Ovum Hospitals – A Unit of Neonatal Care & Research Institute Private Limited
Ovum Hospitals – A Unit of Neonatal Care & Research Institute Private Limited together with its associated brands including, but not limited to, Ovum Fertility (ovumfertility.in) and Ovum Baby Buddy (ovumbabybuddy.com) (collectively referred to as "Ovum", "we", "us", or "our"), operates a network of woman and child speciality hospitals, fertility clinics, neonatal units, and related healthcare facilities across India.
This Privacy Policy ("Policy") governs the collection, use, retention, sharing, and protection of personal information when you interact with us through any channel, including but not limited to our website (www.ovumhospitals.com), mobile application, appointment booking systems, WhatsApp and other digital communication channels, or when you attend any of our hospital facilities in person.
This Policy has been prepared in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), as applicable from time to time, and shall be updated as and when applicable laws are amended or new regulations come into force.
References to "you" and "your" mean the individual availing our services and shall also include, without limitation, any relative, guardian, caretaker, or duly authorised representative ("Authorised Representative") acting on your behalf. This Policy should be read in conjunction with our General Consent Form and any other notices provided to you at the point of data collection.
We collect personal information across the following categories, as may be applicable to your interaction with us. The categories below are illustrative and include, but are not limited to, the examples stated:
| Category | Includes, but is not limited to |
|---|---|
| Identity and contact information | Full name, date of birth, gender, marital status, phone number, email address, postal address, and government-issued identification where required |
| Appointment and booking data | Preferred hospital location, treating doctor, appointment date and time, nature of consultation, referral source |
| Medical and clinical information | Presenting symptoms, medical and surgical history, obstetric history, reproductive health information, IVF treatment records, scan and diagnostic reports, prescriptions, clinical notes, discharge summaries, NICU and PICU admission and progress records |
| Financial and billing information | Billing address, health insurance details, third-party administrator information |
| Device and usage data | IP address, browser type and version, device identifiers, operating system, pages visited, time spent on the website, clickstream data, referral URLs, and interaction data collected through cookies and analytics tools |
| Communication and enquiry data | Messages, enquiries, and feedback submitted via WhatsApp, website forms, email, or our mobile application |
| Digital Marketing interaction data | Engagement with our advertisements on platforms including, but not limited to, Google, LinkedIn, and Meta (Facebook, Whatsapp and Instagram), including clicks, form submissions, and enquiry data originating from such platforms |
We collect information directly from you at the point of registration or enquiry, automatically through your use of our digital platforms, and, where clinically appropriate, from authorised third parties including but not limited to referring physicians, diagnostic laboratories, or insurance providers acting on your behalf.
We process your personal information only for specific, lawful, and clearly defined purposes. Such purposes include, but are not limited to, the following:
Your personal data will not be used for any purpose that is incompatible with the purpose for which it was originally collected, without your prior explicit consent. Where we rely on consent as the legal basis for processing, you retain the right to withdraw that consent at any time.
The nature of our clinical services necessarily requires us to collect and process categories of data that are accorded heightened protection under applicable law. Such sensitive personal data includes, but is not limited to, medical and health records, sexual and reproductive health information (particularly in connection with our IVF, obstetrics, and gynaecology services, childcare), genetic information where applicable, and financial information.
We collect sensitive personal data only with your informed, explicit, and documented consent, provided at the time of registration or at the point of collection. Such consent shall clearly specify the nature of the data being collected, the purpose for which it will be used, and the parties with whom it may be shared. Blanket or implied consent shall not be treated as valid consent for the purposes of processing sensitive personal data.
Sensitive personal data shall be shared only on a strict need-to-know basis, limited to those personnel or entities whose access is directly necessary for the purpose for which the data was collected. It shall not be shared with any third party for commercial, marketing, or any other secondary purpose without your separate, specific, and freely given consent.
You may withdraw your consent to the processing of sensitive personal data at any time by writing to our Grievance Officer. Such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal, and shall be subject to any overriding legal or regulatory obligation that may require us to retain such data.
