Version 1.3 | Effective from 17 October 2026 | Law as of 17 October 2026
Prana Ayurvedic Care Hospital uses your information to care for you, manage your bookings and stays, and meet our legal duties. We do not sell personal data, and we never use your health information for advertising.
We collect what we need to consult, treat and follow up with you, run residential programmes, and keep the records the law requires.
Your health information is seen only by the people caring for you or running your care.
Optional uses, such as health tips, patient stories or photographs, happen only if you say yes. You can withdraw at any time.
We keep records for set periods (section 14), then delete or anonymise them.
You can see, correct or erase your data, nominate someone to act for you, and complain to us and then to the Data Protection Board of India.
This policy is in English. Ask us at admission@pranahospital.org for a Tamil version, or a version in any other language listed in the Eighth Schedule to the Constitution of India, or in large print.
1. Who we are and how to contact us
Prana Ayurvedic Care Hospital is the trade name of a sole proprietorship owned by Parthasarathi Nandakumar. We decide how and why your personal data is used, so we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“we”, “us”, “our”).
Address: Surathi Enclave, 224/1 Velathamman Kovil Street, Chinna Moperipalayam, Vaharayampalayam, Coimbatore 641659, Tamil Nadu, India
This policy covers the personal data we handle when you:
visit pranahospital.org, or contact us by phone, WhatsApp, email or the website form;
book or receive a consultation, therapy or programme, at our hospital or online;
stay with us for a residential programme, or accompany a patient who does;
join a health camp, a community or corporate wellness programme, a workshop or a training course;
ask for help with an insurance claim, or are referred to or from another provider; or
visit our premises.
It also covers information about parents, guardians, companions, emergency contacts and nominees that is given to us.
If you buy our products through Amazon, Amazon’s privacy notice applies to your purchase, and we receive only the order details Amazon shares with sellers. Websites we link to have their own policies. Our staff receive a separate notice.
3. The personal data we collect
We collect only what each service needs. The table lists every type of personal data, grouped by how you deal with us.
When
What we collect
Where it comes from
Enquiries by website form, phone, WhatsApp or email
Name, phone number, email, the service you are interested in (Ayurvedic Consultation, Naturopathy or Mental Wellness), your message, and anything you choose to tell us. On WhatsApp, also your profile name and number
You
Registration and care at the hospital
Name, age or date of birth, gender, address, phone, email and emergency contact. Medical history, current symptoms, medicines you take (including allopathic medicines) and allergies. Lifestyle, diet, sleep and digestion details, and menstrual, pregnancy and emotional well-being details where relevant to your care. Prakriti (body constitution) assessment, examination findings including pulse and tongue examination, measurements and vital signs. Diagnosis, treatment plan, prescriptions, therapy and progress notes, and laboratory reports. Clinical photographs of an affected area, only with your permission
You, your parent or guardian, our practitioners and therapists, laboratories, and doctors who refer you
Online consultations
The items above, plus call or video logs, the account or number used, and e-prescriptions
You and our practitioners
Residential programmes
Details of a government ID (any valid ID; Aadhaar only if you choose it, as a masked copy). For foreign nationals, passport, visa and arrival details. Room, stay and diet details, and details of companions and visitors
You and your companion
Payments
Amount, receipt, payment method, transaction reference, and the payer name or UPI ID that your bank or UPI app shows us. We never ask for or store card numbers, CVV, UPI PIN or passwords
You, your bank or UPI app
Insurance claims
Policy details, claim forms, and the records your insurer or TPA needs
You, your insurer or TPA
Health camps, community and corporate programmes
Name, contact details, age, screening results or programme notes recorded for you, and the organisation through which you joined
You and the organising body
Training courses and workshops
Name, contact details, qualifications, ID details for certificates, attendance, assessments and payments
You
Products bought on Amazon
The order and delivery details Amazon shares with sellers
Amazon
Website visits
IP address, device and browser type, pages visited, the referring site, and identifiers set by cookies (section 9)
Required and optional details. Fields marked as required are needed to provide the service safely. If you do not give them, we may not be able to provide that service. Everything else is optional.
Details about other people. If you give us details of a companion, emergency contact, nominee or family member, please tell them and share this policy with them.
