Privacy Policy

Contents

1. About us and scope of this policy
2. Information we collect
3. How we use your information
4. Sensitive personal data
5. Cookies and tracking technologies
6. Third-party platforms and service providers
7. Disclosure of your information
8. Data retention
9. Your rights
10. Children's privacy
11. Data security
12. International users
13. Changes to this policy
14. Grievance officer and contact

1. About us and scope of this policy

Ovum Hospitals – A Unit of Neonatal Care & Research Institute Private Limited together with its associated brands including, but not limited to, Ovum Fertility (ovumfertility.in) and Ovum Baby Buddy (ovumbabybuddy.com) (collectively referred to as "Ovum", "we", "us", or "our"), operates a network of woman and child speciality hospitals, fertility clinics, neonatal units, and related healthcare facilities across India.

This Privacy Policy ("Policy") governs the collection, use, retention, sharing, and protection of personal information when you interact with us through any channel, including but not limited to our website (www.ovumhospitals.com), mobile application, appointment booking systems, WhatsApp and other digital communication channels, or when you attend any of our hospital facilities in person.

This Policy has been prepared in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), as applicable from time to time, and shall be updated as and when applicable laws are amended or new regulations come into force.

References to "you" and "your" mean the individual availing our services and shall also include, without limitation, any relative, guardian, caretaker, or duly authorised representative ("Authorised Representative") acting on your behalf. This Policy should be read in conjunction with our General Consent Form and any other notices provided to you at the point of data collection.

2. Information we collect

We collect personal information across the following categories, as may be applicable to your interaction with us. The categories below are illustrative and include, but are not limited to, the examples stated:

We collect information directly from you at the point of registration or enquiry, automatically through your use of our digital platforms, and, where clinically appropriate, from authorised third parties including but not limited to referring physicians, diagnostic laboratories, or insurance providers acting on your behalf.

3. How we use your information

We process your personal information only for specific, lawful, and clearly defined purposes. Such purposes include, but are not limited to, the following:

• Scheduling, confirming, and managing your clinical appointments and facilitating the delivery of healthcare services
• Creating, maintaining, and updating accurate medical and clinical records to support continuity and quality of care
• Processing billing, managing health insurance claims, and facilitating payment transactions with all third-party vendors including but not limited to Insurance Companies, TPA, Healthcare aggregators, facilitators
• Communicating with you regarding appointment reminders, post-care instructions, and clinically relevant health information via SMS, WhatsApp, email, or such other channels as may be applicable
• Responding to enquiries and feedback submitted through any of our communication channels through inbound/outbound call centres or through third party vendors.
• Improving website usage and patient interaction patterns to improve our digital platforms and service/clinical delivery.
• Displaying relevant advertisements and promotional content on digital platforms, subject to your consent where required under applicable law
• Complying with our legal, regulatory, and accreditation obligations, including but not limited to requirements under the National Accreditation Board for Hospitals (NABH), the Clinical Establishments Act, the Assisted Reproductive Technology (Regulation) Act, 2021, KPME and any other applicable healthcare regulations under the laws of India.
• Supporting academic research, clinical audits, or public health initiatives, only where data is adequately anonymised or explicit consent has been obtained

Your personal data will not be used for any purpose that is incompatible with the purpose for which it was originally collected, without your prior explicit consent. Where we rely on consent as the legal basis for processing, you retain the right to withdraw that consent at any time.

4. Sensitive personal data

The nature of our clinical services necessarily requires us to collect and process categories of data that are accorded heightened protection under applicable law. Such sensitive personal data includes, but is not limited to, medical and health records, sexual and reproductive health information (particularly in connection with our IVF, obstetrics, and gynaecology services, childcare), genetic information where applicable, and financial information.

We collect sensitive personal data only with your informed, explicit, and documented consent, provided at the time of registration or at the point of collection. Such consent shall clearly specify the nature of the data being collected, the purpose for which it will be used, and the parties with whom it may be shared. Blanket or implied consent shall not be treated as valid consent for the purposes of processing sensitive personal data.

Sensitive personal data shall be shared only on a strict need-to-know basis, limited to those personnel or entities whose access is directly necessary for the purpose for which the data was collected. It shall not be shared with any third party for commercial, marketing, or any other secondary purpose without your separate, specific, and freely given consent.

You may withdraw your consent to the processing of sensitive personal data at any time by writing to our Grievance Officer. Such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal, and shall be subject to any overriding legal or regulatory obligation that may require us to retain such data.

5. Cookies and tracking technologies

Our website uses cookies and similar tracking technologies, including but not limited to pixel tags, web beacons, and session identifiers, to support the functioning of the website, analyse usage patterns, and deliver relevant advertising.

Non-essential cookies will only be placed with your prior consent, which you may provide, manage, or withdraw at any time through the cookie preference centre available on our website or through your browser settings. Please note that withdrawing consent for certain cookies may affect the availability or functionality of specific features on our website.

6. Third-party platforms and service providers

We engage carefully selected third-party service providers and technology platforms to support our operations and digital services. These providers may process your personal data on our behalf and are bound by contractual obligations to handle such data securely, confidentially, and solely for the purposes for which it has been shared with them. Such providers include, but are not limited to:

• Amazon Web Services (AWS), India region — cloud infrastructure, hosting, and secure storage of website assets and operational data
• Eka Care & Medics— digital health platform supporting doctor profiles, patient communication, and clinical record management
• Google LLC — website analytics (Google Analytics) and digital advertising (Google Ads)
• Meta Platforms Inc. — social media advertising and audience engagement on Facebook and Instagram
• LinkedIn Corporation — professional network advertising and lead generation
• WhatsApp Business — patient communication, appointment booking, and clinical follow-up
• Razorpay - Payment gateway service providers — secure processing and settlement of billing and payment transactions
• Such other technology, logistics, or service partners as may be engaged by us from time to time, subject always to appropriate data processing agreements

We do not sell, rent, or trade your personal data to any third party. Any sharing of data with third-party providers is strictly limited to what is necessary for the performance of services on our behalf.

