Privacy Policy

Effective date: May 13, 2026
Last updated: May 13, 2026

1. Introduction — who we are

This Privacy Policy explains how Osteon Orthopedic Hospital (operated by Dr. Harshal V Kalambe Patil, MBBS, MS Orthopaedics; MCI Registration 12/45565), located at Ground Floor, Shree Ganesh Ace Arcade, Opp. Mirchandani Palms, Kokane Chowk, Pimple Saudagar, Pimpri-Chinchwad, Maharashtra 411027, India (the "Hospital", "we", "us" or "our"), handles personal data collected from visitors to www.drharshalorthopedic.com (the "Website") and from patients who consult with us in person or via telemedicine.

We are committed to handling your data lawfully, fairly and transparently in accordance with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the relevant rules made under them, and applicable guidelines of the Medical Council of India (MCI) / National Medical Commission (NMC).

2. Information we collect

Depending on how you interact with us, we may collect the following categories of information:

• Identification & contact details — name, age, gender, email address, phone number and postal address you share through our contact form, booking enquiries, WhatsApp messages or calls.
• Health information — medical history, symptoms, diagnoses, imaging reports, prescriptions and other clinical details that you share with us during in-person consultation, follow-up, or a telemedicine session.
• Appointment information — preferred date, time, reason for visit and emergency contact (if provided).
• Technical data — IP address, browser type, device type, operating system, referring URL and pages visited. This is collected automatically when you use the Website.
• Cookies and analytics data — see Section 8 below.

We do not knowingly collect any data we do not need for the purposes set out below.

3. How we use information

We use your personal data only for clearly defined, lawful purposes, including:

• Scheduling, confirming, rescheduling and reminding you about appointments.
• Providing in-person and telemedicine consultations, diagnosis and treatment.
• Maintaining medical records as required under MCI / NMC guidelines.
• Follow-up communication regarding your recovery, post-operative care, physiotherapy or repeat prescriptions.
• Responding to your enquiries or feedback.
• Improving the Website, our services and patient experience.
• Complying with legal, regulatory and tax obligations.

4. Legal basis for processing

Under the DPDP Act, we process your personal data on one or more of the following bases:

• Your consent, freely given at the time of submitting a form, booking an appointment, or undergoing a consultation.
• Legitimate use for medical care, including diagnosis, treatment and provision of health services, where processing is necessary for your care.
• Legal obligation, where we are required to retain or share information by law (for example, statutory medical record keeping or response to a lawful court order).

5. Data sharing

We treat your data confidentially. We do not sell, rent or trade your personal information. We may share information only in the following limited circumstances:

• With Third Party Administrators (TPAs), insurance companies or corporate health partners, only when you have requested cashless treatment, claim processing or reimbursement, and only with your explicit consent.
• With referring or referred physicians, diagnostic labs and hospitals, only to the extent needed for your continued care.
• With service providers (such as email, telemedicine platform, payment gateway and IT hosting providers) who act on our instructions under appropriate confidentiality obligations.
• With government, regulatory or law-enforcement authorities when we are legally compelled to do so.

6. Data retention

We retain medical records for a minimum of three (3) years from the date of the last consultation, in line with Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations. Records relating to medico-legal cases, ongoing treatment or specific statutory requirements are retained for longer where necessary. Once the retention period ends and there is no legal basis to keep your data, we securely delete or anonymise it.

7. Your rights under the DPDP Act

Subject to the DPDP Act and applicable medical-record obligations, you have the right to:

• Access the personal data we hold about you and obtain a summary.
• Correct data that is inaccurate, incomplete or out-of-date.
• Request erasure of personal data that is no longer required for the purposes for which it was collected, subject to any overriding legal duty to retain it.
• Withdraw consent at any time, where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• Nominate another individual to exercise these rights in the event of your death or incapacity.
• Grievance redressal — see Section 12.

To exercise any of these rights, please write to us using the contact details in Section 13. We may need to verify your identity before responding.

8. Cookies and website analytics

The Website uses a small number of cookies and similar technologies to remember your preferences, keep the site secure, and understand how it is used. We may use privacy-friendly analytics (such as Google Analytics) to measure aggregate, non-identifying traffic patterns. You can disable cookies in your browser settings; some parts of the Website may not work as expected if you do.

9. Data security measures

We follow reasonable security practices designed to protect personal data from unauthorised access, alteration, disclosure or destruction. These include access controls, role-based permissions, encrypted storage where appropriate, secure backups, staff training on confidentiality and a "need to know" basis for handling medical records. While no system is entirely secure, we take our responsibility to safeguard your data seriously, and we will notify you and the appropriate authorities of any significant personal data breach as required by law.

10. Children's privacy

The Website and our services are not intended for use by children under 18 without parental or legal-guardian involvement. We collect data relating to a child or a person with a disability only with the verifiable consent of a parent or lawful guardian, in accordance with the DPDP Act. We never engage in tracking, behavioural monitoring or targeted advertising directed at children.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our practices. When we make material changes, we will revise the "Last updated" date at the top of this page and, where appropriate, notify you directly. We encourage you to review this page periodically.

12. Grievance Officer

In line with Indian law, we have designated a Grievance Officer to address concerns about this Privacy Policy or our handling of your personal data:

• Name: Sagar — Grievance Officer, Osteon Orthopedic Hospital
• Hospital: Osteon Orthopedic Hospital
• Address: Ground Floor, Shree Ganesh Ace Arcade, Opp. Mirchandani Palms, Kokane Chowk, Pimple Saudagar, Pimpri-Chinchwad, Maharashtra 411027
• Email: osteonorthopedichospital@gmail.com
• Phone: +91 86258 71468

We aim to acknowledge grievances within a reasonable period and resolve them within the timelines set out under applicable law.

13. Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at osteonorthopedichospital@gmail.com or call +91 86258 71468 / . You can also reach us through our contact page.