Privacy policy

Last updated — see version below · Notice version 2026-09-01

This notice explains what we collect about you, why, who we share it with and what you can ask us to do about it. It applies to this website, our mobile apps and the information we hold about you as a patient.

1. Who we are

GoodWell MultiSpecialist Hospital operates the hospitals listed on our hospitals page. For the purposes of the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

2. What we collect

We collect different things depending on how you interact with us.

When you use this website

Pages you visit and how you arrived — only if you allowed analytics cookies.
Your IP address and browser, recorded briefly in server logs for security.

When you submit an enquiry or book an appointment

Your name, mobile number, and email and city if you give them.
The hospital, speciality or doctor you asked about, and what you told us in the message.
The date, time and channel of your consent, and the version of this notice you saw.

When you are treated

Your date of birth, gender, address and, where relevant, blood group.
Clinical records — history, examination findings, diagnoses, prescriptions, test and imaging results, and operation notes.
Billing and insurance information.
Your ABHA number, if you choose to link one.

We do not ask for your card or UPI details on this website, and we never will. If a page claiming to be ours asks you for them, it is not ours — please report it.

3. Why we use it, and on what basis

To provide care. Diagnosis, treatment and follow-up. This is the core purpose and we cannot treat you without it.
To manage your appointment. Booking, reminders, rescheduling and cancellation.
To answer your enquiry. Only where you have ticked the box permitting us to contact you.
To bill and to process insurance claims.
To meet legal obligations. Clinical record retention, notifiable disease reporting, and responding to lawful orders.
For marketing. Health check offers and hospital updates — only where you have separately opted in, and never bundled with anything else.
For analytics. Understanding which pages people struggle with — only where you allowed analytics cookies, and never joined to your clinical record.

4. Consent, and how to withdraw it

Where we rely on your consent we ask for it separately for each purpose, unticked, with the purpose named. Consent to be contacted about an enquiry is not consent to receive marketing, and we do not treat it as such.

Withdrawing consent is as easy as giving it. Sign in and use Privacy & consents, or submit a request through Your data rights. Withdrawal takes effect going forward; it does not undo processing already carried out lawfully, and it does not delete clinical records we are required to keep.

5. Children and guardians

For a patient under 18 we process data only on the consent of a parent or lawful guardian, recorded against that guardian's account. We do not carry out behavioural tracking or targeted advertising directed at children, in any circumstances.

6. Who we share it with

Clinicians and staff involved in your care, on a need-to-know basis.
Diagnostic laboratories and imaging providers we refer your samples or scans to.
Your insurer or TPA, where you have asked us to process a cashless claim.
Processors acting on our instructions — hosting, SMS and email delivery, and payment processing at the hospital. They are bound by contract and may not use your data for their own purposes.
Government authorities, where the law requires it.

We do not sell your personal data. We do not share your clinical information with advertisers, and we do not use it to target advertising to you.

7. Where it is stored

Personal and clinical data is held in our cloud provider's Singapore (ap-southeast-1) region. Backups are held in the same region.

The DPDP Act permits transfers outside India except to countries the Central Government has restricted; Singapore is not currently restricted. Where a processor operates outside India we use them only on that basis and under contractual terms that bar them from using your data for their own purposes.

If this changes — including a move to an Indian region — we will update this notice and the date at the top of this page.

8. How long we keep it

Clinical records — retained for the periods required by the Clinical Establishments Act and the applicable medical records regulations. We cannot delete these on request while that obligation is in force.
Enquiries that do not become appointments — 24 months, then deleted.
Consent records — kept for as long as we hold the data they relate to, plus the limitation period, because they are the evidence of what you agreed to.
Job applications — 6 months.
Website analytics — 14 months.

9. Your rights

Under the DPDP Act you may ask us to:

Access a summary of the personal data we hold about you and who we have shared it with.
Correct anything inaccurate, and complete anything incomplete.
Erase data we no longer need — subject to the retention obligations in section 8.
Withdraw consent for any purpose that relies on it.
Nominate someone to exercise these rights if you die or become incapacitated.
Complain — to us first, and to the Data Protection Board of India if we do not resolve it.

Submit a request through Your data rights. We respond within 30 days. We will ask you to verify your identity first — this protects you from someone else obtaining your records.

10. Security

Access to clinical records is restricted by role and logged. Data is encrypted in transit and at rest. Staff access to patient records is auditable and audited. We will notify you and the Data Protection Board of a personal data breach as required by law.

No system is perfectly secure. If you find a vulnerability in this website, please report it to us rather than disclosing it publicly — we will not pursue anyone who reports a genuine issue in good faith.