Privacy Policy

1. Who this applies to

This policy covers personal data YHC Hospital at Home ("YHC", "we") collects through yhchospital.com, the YHC app, and phone/WhatsApp bookings, from patients, family members, and site visitors in India.

2. What we collect

Identity and contact data: name, phone number, address, family member details.

Health data: vitals, medical history, prescriptions, and records you or your care team upload — this is "sensitive personal data" under the DPDP Act and is handled with additional safeguards.

Booking and payment data: service history, booking status, and payment confirmation (card/UPI details are handled directly by our payment processor — YHC does not store them).

Device and usage data: IP address, app/browser type, and pages visited, for security and service reliability.

3. Why we collect it, and our legal basis

To provide the booked service (contract performance): dispatching staff, tracking a visit, billing.

With your consent: Care Copilot vitals logging, marketing communications, and any use beyond what a booking strictly requires.

To meet a legal obligation: tax records, grievance handling, and requests from authorities under applicable law.

4. Who we share it with

Assigned care staff, to the extent needed to deliver the booked service.

Payment processing (Razorpay), SMS/WhatsApp delivery, and cloud hosting providers, acting as processors under contract — never sold.

Authorities, only where legally required.

5. Your rights as a Data Principal

Access: request a copy of your personal data — /me/privacy/export in your account, or by contacting the grievance officer below.

Correction and erasure: request correction of inaccurate data, or deletion — /me/privacy/delete in your account.

Withdraw consent: for anything collected on a consent basis (e.g. Care Copilot), at any time, without affecting past processing.

Grievance redressal: raise a complaint with our grievance officer before escalating to the Data Protection Board of India.

6. Retention

Booking and billing records are retained as required by Indian tax and healthcare recordkeeping law. Health data is retained only as long as needed for care continuity or a legal obligation, then deleted or anonymised.

7. Security

Data is encrypted in transit and at rest. Access to health data is role-restricted and logged.

8. Children’s data

Where a booking is made on behalf of a minor family member, the adult account holder provides consent on their behalf.

9. Grievance officer

Name and direct contact pending appointment by YHC. Until published here, use the phone number on /contact for any privacy request.

10. Changes to this policy

Material changes will be notified before they take effect.