Privacy Policy

1. Who we are

This website, www.abhayahealthconsultants.com, is operated by Abhaya Health Consultants, a healthcare consulting business based in Karnataka, India. Abhaya Health Consultants is a business of Abhaya Healthtech Private Limited, a private limited company incorporated in India (“Abhaya Health Consultants”, “we”, “us” or “our”). Our registered office is at Opposite Fire Station, NH 206, Kadur, Karnataka 577548, India.

We provide consulting services to hospitals, clinics, doctors and other healthcare organizations, including staffing and recruitment, insurance and TPA consulting, insurance and risk-management support, hospital operations, healthcare marketing, business consulting and technology. Abhaya Health Consultants is a consulting company and does not underwrite or issue insurance policies.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Abhaya Healthtech Private Limited, operating as Abhaya Health Consultants, is the Data Fiduciary for the personal data described in this policy, and you are the Data Principal.

2. Scope of this policy

This Privacy Policy explains how we collect, use, share, store and protect personal data when you:

• visit or browse this website;
• submit the consultation request form on this website;
• contact us by email or telephone; or
• share information with us while we discuss or provide a service you have requested.

It is written to comply with, and should be read together with, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) and the DPDP Act and the rules made under it, as they apply from time to time. Where a separate written agreement with a client contains specific data-protection terms, those terms also apply to that engagement.

This website is intended for hospitals, clinics, doctors and healthcare businesses. It is not intended for patients seeking medical care, and we do not provide medical advice through it.

3. Personal data we collect

a) Information you enter in the consultation request form

b) Technical information sent with the form

• Date and time of your submission (Indian Standard Time).
• Page address from which the form was sent.
• IP address of the device or network used, and the browser user-agent (a short text that identifies the browser and device type).
• Anti-spam data: the form contains a hidden field that only automated programs fill in, and records how long the form was open before it was submitted. These values are used only to detect automated or abusive submissions.

c) Information collected when you browse

Like most websites, our hosting provider’s web servers automatically record standard server logs when a page is requested. These logs typically include the IP address, date and time, the page or file requested, the referring page, the browser user-agent and the response status. We use them only to keep the website secure and working, and to investigate errors or misuse.

We do not use Google Analytics or any other analytics service, advertising or tracking pixels, or social-media plugins on this website, and our fonts are hosted on our own server. See Cookies and similar technologies.

d) Information you share with us directly

If you email or call us, we receive the information you choose to share, such as your name, contact details, organization details and the content of your message. If you engage us for a service, we may receive further information needed for that service, for example details of employees for a group insurance requirement, candidate profiles for recruitment, or business information for consulting. We handle that information only for the requested service and as agreed with you.

4. How we collect personal data

• Directly from you, when you fill in the consultation request form, email us, call us or meet us.
• Automatically, through server logs and the technical information described above when you use the website.
• From your organization or other parties, where you or your organization ask us to provide a service (for example a hospital sharing staff details for group insurance planning, or a candidate applying for a role we are helping to recruit for).

5. Why we use your personal data

We use personal data only for the following purposes:

• to respond to your consultation request, enquiry or call, and to understand your requirement;
• to discuss, plan and provide the services you request, and to communicate with you about them;
• to keep a record of enquiries so that requests are not lost, for example if an email fails to arrive;
• to protect the website and the form against spam, abuse, fraud and security threats, including limiting repeated submissions from the same connection;
• to maintain, troubleshoot and improve the website; and
• to comply with applicable law, legal processes and requests from authorities, and to establish, exercise or defend legal claims.

We do not use your personal data for automated decision-making or profiling.

6. Lawful basis and consent

We process your personal data on the basis of your consent, which you give when you submit the consultation request form (as stated next to the submit button) or when you choose to contact us. Your consent is limited to the personal data and purposes described in this policy. We collect only the data needed for those purposes.

