Privacy Policy

Introduction

Max Healthcare Institute Limited, including its affiliates and subsidiaries (hereinafter referred to as “MHIL”, “we”, “us”, or “our”), is committed to protecting the privacy, confidentiality and integrity of your personal data. We recognise that when you interact with us, whether through our website, mobile applications, or by accessing our medical services, you place your trust in us.

This Privacy Policy (“Policy”) applies to the collection, storage, processing, disclosure, and transfer of your personal data (defined below) that we may collect during your interactions with our website, https://www.maxathome.in or when such personal information is shared with MHIL for any purpose, transaction, or services (“Services”).

“You”, “Your”, “User”, or “Data Principal” refers to any individual who accesses, browses, or uses our website or services, including but not limited to patients, visitors, caregivers, job applicants, or legal representatives.

This Policy does not apply to third-party websites or services that may be linked through our platform. We strongly encourage you to review the privacy policies of such third-party websites, as we are not responsible for their data practices.

Note: This Privacy Policy does not constitute a legal, contractual, or fiduciary obligation between MHIL and any party and does not confer any enforceable rights on any individual or organization, unless otherwise required under applicable law.

Scope 

This Privacy Policy applies to all personal and non-personal data that we collect from:

• Individuals accessing or using our website or MHIL mobile applications
• Patients availing treatment or diagnostic services at MHIL
• Visitors, bystanders, dependents, or representatives interacting with our healthcare services
• Job applicants, employees, contractors, or service providers engaging with MHIL digitally or physically
• Users who submit enquiries, make payments, participate in surveys, or marketing initiatives
• Guardians, caregivers, autistic individuals, or persons with mental incapacity or those legally adjudged as such under applicable law

This Privacy Policy covers data collected through all digital platforms that MHIL owns or operates. This includes websites, patient portals, appointment tools, teleconsultation platforms, and electronic health record systems.

This Privacy Policy does not cover:

• Third-party websites or services linked from or accessible via MHIL’s platforms
• Information collected through non-affiliated entities that MHIL does not own or control
• Practices of third parties not governed or operated by MHIL, including but not limited to partner hospitals, labs, or insurance companies, unless data is shared under contractual obligation

Definitions

For the purposes of this Privacy Policy:

• “Data Principal” refers to any individual who accesses, browses, or uses our website or Services, including but not limited to patients, visitors, caregivers, job applicants, or legal representatives.
• “Personal Data / Personal Information” means any information relating to an identified or identifiable natural person, capable of identifying such a person either directly or indirectly. This includes but is not limited to name, contact information, identification details, health records, financial details, and government-issued documents.
• “Guardian” means a person legally authorized to act on behalf of a minor or an individual with mental incapacity, including those diagnosed with autism spectrum disorders or similar conditions.
• “Data Fiduciary” refers to MHIL, which determines the purpose and means of processing personal data, in compliance with the applicable law.
• “Data processor / Third Party” refers to any third party that processes personal data on behalf of MHIL under contractual agreement and confidentiality obligations (e.g., IT service providers, payment gateways, diagnostic labs).

Information we collect

MHIL collects data through its website and connected digital platforms for the purpose of providing medical care, delivering services, improving healthcare outcomes, and supporting outreach initiatives. Data may be collected directly from users or indirectly through interactions with third-party services.

The types of information we collect include:

Personal information

• Full name, date of birth, gender, and contact details (such as phone number, email address, and residential address), identification details (such as Aadhaar number, passport number, nationality number, driving licence and PAN card number), and bank details
• Health information, including medical history, current conditions, treatment details, and diagnostic reports
• Patient registration and admission data
• Details of guardians, bystanders, caregivers, or primary points of contact (where applicable)
• Financial and payment information related to services availed
• Responses and feedback provided during and after hospital visits or stays
• Information received through referrals and physician networks

Digital and non-personal information

• IP address, browser type, device information
• Cookies and tracking technology data collected through website usage, social media engagement, and online campaigns

Sources of collection

• Direct input through patient registration, admission forms, feedback surveys (during or after discharge), and health programs
• Digital platforms, including appointment bookings, website queries, and social media interactions
• Campaigns, workshops, community outreach initiatives, and health and wellness programmes
• Referrals and physician networks
• CRM systems and chatbots
• CCTV surveillance systems and related records
• Events such as workshops, community health initiatives, and marketing campaigns
• Third-party referrals and healthcare provider networks

Personal information of beneficiaries/dependents/other individuals

If you provide personal information relating to beneficiaries/dependents/other individuals to MHIL, you confirm that you:

• Have informed such individuals about this Privacy Policy, and any other applicable MHIL privacy notices
• Have ensured understanding and acceptance of this Privacy Policy by the individuals; and
• Have obtained approval from a legal guardian where the information relates to minors or individuals requiring such consent

Purpose for which we collect Your data

The personal data collected by MHIL is utilised to fulfil various purposes, including but not limited to:

