Privacy Policy

Our Commitment

[CENTOSA] ("Centosa", "we", "us", "our"), operating centosa.in, is committed to protecting the privacy and confidentiality of every person who uses this website or receives care from us.

We handle health information. We treat it with the seriousness that both medical ethics and Indian law demand.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have. It is issued in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act")
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• The Telemedicine Practice Guidelines, 2020
• Applicable professional confidentiality obligations under the regulations of the National Medical Council and the Rehabilitation Council of India

For the purposes of the DPDP Act, we act as the Data Fiduciary in respect of your personal data. You are the Data Principal.

Scope

This Policy applies to personal data collected through centosa.in, our appointment and teleconsultation systems, our online report access facility, and our electronic communications with you. It also describes how we handle clinical records generated at our facility.

It does not apply to third-party websites or platforms you may reach through links on our site.

Personal Data We Collect

3.1 Identity and Contact Data

Name, age, date of birth, sex, mobile number, email address, postal address, and, where clinically required, an identity document reference.

3.2 Health Data

This is the most sensitive category we handle. It may include:

• Presenting complaints, symptoms, duration and history
• Past medical, surgical, otological and audiological history
• Family history relevant to hearing, balance, speech or ENT conditions
• Current medications and allergies
• Otoscopic and endoscopic findings and images
• Audiological data — pure-tone and speech audiometry, tympanometry, acoustic reflexes, otoacoustic emissions, auditory brainstem response and other electrophysiology
• Vestibular data — videonystagmography, positional testing, posturography and related recordings
• Hearing aid and cochlear implant fitting data, programming records and device serial numbers
• Speech and language assessment findings and therapy progress notes
• Radiology and laboratory reports you share with us
• Photographs, audio or video recordings made for clinical documentation, with your consent

3.3 Appointment and Interaction Data

Booking history, appointment status, consultation notes, correspondence with our clinic, and feedback you provide.

3.4 Teleconsultation Data

Consultation date and time, mode of communication, consent record, clinical notes and any prescription issued. We do not routinely record video or audio of teleconsultations; where a recording is made for clinical or legal reasons, your explicit consent will be obtained first.

3.5 Technical Data

IP address, browser type and version, device type, operating system, referring URL, pages viewed, and date and time of access. This is collected automatically through server logs and cookies.

3.6 Data We Do Not Collect

How We Collect Data

• Directly from you — through website forms, teleconsultation, telephone, email, WhatsApp, or in person at our clinic
• From your parent, guardian or caregiver where they act on your behalf
• From referring doctors, hospitals or diagnostic centres, with your consent or where clinically necessary for your care
• Automatically — through cookies and server logs when you browse the website
• From devices used in your assessment or hearing-device fitting

Purposes for Which We Use Your Data

We use your personal data only for the following purposes:

We do not sell your personal data. We do not share your health data with advertisers. We do not use your health data for targeted advertising.

Lawful Basis for Processing

We process your personal data on the basis of:

1. Your consent, which is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action — such as submitting a form after reading the consent notice, or confirming consent at the start of a teleconsultation;
2. Certain legitimate uses recognised under Section 7 of the DPDP Act, including where you have voluntarily provided data for a specified purpose, and for responding to a medical emergency involving a threat to your life or immediate threat to your health, or where processing is necessary for the provision of medical treatment or health services during an epidemic or outbreak;
3. Compliance with law, where processing is required under any Indian statute, judgment or order.

You may withdraw your consent at any time (see Section 12).

Children's Data & Persons with Disabilities

A substantial part of our practice involves children — newborn hearing screening, paediatric audiology, speech and language therapy, and cochlear implantation.

• For any patient below 18 years of age, we process personal data only with the verifiable consent of a parent or lawful guardian.
• We will take reasonable steps to verify that the person giving consent is in fact the parent or lawful guardian, and that they are an identifiable adult.
• We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children.
• We do not process a child's data in any manner likely to cause a detrimental effect on the well-being of the child.
• For a person with a disability who has a lawful guardian, we process data only with the consent of that guardian, appointed under applicable law.

Where a young patient reaches the age of 18, we will, on request, transition consent and access rights to them directly.

