aware of it, as required by the Digital Personal Data Protection Rules 2025.

11. Changes to this policy

Material changes will be notified before they take effect.