In some cases we may also process personal data for legitimate uses permitted under Section 7 of the DPDP Act, for example where you have voluntarily provided your data for a specific purpose and have not indicated that you do not consent to its use, or where processing is needed to comply with a law, a court order or a request from a competent authority.

You may withdraw your consent at any time (see Your rights). Withdrawal does not affect processing that took place before it, but we may then be unable to respond to your enquiry or continue a service.

7. Patient health information: please do not submit it

Our website and contact form are meant for hospitals, clinics and healthcare businesses to contact us about consulting services. We do not ask for, and do not want to receive, patient medical records or other patient health information through this website.

Please do not include in the form or in emails any patient’s name together with medical details, diagnoses, treatment records, insurance claim documents, medical history or other health information, or any other sensitive personal data such as passwords or financial account details. Under the SPDI Rules, medical records and history are sensitive personal data. If such information is sent to us by mistake, we will not use it for any purpose and will delete it as soon as reasonably possible.

Where a client engagement genuinely requires access to patient or employee information (for example during an insurance or operations project), this is handled under a separate agreement with the client organization, which remains responsible for having a lawful basis to share it.

8. Sharing and disclosure

We share personal data only when necessary and only with:

• Service providers who help us run our website and communications, acting on our instructions, including our website hosting provider Hostinger and our email service provider. They process the data only to provide their service to us.
• Insurers, Third Party Administrators (TPAs), insurance intermediaries and similar parties, only where this is needed for an insurance-related service you or your organization have requested, and with your consent.
• Clients and candidates in recruitment: where we support recruitment, we share a candidate’s details with a hiring organization only with the candidate’s consent, and share a client’s requirement with candidates only as needed for the role.
• Professional advisers, such as lawyers, auditors or accountants, where needed, under confidentiality obligations.
• Government authorities, courts or law-enforcement agencies, where we are required to do so by law or legal process, or where disclosure is necessary to protect rights, safety or property.
• A successor organization, if our business is restructured, merged or transferred, subject to this policy or an equivalent level of protection.

9. We do not sell personal data

We do not sell, rent or trade your personal data, and we do not share it with third parties for their own marketing.

10. Data storage and retention

When you submit the form, your request is sent by email to our support mailbox (support@abhayahealthconsultants.com). A backup copy of each request (the form fields and the technical information listed above, plus whether the email was delivered) is stored in a protected file on our hosting server, outside the public part of the website or in a folder blocked from public access, so that no request is lost if an email fails.

To limit repeated submissions, the website stores a one-way hashed (SHA-256) form of the IP address with the time of each submission. These records are used only for rate limiting, stop counting after one hour and are deleted automatically by periodic clean-up. Submissions flagged as automated spam are logged with the time, reason, IP address and email address entered, so that abuse can be blocked.

If the website cannot send your request, your own email app may open with the request filled in. In that case the email is sent through your own email provider when you press Send.

We keep personal data only for as long as it is needed for the purposes in this policy, and then delete it, unless a longer period is required by law (for example tax, accounting or legal-claim purposes). Enquiry details are kept for up to 12 months from the date of your enquiry, unless a longer period is required by law or the enquiry leads to an ongoing engagement; after that they are deleted or anonymised. Records relating to services we provide are kept for the duration of the engagement and afterwards for as long as required by law or our agreement with the client. Server logs are kept by our hosting provider in line with its own retention practices. Under the DPDP Act, we will erase personal data when you withdraw consent or when the purpose has been served, unless retention is required by law.

11. Security

We use reasonable security practices and procedures, appropriate to the nature of the data, as required by Section 43A of the Information Technology Act, 2000 and the SPDI Rules, and reasonable security safeguards as required by the DPDP Act. These include:

• encrypted connections (HTTPS) between your browser and this website;
• server-side validation and filtering of form data, and protection against automated and abusive submissions;
• storing enquiry backups outside the public website or in folders blocked from public access;
• restricting access to enquiry data to people who need it to respond to you; and
• using reputable service providers for hosting and email.