7. Disclosure of your information

We may disclose your personal information only in the following circumstances and, in each case, only to the extent strictly necessary for the stated purpose:

• To treating physicians, nurses, paramedical staff, and clinical personnel within Ovum who are directly and necessarily involved in your care, on a need-to-know basis
• To external laboratories, diagnostic partners, specialist referral centres, or allied health providers, where required for the coordination and delivery of your clinical care and with your knowledge or consent
• To health insurance companies, third-party administrators, or government health schemes, solely to the extent required to process your legitimate claims or entitlements
• To regulatory authorities, statutory bodies, courts of law, or law enforcement agencies, where disclosure is mandated by applicable law or valid legal process
• To our professional advisors including, but not limited to, legal counsel, auditors, and accreditation bodies, subject to appropriate confidentiality obligations
• In connection with a business merger, acquisition, restructuring, or transfer of assets, subject to the receiving entity being bound by equivalent data protection obligations

In all cases of disclosure, we shall take reasonable steps to ensure that the recipient handles your data in a manner consistent with this Policy and applicable law. Your personal data shall never be disclosed to third parties for their independent commercial, marketing, or any other purpose without your explicit prior consent.

8. Data retention

We retain personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law, whichever is longer. Our general retention practices are as follows:

• Medical and clinical records are retained in accordance with the requirements of the Clinical Establishments Act, applicable state health regulations, the ART (Regulation) Act, 2021, and NABH standards, as may be applicable from time to time
• Appointment, communication, and operational data is retained for a minimum period of eight (8) years from the date of the last interaction
• Marketing interaction data is retained for a period of twelve months from the date of last engagement, unless earlier deletion is requested by you
• Financial and billing records are retained for a minimum period of seven years in accordance with applicable tax and financial reporting laws
• Data collected through cookies and analytics tools is retained in accordance with the respective platform providers' data retention policies and our cookie settings

Upon expiry of the applicable retention period, personal data will be securely and irreversibly deleted, anonymised, or otherwise disposed of in a manner that prevents its reconstruction or re-identification.

9. Your rights

In accordance with the DPDP Act, 2023 and other applicable law, you, as a data principal, are entitled to exercise the following rights in relation to your personal data held by us:

To exercise any of the above rights, please submit a written request to our Grievance Officer at the details provided in Section 14. We shall acknowledge your request within 48 hours and endeavour to respond substantively within 30 days. Where we are unable to fulfil your request in full, we shall provide you with written reasons.

10. Personal data of minors and patients who lack capacity

As a hospital specialising in woman and child care, neonatology, and paediatrics, the collection and processing of personal data relating to minors — defined as any individual below the age of 18 years — is an inherent and necessary part of our clinical operations. We therefore collect, use, and retain such data in a lawful, purposeful, and clinically responsible manner.

The following principles govern our handling of a minor's personal data:

• Consent by guardian: All personal and medical data relating to a minor shall be collected only with the prior, documented, and informed consent of a parent or legal guardian. Such consent shall be specific to the purpose of collection and shall not be construed as a general or blanket authorisation.
• Need-to-know access: A minor's personal and clinical data shall be accessible only to treating clinical staff and authorised personnel who have a direct and necessary role in the child's care. Access shall not be granted to any other internal or external party without the express consent of the parent or legal guardian.
• No secondary use: Personal data of a minor shall not, under any circumstances, be used for marketing, advertising, research, or any other secondary purpose without the separate, explicit, and informed consent of the parent or legal guardian.
• Highest standard of confidentiality: Clinical records relating to minors, including neonatal, NICU, PICU, and paediatric records, shall be held to the strictest standard of confidentiality and shall be treated as sensitive personal data in their entirety.
• Parents' and guardians' rights: The parent or legal guardian of a minor patient may exercise all rights set out in Section 9 of this Policy on behalf of the minor. Upon the minor attaining the age of 18, they may exercise such rights independently.
• Patients lacking capacity: Where an adult patient lacks the mental capacity to provide informed consent — including but not limited to patients in intensive care or under general anaesthesia — consent shall be obtained from their next of kin or Authorised Representative in accordance with applicable medical ethics and law. Their data shall be handled with the same protections as apply to minors under this section.

In compliance with the DPDP Act, 2023, we shall not process the personal data of a minor in any manner that may cause a detrimental effect on the child's wellbeing, and we shall not subject a minor to behavioral tracking, profiling, or targeted advertising of any kind.

11. Data security

We have implemented appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include secure HTTPS connections on our website, access controls limiting data access to authorised personnel only, data hosted on AWS servers within India, regular security assessments, and staff training on data privacy and confidentiality.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the Data Protection Board of India and, where required, the affected individuals, in accordance with the DPDP Act.

12. International users

Ovum Hospitals operates exclusively within India. If you are accessing our website from outside India - for example, if you are an NRI, a foreign national, or an individual located abroad enquiring about our services - please be aware that any personal data you submit will be transferred to, processed, and stored in India, in accordance with Indian law.

We handle such data with the same standards of care, transparency, and security as we do for all our patients and visitors, consistent with the principles of the DPDP Act 2023, including purpose limitation, data minimization, and your right to access and correction.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The updated policy will be published on our website with a revised "Last Updated" date. We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to inform you directly.