Our website uses cookies and similar tracking technologies, including but not limited to pixel tags, web beacons, and session identifiers, to support the functioning of the website, analyse usage patterns, and deliver relevant advertising.
| Type | Purpose and scope |
|---|---|
| Strictly necessary cookies | Essential to the core operation of the website, including session management, appointment booking, and security. These cookies cannot be disabled as they are integral to the delivery of the service you have requested. |
| Analytics and performance cookies | Collect aggregated and, where possible, anonymised data on how visitors interact with our website, including pages visited, time on site, and navigation paths. Used to identify areas for improvement. Includes tools such as Google Analytics. |
| Marketing and retargeting cookies | Track interactions with our digital advertising campaigns across platforms including, but not limited to, Google Ads, Meta (Facebook/Instagram), and LinkedIn. Used to measure campaign effectiveness and to display relevant content to users who have previously visited our website. |
| Functional cookies | Retain preferences selected by you during your visit, including your chosen hospital location or preferred language, to personalise your experience on subsequent visits. |
Non-essential cookies will only be placed with your prior consent, which you may provide, manage, or withdraw at any time through the cookie preference centre available on our website or through your browser settings. Please note that withdrawing consent for certain cookies may affect the availability or functionality of specific features on our website.
We engage carefully selected third-party service providers and technology platforms to support our operations and digital services. These providers may process your personal data on our behalf and are bound by contractual obligations to handle such data securely, confidentially, and solely for the purposes for which it has been shared with them. Such providers include, but are not limited to:
We do not sell, rent, or trade your personal data to any third party. Any sharing of data with third-party providers is strictly limited to what is necessary for the performance of services on our behalf.
We may disclose your personal information only in the following circumstances and, in each case, only to the extent strictly necessary for the stated purpose:
In all cases of disclosure, we shall take reasonable steps to ensure that the recipient handles your data in a manner consistent with this Policy and applicable law. Your personal data shall never be disclosed to third parties for their independent commercial, marketing, or any other purpose without your explicit prior consent.
We retain personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law, whichever is longer. Our general retention practices are as follows:
Upon expiry of the applicable retention period, personal data will be securely and irreversibly deleted, anonymised, or otherwise disposed of in a manner that prevents its reconstruction or re-identification.
In accordance with the DPDP Act, 2023 and other applicable law, you, as a data principal, are entitled to exercise the following rights in relation to your personal data held by us:
| Right | Scope and application |
|---|---|
| Right to access | Request a summary of the personal data we hold about you and the purposes for which it is being processed |
| Right to correction and completion | Request rectification of any inaccurate, outdated, or incomplete personal data we hold |
| Right to erasure | Request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal, regulatory, or medical record-keeping obligations |
| Right to withdraw consent | Withdraw your consent to any processing activity for which consent was the legal basis, without prejudice to the lawfulness of prior processing within a period of 60 (sixty) days from the date of processing activity |
| Right to grievance redressal | Lodge a complaint with our Grievance Officer and receive a reasoned response within the timelines specified in this Policy |
| Right to nominate | Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, in accordance with the DPDP Act |
To exercise any of the above rights, please submit a written request to our Grievance Officer at the details provided in Section 14. We shall acknowledge your request within 48 hours and endeavour to respond substantively within 30 days. Where we are unable to fulfil your request in full, we shall provide you with written reasons.
As a hospital specialising in woman and child care, neonatology, and paediatrics, the collection and processing of personal data relating to minors — defined as any individual below the age of 18 years — is an inherent and necessary part of our clinical operations. We therefore collect, use, and retain such data in a lawful, purposeful, and clinically responsible manner.
The following principles govern our handling of a minor's personal data:
In compliance with the DPDP Act, 2023, we shall not process the personal data of a minor in any manner that may cause a detrimental effect on the child's wellbeing, and we shall not subject a minor to behavioral tracking, profiling, or targeted advertising of any kind.
We have implemented appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include secure HTTPS connections on our website, access controls limiting data access to authorised personnel only, data hosted on AWS servers within India, regular security assessments, and staff training on data privacy and confidentiality.
In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the Data Protection Board of India and, where required, the affected individuals, in accordance with the DPDP Act.
Ovum Hospitals operates exclusively within India. If you are accessing our website from outside India - for example, if you are an NRI, a foreign national, or an individual located abroad enquiring about our services - please be aware that any personal data you submit will be transferred to, processed, and stored in India, in accordance with Indian law.
We handle such data with the same standards of care, transparency, and security as we do for all our patients and visitors, consistent with the principles of the DPDP Act 2023, including purpose limitation, data minimization, and your right to access and correction.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The updated policy will be published on our website with a revised "Last Updated" date. We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to inform you directly.
In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we have appointed a Grievance Officer to address any concerns or complaints relating to the processing of your personal data.
Grievance Officer
Ovum Hospitals
Email: grc@ovumhospitals.com
Address: #916, 5th A Cross, Outer Ring Road, HRBR Layout, Kalyan Nagar, Bengaluru – 560043
We shall acknowledge receipt of your complaint or request within 48 hours and endeavour to resolve it within 30 days. Where a resolution requires additional time, we shall inform you of the delay and the expected timeline for resolution.