• Delivering medical care, including diagnosis, treatment, follow-ups, and maintenance of patient health records
• Managing appointments, admissions, billing processes and payment transactions efficiently
• Facilitating communication with patients, guardians, and healthcare professionals regarding appointments, test results, health alerts, and treatment plans
• Conducting patient satisfaction surveys and collecting feedback to improve service quality
• Organising and managing health programmes, community outreach initiatives, workshops, and awareness campaigns, including targeted communications
• Documenting and processing personal data for clinical trials, publication of testimonials, and recording surgical procedures for training, academic research, and educational purposes
• Ensuring safety and security through CCTV surveillance across MHIL premises
• Sending promotional materials, newsletters, and information about upcoming services or events, through phone calls, SMS, WhatsApp, or email (where permitted under applicable law)
• Improving digital platforms by analysing usage data to optimise user experience and functionality
• Complying with legal or regulatory requests, including internal investigation, responding to subpoenas or government mandates

Sharing of information

At MHIL, we respect your privacy and are committed to protecting your personal data. We do not sell or rent your personal information under any circumstances. Your data is shared only for legitimate purposes, with appropriate safeguards in place to ensure confidentiality, integrity, and purpose limitation.

We may share your personal information in the following circumstances:

1. With healthcare providers

To ensure continuity and quality of medical care, we may share personal data with doctors, specialists, laboratories, and allied healthcare professionals directly involved in your diagnosis, treatment, and care.

2. With service providers and third-party vendors

We engage trusted partners to support operational and technical services. These partners are contractually bound by strict confidentiality obligations and are authorised to process only the minimum data necessary for their services.

Examples include:

• Medical professionals and diagnostic laboratories
• Payment gateway providers and banking partners
• IT service providers, software developers, and cloud storage vendors
• Patient communication and appointment management platforms
• Marketing and outreach partners
• Survey agencies or patient experience consultants

All vendors are subject to appropriate due diligence and contractual safeguards to maintain data confidentiality and security.

3. With regulatory or legal authorities

We may disclose personal data where required by applicable law or regulation, including:

• Local and central health authorities
• Law enforcement agencies
• Courts or quasi-judicial bodies
• Insurance and health regulators
• Public health or epidemic control authorities

Such disclosures are made strictly in accordance with legal requirements and internal review processes.

4. With auditors, legal advisors, and compliance officers

To meet statutory, regulatory, and internal governance requirements, personal data may be shared with:

• External and internal audit teams
• Legal advisors, claims handlers, and compliance teams
• Risk management and governance consultants

5. With investigators or risk consultants

In cases involving suspected fraud, medico-legal matters, disputes, or regulatory investigations, personal data may be shared for the purposes of detection, investigation, resolution, and verification of compliance.

6. To safeguard vital interests

In medical emergencies or life-threatening situations, we may share relevant information with:

• Emergency response services (such as ambulance providers)
• Referred hospitals or emergency care providers
• Family members or legal representatives

Such sharing is undertaken solely to protect your health, safety, or life.

7. For marketing and outreach

We may use and share limited personal information for:

• Health awareness campaigns
• Preventive care programmes
• Community outreach and educational initiatives

8. With business affiliates

In the event of a merger, acquisition, restructuring, or similar corporate transaction, personal data may be transferred to affiliated entities or their successors, subject to the implementation of appropriate data protection safeguards.

Data storage and processing

At MHIL, we retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required under applicable laws and regulations.

Your Data Rights and Account Deletion

To exercise your rights under applicable healthcare and statutory laws, including accessing or correcting your personal information, please contact our Data Protection Officer at DPO_Office@maxhealthcare.com.

Security Controls

At MHIL, we take the security and confidentiality of your personal data very seriously. To protect your information against unauthorised access, loss, misuse, or alteration, we have implemented a robust framework of technical, administrative, and physical safeguards.

We apply appropriate security measures and conduct periodic assessments to ensure the effectiveness of these controls. In the event of any security incident or data breach, necessary actions will be taken promptly in accordance with applicable laws and internal policies.

Changes to the Privacy Policy

MHIL reserves the right to modify or update this Privacy Policy at any time. In the event of significant changes, we will notify you through prominent notices on our website or through other communication channels. Please review this policy periodically to stay informed about how we protect and process your information.

Last Update Date - [This date shall correspond to the date on which this Privacy Policy is made live on the website]

Communication

MHIL may communicate with You using the contact information You provide, such as phone numbers, email addresses, or messaging platforms like WhatsApp. These communications may include:

• Appointment reminders, test results, treatment updates, and health alerts
• Information related to billing, payments, and insurance claims
• Invitations to participate in health programmes, workshops, surveys, and community events
• Promotional messages about hospital services, offers, or campaigns
• Important updates about hospital policies, changes in services, or emergency situations

Contact us

In case you require any further clarification regarding this Privacy Policy or wish to raise a query or concern, please contact us at:

Data Protection Officer – Mr. Kapil Madaan

DPO email: DPO_Office@maxhealthcare.com 

Generic email ID: DPO_Office@maxhealthcare.com 

Registered Office
Max Healthcare Institute Ltd.

401, 4th Floor, Man Excellenza, 

V. Road, Vile Parle (West),

Mumbai, Maharashtra - 400056