Disclosure & Sharing

We share personal data only where necessary, and only with:

1. Our own clinical and administrative team — on a strict need-to-know basis, bound by confidentiality obligations.
2. Other healthcare providers — referring or treating doctors, hospitals, surgical teams, imaging centres and laboratories, where required for your continued care.
3. Hearing device manufacturers and service centres — limited to the data necessary for device selection, fitting, programming, repair or warranty processing.
4. Service providers (Data Processors) — website hosting, secure cloud storage, appointment and clinic-management software, video-consultation platforms, SMS and email service providers. These parties act only on our documented instructions under contractual obligations of confidentiality and security, and may not use your data for their own purposes.
5. Insurers or third-party administrators — only where you request or authorise a claim submission.
6. Legal and regulatory authorities — courts, police, medical councils or statutory bodies, where disclosure is required by law or by a valid legal process, or where disclosure is necessary to prevent serious harm.
7. Successors — in the event of a restructuring, merger or transfer of the practice, subject to the same protections continuing to apply.

We will not disclose your health information to family members, employers, schools or any other person without your consent, except where you lack capacity and disclosure is in your best interest, or where the law requires it.

Data Storage & Cross-Border Transfer

Your data is stored on servers located in [India / specify]. Some of our service providers may process limited data on infrastructure outside India. Where this occurs, we ensure that such transfers comply with the DPDP Act and any restrictions notified by the Central Government, and that appropriate contractual safeguards are in place.

Data Retention

We retain your data only for as long as necessary for the purposes described above, or as required by law:

• Outpatient and consultation records — retained for a minimum of 3 years from the date of the last entry, in accordance with professional record-keeping requirements
• Records relating to a medico-legal case or pending litigation — retained until final resolution and any applicable limitation period thereafter
• Paediatric records — retained for an extended period appropriate to the patient's age and condition, and in any event as required by law
• Cochlear implant and hearing device records — retained for the service life of the device and warranty period
• Website server logs — typically retained for [12] months

When retention is no longer required and no legal obligation applies, data is securely deleted or irreversibly anonymised.

Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

To exercise any right, write to us at [privacy@centosa.in] with sufficient detail to identify you and your request. We will respond within a reasonable period, and in any case within the timelines prescribed under applicable law.

You also have a duty under the DPDP Act not to furnish false particulars, impersonate another person, or file frivolous complaints.

Withdrawal of Consent

You may withdraw your consent at any time by writing to [privacy@centosa.in]. Withdrawal is as easy as giving consent.

Please note:

• Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before withdrawal.
• We may be legally obliged to retain existing clinical records even after withdrawal.
• Withdrawal may make it impossible for us to continue providing clinical care, teleconsultation or device support, and you accept the consequences of that.

Cookies & Tracking

We use cookies and similar technologies to:

• Keep the website functioning and secure (essential cookies)
• Remember your preferences (functional cookies)
• Understand aggregate usage patterns (analytics cookies)

Essential cookies are necessary for the site to work. You may control or delete other cookies through your browser settings; disabling them may affect certain features. We do not use cookies to build health-related advertising profiles.

Data Security

We implement reasonable security safeguards appropriate to the sensitivity of health data, including:

• Encryption of data in transit (HTTPS/TLS) and encryption at rest for stored records
• Role-based access control, so staff access only what their role requires
• Individual user accounts and strong password policies; multi-factor authentication where available
• Access logging and periodic review
• Physical security of the premises where records and equipment are held
• Regular backups and a documented recovery process
• Confidentiality undertakings from all staff and contractual security obligations on our service providers
• Periodic review of our security practices

However, no method of electronic transmission or storage is completely secure. While we take all reasonable measures, we cannot guarantee absolute security. You are responsible for protecting your own devices, email account and any access credentials or one-time passwords we send you.

Personal Data Breach

In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the manner and within the timelines prescribed under the DPDP Act and the rules made under it, along with a description of the breach and the steps you may take to protect yourself.

Third-Party Websites

Our website may link to third-party sites, including manufacturer pages, professional bodies and educational resources. We are not responsible for their privacy practices. Please read their policies before providing any information.

Marketing Communications

We may send you clinically relevant communications such as appointment reminders, follow-up recall notices and device service reminders. These are part of your care.

Any general newsletter or educational mailing will be sent only with your consent, and every such message will carry a clear unsubscribe option. We will never use your diagnosis or health status to target promotional content at you.

Changes to This Policy

We may update this Policy to reflect changes in our practices or in the law. The revised version will be posted here with a new "Last Updated" date. Where changes are material, we will make reasonable efforts to notify you directly. Please review this page periodically.

Contact Us

For questions, requests or complaints relating specifically to your personal data, please write to [privacy@centosa.in]. We will acknowledge your message and respond within a reasonable period.

If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India in accordance with the DPDP Act.