4. Why we use your data, and the legal basis
Each use below rests either on your consent or on a specific “legitimate use” in section 7 of the Digital Personal Data Protection Act, 2023.
Purpose
Main data used
Legal basis
Reply to enquiries and arrange appointments
Contact and enquiry details
Details you give us for this purpose (section 7(a)); your consent for any health details you share
Assess, diagnose, treat and follow up; prepare and dispense medicines; coordinate your care within our team
Health, identity and contact data
Your consent at registration, and details you give us for your care (section 7(a))
Protect you in a medical emergency, including transfer to our partner hospital
Relevant health and contact data
Medical emergency (section 7(f))
Run residential programmes: rooms, meals, safety and visitors
Stay, ID, diet and companion details
Your consent, and section 7(a)
Report foreign nationals’ stay or treatment to immigration authorities
Passport, visa and stay details
Legal obligation (section 7(d))
Issue receipts and keep tax and accounting records
Payment, identity and service details
Legal obligations under income-tax and GST laws
Support insurance claims
Records the claim needs
Your consent
Refer you for tests or care elsewhere
Relevant health details
Your consent, or a medical emergency
Run health camps, community and corporate programmes
Camp or programme details
Your consent
Run training courses and issue certificates
Trainee details
Details you give us for this purpose (section 7(a)) and your consent
Send service messages: confirmations, reminders, reports and follow-up
Contact details
Your consent, and section 7(a)
Send health tips, programme news and offers
Contact details and the interests you tell us
Your separate, optional consent only
Publish patient stories, photographs or videos
Only what the consent form lists
Your separate written consent only
Understand how our website is used
Cookie and device data
Your consent for non-essential cookies
Report to public health authorities where the law requires
Relevant clinical data
Legal obligation and public health (sections 7(d) and 7(g))
Keep our premises and systems secure
System logs, and CCTV images where installed
Legal duties to keep logs; for CCTV, your consent through our registration and visitor forms, with notices at entrances
Handle complaints, disputes and legal claims
The records concerned
Compliance with law, and enforcing legal rights and claims (section 17(1)(a))
We use your data only for these purposes. Before using it for a new purpose, we will tell you and ask for your consent where the law requires. We do not make decisions about you by automated means alone.
5. How we treat your health information
Your health information is used for your care and is kept confidential.
Only practitioners, therapists and staff involved in your care or its administration can see it, and they are bound by confidentiality.
Mental and emotional health details get extra protection. We share them only with your consent or where the law requires, in line with the Mental Healthcare Act, 2017.
We do not share your health information with your employer, family, insurer, a camp organiser or anyone else without your consent, except where the law requires it or in an emergency.
We do not sell it, use it for advertising or share it with advertising platforms. Our website uses no advertising pixels or advertising cookies.
We will not add you to WhatsApp or other groups without your consent.
We keep your records electronically only with the consent you give at registration. Paper records are kept in restricted areas.
6. Children and persons with disabilities
For patients under 18, a parent or lawful guardian registers the child, gives consent and receives information.
We take reasonable steps to confirm that the person is an adult and is the child’s parent or guardian.
We use a child’s data for health care to the extent needed to protect the child’s health. For anything else, such as photographs, stories or newsletters, we ask the parent or guardian for separate consent.
We do not track children’s behaviour for advertising, and we do not direct targeted advertising at children.
For an adult who has a lawful guardian, we act on the guardian’s consent and check the guardianship.
7. Who we share data with
We share personal data only with the people and organisations below, and only what each needs. We do not sell personal data.
Our team: practitioners, therapists, pharmacy and front-office staff, on a need-to-know basis.
Other health providers: doctors, laboratories or hospitals you choose or we refer you to, with your consent.
Insurers and TPAs: only for a claim you ask us to support, with your consent.
Service providers who work for us under confidentiality: website hosting and maintenance, email, WhatsApp messaging (WhatsApp, a Meta service), video consultations, our record system, website statistics, banks and UPI apps that process payments, and our accountants and auditors.
Programme organisers: for camps, community and corporate programmes, only combined, de-identified results, unless you agree to more.
Authorities, when the law requires: immigration authorities for foreign nationals, public health authorities, tax authorities, and courts or police on a lawful written request or order.
People you choose: your nominee, guardian or emergency contact, as you instruct or in an emergency.
