CSC Healthcare Privacy Policy

1   Purpose and Scope

This Privacy Policy explains how CSC Healthcare collects, uses, stores, shares, protects, retains and deletes personal data when an individual visits or uses the https://cschealthcare.in website, any other website, portal or mobile application owned or controlled by CSC Healthcare that links to this Policy, CSC Healthcare healthcare or diagnostic-service interfaces, voice and messaging platforms, marketing channels, customer-support channels, and other related digital or operational services (together, the Services). It also explains the choices and rights available to individuals whose personal data is processed through the Services.

This Policy may apply to website visitors, patients, customers, beneficiaries, healthcare professionals, diagnostic and facility personnel, blood donors or recipients where applicable, authorized business-customer users, organization representatives, referral contacts, event participants, support contacts and other individuals who interact with CSC Healthcare.

CSC Healthcare may receive personal data from a business customer in order to provide voice, messaging, technology, HMIS, diagnostic, healthcare or other contracted services on that customer’s behalf. Where CSC Healthcare processes personal data solely on the documented instructions of a business customer, that customer may be the relevant Data Fiduciary and its privacy notice will govern the purpose for which it collected the data. Rights requests concerning that processing may be redirected to the relevant business customer.

A privacy policy is not itself a blanket consent. Where consent is required, CSC Healthcare will request consent through a clear affirmative action for the specific purpose and personal data involved. This Policy should be read together with applicable Terms of Use, service-specific notices, patient forms, business contracts, employment or organizational policies and notices shown at the point of collection.

2   Identity of the Data Fiduciary and Service Roles

CSC Healthcare’s public website describes CSC Healthcare as an extended healthcare division of CSC e-Governance Services India Limited. Before publication, the entity responsible for each website, application, diagnostic programme, HMIS deployment, healthcare service, marketing activity and business-customer contract must be identified in the applicable service notice or terms.

Depending on the service and relationship, CSC Healthcare may act as: (a) a Data Fiduciary that determines the purpose and means of processing; (b) a Data Processor or service provider acting on documented instructions from a business customer, hospital, diagnostic centre, clinic, government department or other authorized organization; or (c) a joint or independent Data Fiduciary with another organization where the parties independently determine purposes of processing. Where another organization controls the processing, CSC Healthcare may forward a rights request to that organization or direct the requester to it.

3   Applicable Legal Framework

This Policy is intended to support compliance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as applicable and brought into force from time to time. The Information Technology Act, 2000 and rules made under it, and applicable healthcare, diagnostic, telemedicine, clinical-record, laboratory, blood-bank, consumer, taxation, accounting, payment, employment, government-contract and other legal requirements may also apply.

If another applicable law, government direction, contract or sector-specific requirement provides a higher standard of protection, prescribes data localization, or requires longer retention for a particular record, that requirement will prevail for that record.

3.1   Key DPDP terminology and service roles

For this Policy, personal data means data about an identifiable individual. A Data Principal is the individual to whom personal data relates and includes a parent or lawful guardian acting for a child or a person with disability where applicable. A Data Fiduciary determines the purpose and means of processing. A Data Processor processes personal data on behalf of a Data Fiduciary. A Consent Manager is a person registered with the Data Protection Board of India that enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.

4   Personal Data We Collect

4.1   Identity, profile and account information

• name, gender, date of birth, age and photograph, where required for a service;
• mobile number, email address, postal address and preferred communication details;
• patient, beneficiary, customer, donor, facility, employee, business-customer or other unique identifier;
• username, authentication status, account role, permissions, login and session information;
• employer, company, professional title, department, clinic, laboratory, wellness centre, facility or work-location details; and
• identity-verification information where required for account security, healthcare delivery, legal compliance or a government programme.

4.2   Health, diagnostic and healthcare-service information

Where a healthcare, diagnostic, preventive-screening, wellness-centre, Doctor on Call, blood-bank, HMIS, mobile-medical-unit, telemedicine or related service is enabled or delivered, CSC Healthcare may process:

• patient registration, demographics, service eligibility and appointment information;
• symptoms, health conditions, medical history, allergies, medicines, vital signs and other information provided for care or screening;
• consultation details, prescriptions, referrals, care instructions and healthcare-provider information;
• test orders, samples, barcodes, collection details, laboratory or imaging results and diagnostic reports;
• blood-donation, donor, recipient or blood-bank information where the applicable service requires it;
• HMIS, EMR, EHR, clinical-document, insurance, claim, billing and service-status information;
• records from connected medical devices, wearables or remote-care systems where the individual or responsible organization has authorized the connection; and
• communications, complaints, grievances, support records and service feedback.

CSC Healthcare treats health and diagnostic information as confidential and applies access restrictions appropriate to its sensitivity, clinical purpose and applicable legal requirements. The exact categories collected depend on the Service used and should be described in the applicable collection notice.

4.3   Business-customer and organization information

• organization name, address, registration details, sector, contact information and authorized representatives;
• business-user names, job titles, work email addresses, telephone numbers, credentials, roles and permissions;
• service configuration, customer-support, implementation, training, billing and contract-administration records;
• voice, message, routing, delivery, support and platform-usage records processed for a business customer, subject to the customer’s instructions and contract; and
• information received from government departments, hospitals, clinics, diagnostic centres, nursing homes, teaching institutions or other partners for an authorized service.

