Privacy Policy (DPDP Act, 2023)

1. Commitment to Patient Privacy

Dr. Sukhija's City Diagnostic Centre ("CDC", "we", "us", or "our") is dedicated to protecting the confidentiality, integrity, and security of your personal and health data. In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable healthcare data regulations in India, this Privacy Policy outlines how we collect, process, store, and safeguard your personal information.

2. Personal Data We Collect

We collect only the information necessary to provide accurate diagnostic services, deliver reports, and comply with statutory healthcare mandates:

• Patient Identification & Contact: Full name, age, gender, mobile number, residential address (for at-home collection), and email address.
• Medical Information: Referring doctor's prescription, diagnostic test requests, relevant clinical history, previous radiological scans, or laboratory reports.
• Statutory Requirements: Valid government photo ID and signed declaration (Form F) as mandated by the PCPNDT Act, 1994 for all obstetric ultrasound examinations.
• Billing & Report Delivery Data: Unique Lab ID, transaction receipts, and digital OTP verifications for report downloads.

3. Purpose and Legal Basis for Processing

Your personal and diagnostic data is processed strictly for the following purposes based on your explicit consent:

• Scheduling appointments and home sample collection visits.
• Performing laboratory analyses and imaging investigations accurately.
• Correlating findings with clinical history by our consultant radiologists and pathologists.
• Delivering diagnostic test reports securely to you via WhatsApp and our encrypted OTP report portal.
• Complying with statutory reporting requirements established by statutory health bodies and accreditation standards (NABH & NABL).

4. Security of Diagnostic Reports & PACS / LIS Systems

Patient diagnostic records and DICOM imaging scans are managed with stringent technical safeguards:

• No Guessable URLs: Diagnostic reports cannot be accessed via sequential or predictable web links.
• OTP Verification: Access to patient reports requires dual-factor authentication using your registered mobile number and Lab ID.
• Server Security: No patient PDF reports are permanently exposed or stored unencrypted on public website web servers. Transfers use end-to-end HTTPS encryption.

5. Data Retention and Sharing

Diagnostic records are retained in compliance with Indian medical council standards and NABL accreditation requirements. We do not sell, rent, or trade your personal data to any third-party marketing companies. Data is shared exclusively with:

• Your treating or referring medical practitioner upon your request or referral.
• Authorized empanelled organisations (e.g., ECHS) for verified beneficiaries with valid polyclinic referrals.
• Statutory authorities when legally required under Indian law (e.g., infectious disease notifications, PCPNDT regulatory audits).

6. Your Rights Under DPDP Act, 2023

As a data principal, you hold the following rights regarding your personal data:

• Right to Access: Review a summary of your personal data and diagnostic reports processed by the centre.
• Right to Correction: Request correction of inaccurate personal demographic details.
• Right to Grievance Redressal: Address any concerns regarding data processing with our Data Protection Officer.