A successor: if our hospital is transferred, the new operator must protect your data as this policy describes, and we will tell you.
Professional advisers: our lawyers and auditors, under confidentiality.
Ask us for the current list of our main service providers.
8. Messages, WhatsApp and marketing choices
We send service messages as part of your care, and promotional messages only if you opt in.
Service messages (confirmations, reminders, reports, follow-up and safety information) come by SMS, WhatsApp, email or phone.
WhatsApp is run by Meta under its own terms. Chats may contain health details you choose to share, so share only what is needed to book; your practitioner takes your full history at the consultation. We copy clinically relevant details into your record.
Promotional messages (health tips, programme news and offers) come only if you opted in. Stop them at any time by replying STOP, using the unsubscribe link in an email, or telling us. We act on an opt-out within 2 working days and will not ask you to opt in again for at least 90 days.
Our SMS headers and templates are registered as Indian telecom rules require.
Fraud warning: we never ask for your OTP, UPI PIN, card details or passwords. Pay only at our hospital or through the official UPI QR code on our website, and call +91 99436 11911 if a message claiming to be from us looks wrong.
9. Cookies and website tools
Our website uses a few outside services, and none of them is used for advertising.
Service
What it does
What it receives
Essential cookies (our website)
Keep the site working and remember your cookie choice
Cookie identifiers
WordPress.com Stats (Jetpack), Automattic, USA
Counts visits and shows which pages are useful, in combined form
IP address, browser details, pages visited; sets statistics cookies
Statistics cookies are set only if you accept them in the cookie banner, and you can change your choice at any time through “Cookie settings” at the foot of every page. You can also block or delete cookies in your browser settings.
10. Online consultations
Online consultations are handled with the same confidentiality as visits to the hospital.
We use video platforms for video and voice consultations. Please join from a private place on your own device.
We confirm your identity before the consultation, and a parent or guardian must be present for a child.
Neither you nor our practitioner may record a consultation unless both agree beforehand.
Your prescription and advice are sent to your registered email or WhatsApp number and kept in your record, with the consultation log.
Online consultations are not for emergencies. In an emergency, call 112 or 108.
11. Photographs, videos and patient stories
We never photograph or film you, or publish your words, without your separate written consent for that specific use.
The consent form says what will be used, where it will appear and for how long.
You can withdraw consent for future use at any time. We then remove the material from channels we control within 7 days, but we cannot recall printed copies already handed out or posts others have already shared.
Clinical photographs taken for your record are used only for your care and are never published.
We do not publish before-and-after images, and we do not identify children in any published material.
We do not film in treatment rooms, changing areas or patient rooms while any patient is present.
12. Residential programmes, companions, foreign nationals and our premises
For residential programmes we collect only what we need to keep you safe and run your stay.
Identity: any valid government ID is accepted. Aadhaar is never compulsory; if you choose it, we take only a masked copy.
Companions and visitors: we record their names, contact details and visits for safety.
Foreign nationals: Indian law (the Immigration and Foreigners Act, 2025) requires us to report foreign nationals who receive indoor treatment, and attendants we give lodging to, to the immigration Registration Officer. We use passport, visa and stay details for that report.
CCTV: cameras cover entrances, corridors, reception and other common areas, with notices where they operate. There are no cameras in consultation rooms, treatment rooms, changing areas, toilets or patient rooms. Footage is kept for 30 days, then overwritten, unless needed for an incident under review. Only authorised staff can view it, and we disclose it only on a lawful request from the police or a court.
13. Where your data is stored, and transfers outside India
Your clinical records are kept at our hospital in Coimbatore, on paper and in RECORD SYSTEM AND WHERE IT IS HOSTED.
Some service providers process data outside India: WhatsApp (Meta), WordPress.com Stats (Automattic, USA), and Google Fonts. We use providers that protect data under contract. Any transfer follows Indian law, including any restriction the Central Government notifies under section 16 of the Digital Personal Data Protection Act, 2023.
We do not send your health records or samples to any organisation outside India for your care without telling you first and asking for your consent.
14. How long we keep your data
We keep each type of data for a set period, then delete it or make it anonymous.
