Privacy notice
How we handle your reports
In plain language, because a privacy policy nobody can read protects nobody. Last updated 15 October 2026.
Note for Your Hospital Name: have your legal adviser review and sign off this page before the site goes live. The content below is a working draft written to match the Digital Personal Data Protection Act, not legal advice. Delete this box once it has been reviewed.
Who is responsible for your data
Your Hospital Name, Building, Street, Area, City, State, PIN, is the data fiduciary for the information you send through this service. In plain terms: we are the ones answerable for it.
What we collect, and why — item by item
| What | Why we need it |
|---|---|
| Patient’s name, age, sex | To identify the case and because age and sex change clinical judgement |
| Mobile number, email, city | To tell you your opinion is ready, or to ask for a missing report |
| Your condition, diagnosis, medicines, history | So the doctor can give an opinion |
| Reports and documents you upload | These are the evidence the opinion is based on |
| Parent or guardian’s name, if the patient is under 18 | Because a minor cannot give this consent themselves |
| The date, time and IP address of your consent | To prove you gave permission, and when |
| A record of each time a doctor opens your case | So we can tell you honestly who has seen your records |
That is the whole list. We do not ask for your government ID, your income, your insurance details, or your religion or caste, and you should not send them.
What we use it for — and nothing else
- To prepare your second opinion. This is the only purpose you must agree to.
- To keep a medical record of the opinion we gave, as medical records rules require.
- Anonymous teaching examples — only if you ticked that box. Only in a form like “62-year-old man, knee pain”, never your name, photograph, or anything that could identify you.
- To contact you about treatment here — only if you ticked that box. If you did not, nobody will call you about treatment. Ever.
We do not sell your data. We do not share it with insurers, pharmaceutical companies, labs, diagnostic centres, or marketing agencies. There is no arrangement under which anyone pays us for access to patients.
Who can see it inside the hospital
The doctor reviewing your case, the staff member who triages cases when they arrive, and the medical director who is accountable for the quality of opinions. Nobody else, including our administrative and billing staff.
Every time a case is opened, it is logged with the doctor’s name and the time. If you ask us who has seen your records, we can tell you exactly.
Where your files are stored
Your uploaded documents are held on our server in India, in a location that is not reachable from the public web — there is no link anyone can guess or share. Every request for a file is checked against who is asking before the file is sent. Your case page is reached through a private link unique to you, is never indexed by search engines, and is never cached.
How long we keep it
Medical records rules require us to keep records for at least 7 years after the opinion. After that they are deleted. We do not keep them “just in case” beyond that.
What you can ask us to do
- See what we hold about you — we will send you a copy.
- Correct something that is wrong — a misspelled name, a wrong age.
- Delete your data — we will do it, unless a specific law requires us to keep a particular record, in which case we will tell you which one and why.
- Withdraw a permission you gave — for example, take back the anonymous case-study consent, or the permission to be contacted.
- Nominate someone to exercise these rights on your behalf if you are unable to.
Write to our Grievance Officer and we will act on it. See the Grievance Officer page for the contact details and how long we take.
If something goes wrong
If your data is ever exposed in a breach, we will tell you and we will report it to the Data Protection Board. We will not quietly sit on it.
Children
If the patient is under 18, a parent or guardian must give consent and we record their name and relationship. We do not run any tracking or advertising aimed at children, or at anyone else.
Tracking on this website
We do not load advertising trackers or social media pixels on any page that carries your medical information — not on the submission form, not on your case page, not on your opinion. This is deliberate. Basic, anonymised visitor counting may run on our public information pages only.
A word about WhatsApp and email
If you send documents to us over WhatsApp or email, please understand that a copy then also exists on your own phone or in your own mailbox, which is outside our control. We use an official hospital WhatsApp number and hospital email — not a doctor’s personal phone — and what reaches us goes into the same protected case file as a web submission.
Questions about any of this
Full Name, Grievance Officer
grievance@secondopinionhospital.com
+91 00000 00000