No method of transmission or storage over the internet is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will take steps to contain it and will notify the Data Protection Board of India and affected individuals where required by law.

12. Your rights as a Data Principal

Subject to the DPDP Act and applicable rules, you have the right to:

• Access information: obtain a summary of the personal data we hold about you, the processing activities we carry out, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, with a description of the data shared.
• Correction, completion and updating: ask us to correct inaccurate or misleading data, complete incomplete data and update your data.
• Erasure: ask us to erase personal data that is no longer needed, unless we must keep it to comply with law.
• Withdraw consent at any time, as easily as you gave it.
• Grievance redressal: have your complaint about our handling of your personal data addressed by our Grievance Officer (see below).
• Nominate another individual who may exercise these rights on your behalf in the event of your death or incapacity.

Under the SPDI Rules you may also review the information you have provided to us and ask for any inaccurate or deficient information to be corrected.

If you are not satisfied with our response to a grievance, you may, after using our grievance process, file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act.

As a Data Principal you also have duties under the DPDP Act, including not providing false information and not filing frivolous complaints.

13. How to exercise your rights

To exercise any of these rights, email support@abhayahealthconsultants.com with the subject line “Privacy request”, or contact our Grievance Officer using the details below. Please tell us which right you wish to exercise and give enough information for us to identify you. We may need to verify your identity before acting on a request, and we will only use the verification information for that purpose.

We will acknowledge your request and respond within the time required by applicable law. Grievances under the SPDI Rules are addressed within one month of receipt.

14. Children’s personal data

This website and our services are intended for adults acting for hospitals, clinics and healthcare businesses. They are not directed at children (individuals under 18 years of age, as defined in the DPDP Act). We do not knowingly collect personal data of children through this website, and we do not track, behaviourally monitor or target advertising at children.

If you believe a child has provided personal data to us, please contact us and we will delete it. Where a service requires processing a child’s personal data (for example a dependant under a group insurance plan arranged by a client organization), we will do so only with verifiable consent of the parent or lawful guardian, or as otherwise permitted by law.

15. Cookies and similar technologies

This website itself does not set cookies and does not use analytics, advertising, tracking or social-media cookies. It does not use browser local storage to identify you. The fonts used on the website are hosted on our own server, so your browser does not contact third-party font services.

Our hosting provider’s network and security services may set strictly necessary technical cookies, for example to protect the website against automated attacks or to balance traffic. These are not used by us to identify you or to track you across other websites.

If we introduce analytics or other non-essential cookies in future, we will update this policy and, where required, ask for your consent first.

16. Third-party links

This website may contain links to other websites, such as social-media profiles. We are not responsible for the privacy practices or content of those websites. Please read their privacy policies before sharing personal data with them.

17. Transfer of data outside India

We aim to store and process personal data in India where practical. However, some of our service providers (for example hosting, email or communication services) may store or process data on servers located outside India. Any such transfer will be made in accordance with the DPDP Act, which permits transfers except to countries or territories restricted by the Central Government, and with reasonable safeguards to protect the data.

18. Marketing communications

We use your contact details to respond to your enquiry and about services you have requested. We will send you newsletters or promotional messages only if you have agreed to receive them. You can opt out at any time by replying “unsubscribe” or “stop” to the message, or by emailing support@abhayahealthconsultants.com. Promotional calls and SMS, where used, will follow the applicable telecom commercial communication regulations in India.

19. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law, in our services or in how the website works. The updated version will be posted on this page with a new “Last updated” date. If changes are significant, we will take reasonable steps to bring them to your attention, and where required we will ask for fresh consent.

20. Grievance Officer and contact

If you have any questions, requests or complaints about this Privacy Policy or about how we handle your personal data, please contact our Grievance Officer, designated under Rule 5(9) of the SPDI Rules and for the purposes of the DPDP Act:

Please mark your email “Privacy request” or “Grievance” so it reaches the right person quickly.