1. Introduction
VITALOS respects patient confidentiality and the privacy of healthcare professionals, employees, visitors and other individuals. This notice describes personal-data processing through the VITALOS website and, where contracted and enabled, its hospital management platform. Processing must comply with applicable Indian law, including applicable provisions of the Digital Personal Data Protection Act, 2023 and rules as their respective provisions come into force.
2. Roles and Responsibilities
The hospital or healthcare organization ordinarily decides the purpose and lawful basis for collecting and using patient medical records and may act as the relevant data fiduciary. VITALOS may process such information under the hospital’s documented instructions and agreement. For website enquiries, demonstration bookings, direct marketing preferences and VITALOS-owned accounts, the relevant operating entity may determine those purposes itself. Responsibilities depend on actual deployment and contractual arrangements.
3. Data We May Process
Depending on modules in use, this includes patient identifiers and demographics; contact and emergency-contact details; appointments and admissions; diagnoses, complaints, prescriptions, vitals, laboratory and imaging results; clinical notes and discharge summaries; insurance and TPA information; invoices and payment references; pharmacy and inventory transactions; doctor, nurse, staff and vendor records; usernames, permissions and audit logs; enquiry form details; device, browser, IP address and service diagnostics. Do not enter information unnecessary for the relevant healthcare or administrative purpose.
4. Why Data Is Used
Data may be processed for registration, care coordination, clinical documentation, appointment and admission management, prescriptions and orders, diagnostic workflows, billing, collection and insurance administration, pharmacy and inventory processes, access control, audits, security, backup, issue resolution, customer support, service maintenance and lawful reporting. Direct website enquiries are used to respond to the requested information or demo.
5. Consent and Other Lawful Grounds
The responsible organization must provide appropriate notices and obtain consent where required, or rely only on another processing ground available under applicable law. Where relevant, the hospital is responsible for additional clinical or regulatory consent requirements. Withdrawal, correction and erasure requests are considered subject to applicable lawful processing and medical recordkeeping obligations.
6. Access, Sharing and Processors
Records may be available to role-authorized hospital personnel and contracted service providers acting within their duties. Where enabled and authorized, data may be transmitted to laboratories, diagnostic partners, insurers or TPAs, payment providers, SMS/email providers, cloud hosting suppliers and government health systems or ABDM participants. Sharing must have an appropriate lawful basis, safeguards and access restrictions. We do not sell identifiable patient medical records to advertising data brokers.
7. Security and Audit Trails
Reasonable safeguards may include access permissions, account authentication, encrypted communication, logging, monitoring, controlled support access, backups and incident response. Hospitals must administer user permissions, secure endpoint devices and follow clinical confidentiality procedures. Specific implemented protections depend on the customer deployment and should be verified against its security documentation.
8. Storage, Retention and Backups
Retention depends on the type of information, applicable medical, financial and other legal obligations, lawful purposes and the hospital’s documented retention instructions. Records may not be erased merely because an individual’s login account closes. Backup copies may persist for a limited documented cycle, subject to protection and deletion controls. The actual hosting geography and retention schedule should be confirmed with the customer agreement.
9. Individual Rights and Requests
Individuals may seek information about processing and request appropriate correction, updating, erasure, withdrawal of consent or grievance redressal where available under applicable law. For medical records held under a hospital’s authority, the hospital may need to evaluate and respond to the request. Contact info@vitalos.in to route a request, specifying the relevant institution without sending sensitive medical documents unnecessarily. Identity may be reasonably verified.
10. Medical Records and Patient Safety
Medical records, prescriptions, audit entries, dispensing histories and billing records may need preservation for safety, continuity of treatment, medical negligence claims, audits and legal compliance. Erasure is not automatic where keeping records is required or otherwise lawfully justified. Access to historical records must remain appropriately restricted.
11. Children and Vulnerable Patients
Where information about children or patients lacking capacity is processed, the responsible hospital must follow applicable consent, guardianship and professional confidentiality requirements. The platform is intended for authorized organizational use and any enabled patient interfaces, not unsupervised collection from children for unrelated commercial purposes.
12. Website Cookies and Device Permissions
The website or enabled applications may use essential cookies, session identifiers and device diagnostics. Any optional analytics, advertising trackers, camera, microphone, notifications, file access or other mobile permissions must be disclosed and requested where actually implemented. This policy does not imply that every permission or tracker is in use.
13. Breaches and International Processing
Potential breaches are investigated and handled under applicable legal and contractual notification requirements. Hosting and transfers outside India, if any, must follow applicable law and government restrictions. Individuals and hospital clients will be notified when legally required.
14. Updates and Privacy Contact
We may revise this notice and post the revised effective date. For privacy requests or complaints, contact info@vitalos.in, VITALOS, Ahmedabad, Gujarat, India. The final published notice should identify the contracting legal entity, appropriate grievance contact, and any required additional disclosures.