Data
How long
Why
Clinical records
7 years after your last visit. For children, until 3 years after they turn 18 or 7 years after the last visit, whichever is later
Safe continuing care; professional rules require at least 3 years; complaints and claims can arise years after treatment
Daily case register, receipts, invoices and accounts
8 years
Income-tax rules require the daily case register for 7 tax years; GST law requires records for 72 months
Consent forms
As long as the related record. Marketing and photograph consents: 3 years after you withdraw
To show what you agreed to
Enquiries that did not lead to a visit
12 months after your last contact
To answer follow-up questions
WhatsApp, email and website form messages
3 years after your last contact; clinical details are copied into your record
Service history
Marketing choices
Until you opt out; the opt-out record for 3 years
To respect your choice
Training and certificate records
7 years after the course
To confirm certificates and keep fee records
Health camp and programme records
As clinical records
They record care given to you
CCTV footage, where installed
30 days
Security
Website and server logs
1 year
Security, and legal duties to keep logs
Passport and visa details of foreign nationals
As long as immigration rules require, then deleted
Legal obligation
If a complaint, claim or legal requirement is pending, we keep the records it concerns until it is resolved.
15. Security, and what happens if there is a breach
We protect your data with safeguards suited to health information, and we plan for incidents because no system is completely secure.
Access is limited by role, and staff are bound by confidentiality.
Paper records are kept in restricted areas.
Our website uses an encrypted connection (HTTPS), and our systems use individual logins, regular backups and access logs.
Service providers must protect data under their contracts with us.
Please keep any login or one-time password private, and tell us at once if you suspect misuse.
If a breach affects your personal data, we will tell you without delay through your registered contact: what happened, the likely effect on you, what we are doing, and what you can do. We will also report it to the Data Protection Board of India and to CERT-In as the law requires.
16. Your rights and how to use them
You can ask us at any time to show, correct or erase your data, and we reply within 30 days.
Access: a summary of the personal data we hold about you and how we use it, and the names of others we have shared it with and what we shared.
Copies of your medical records: within 72 hours for records we hold electronically, and in any case within 7 days.
Correction, completion and updating: in clinical records we add a dated correction rather than deleting the original entry, because the record must show what was known at the time.
Erasure: we erase data we no longer need. Records the law requires us to keep (section 14) cannot be erased early, and we will tell you which they are.
Withdraw consent: as easily as you gave it, through the same channel or any channel below. Withdrawal does not affect what we did before, but we may be unable to continue a service that depends on it.
Nominate: name one or more people to use these rights for you if you die or cannot act.
Complain: to our Grievance Officer, and then to the Data Protection Board of India (section 18).
How to ask: email admission@pranahospital.org, call or WhatsApp us, or ask at reception. Tell us your registered mobile number or email, and your patient ID or booking reference if you have one. We may ask for proof of identity, and a guardian or nominee may need to show their authority. Requests are free.
When we reply: we acknowledge within 48 hours and give a full answer within 30 days. If a request is complex we will tell you why and when to expect our answer, and we will never take longer than 90 days. Every reply includes the contact details in section 1.
17. Your duties
The Digital Personal Data Protection Act, 2023 (section 15) also asks something of you. When you give us information, please:
make sure it is accurate, and that it is yours to give;
not impersonate anyone else;
not leave out information that matters for your care or your identity; and
not file false or frivolous complaints.
18. Complaints
If you are unhappy with how we handle your data, tell our Grievance Officer first (section 1).
We acknowledge your complaint within 48 hours and give you a copy of it as we recorded it.
We resolve it within 30 days.
If you are not satisfied, you may complain to the Data Protection Board of India. For concerns about our services, you can also call the National Consumer Helpline on 1915, or file a consumer complaint through e-Jagriti.
You may also approach the authority that registered our hospital
19. Changes to this policy, and the laws we follow
We update this policy when our practices or the law change, and the version number and effective date at the top change with it. For significant changes we tell you by email or WhatsApp before they take effect. Earlier versions are available on request.
This policy is written to meet:
the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, applied in full as their provisions come into force;
the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, while they remain in force;
the Consumer Protection Act, 2019 and the rules made under it;
the Mental Healthcare Act, 2017, for mental health information; and
the professional and ethical rules that apply to our practitioners, including the National Commission for Indian System of Medicine (Ethics and Registration) Regulations, 2023.