4.4   Communications, referrals, social media and public-source information

• enquiries, feedback, correspondence, call or message records and support requests;
• event or programme registration and participation information;
• referral contact information where the referring user confirms that they have authority to provide it;
• information received through CSC Healthcare social-media pages, subject also to the platform provider’s privacy policy; and
• information received from authorized marketing partners, business partners, public sources or data providers, subject to applicable law and contracts.

4.5   Payment and transaction information

Where payment is enabled, CSC Healthcare may process order or invoice references, amount, payment method, transaction identifier, payment status, refund status, reconciliation information and limited payment metadata. Approved payment gateways or financial institutions may process card, bank, UPI or wallet credentials under their own terms and privacy notices. CSC Healthcare does not intentionally store complete card numbers, CVV, PIN or banking authentication credentials in its application databases.

4.6   Location information

Where an enabled service requires location—for example, locating a wellness centre, providing a mobile medical or home service, validating an authorized field activity, mapping a service point, or supporting safety and fraud prevention—CSC Healthcare may collect approximate or precise location after providing the required notice and obtaining device permission or other lawful authorization. Precise location will not be used for unrelated advertising.

4.7   Device, usage, cookies and technical information

• Internet Protocol address, device model, manufacturer, operating system, browser type, language and screen characteristics;
• application version, device identifiers, advertising identifiers where permitted, network and connectivity information;
• login time, access time, pages or screens viewed, navigation path, feature usage, referring or exit page and duration of access;
• cookies, browser storage, pixels, web beacons, software-development kits and similar technologies used for security, session continuity, preferences, analytics or advertising where permitted;
• security, audit, synchronization, diagnostic, crash, delivery and error logs; and
• permission status for location, camera, photos, microphone, notifications, contacts or storage, where a feature requires it.

4.8   Information concerning another person

If a user provides personal data about a patient, dependent, employee, referral contact, donor, caregiver or another individual, the user must have lawful authority to do so and must provide any required notice or obtain any required consent. CSC Healthcare may verify that authority where appropriate.

5   How We Collect Personal Data

CSC Healthcare may collect personal data directly from the individual through websites, portals, applications, registration, appointment, consultation, screening, diagnostic, sample, report, payment, enquiry, marketing, event and support workflows; from an authorized business customer, employer, government department or programme; from healthcare professionals, laboratories, hospitals, clinics, wellness centres, blood banks or other service providers; from connected systems and medical devices; from payment, messaging and communication providers; from social-media platforms; and automatically through cookies, device permissions and system logs.

Where personal data is obtained from another organization, CSC Healthcare expects that organization to have lawful authority to provide it and to comply with applicable notice, consent and data-accuracy requirements. CSC Healthcare’s use of business-customer data is restricted by the relevant contract and documented instructions.

6   Purposes of Processing

CSC Healthcare processes personal data only for identified and lawful purposes, including:

• creating and administering website, patient, beneficiary, business-user, professional or facility accounts;
• authenticating users, securing sessions and enforcing role-based access controls;
• responding to enquiries and providing information about CSC Healthcare services, programmes and events;
• providing or supporting diagnostic, preventive-screening, wellness, telemedicine, Doctor on Call, HMIS, blood-bank, mobile-medical-unit and other authorized healthcare services;
• managing appointments, consultations, test orders, samples, reports, prescriptions, referrals, follow-up and service delivery;
• providing voice, messaging, technology, routing, platform or operational services on behalf of a business customer;
• processing payments, issuing invoices or receipts, managing refunds and performing reconciliation;
• communicating confirmations, reminders, service updates, report availability, security alerts, administrative messages and support responses;
• conducting quality assurance, audit, accreditation support, complaint handling, fraud prevention and security monitoring;
• complying with applicable law, court orders, government directions, public-health obligations, contracts and regulatory requirements;
• maintaining business, financial, clinical, diagnostic, security and operational records;
• improving the reliability, accessibility, safety and performance of the Services; and
• conducting research, statistical analysis, service evaluation or programme reporting using anonymized or aggregated information that does not identify an individual, or using identifiable data only under an appropriate lawful basis and approval.

7   Lawful Grounds, Privacy Notices and Consent

CSC Healthcare processes personal data on the basis of consent or another lawful ground available under applicable law, including certain legitimate uses. Depending on the circumstances, processing may be necessary to provide a service requested by the individual, carry out an authorized business-customer or government function, comply with law, respond to a medical emergency or public-health threat, fulfil an employment-related purpose or protect against fraud and security threats.

7.1   Privacy notice

At or before seeking consent, CSC Healthcare will provide a clear and independently understandable notice describing the personal data proposed to be processed, each specified purpose, how the individual may exercise rights, how consent may be withdrawn, and how a grievance may be submitted. Where required, the notice will be available in English or an applicable language specified in the Eighth Schedule to the Constitution of India. Service-specific notices shown at registration, appointment booking, diagnostic collection, report access, payment, location activation, voice or messaging activation, or another collection point form part of this Policy.

7.2   Consent and withdrawal

Where consent is used, the request will be presented in clear and plain language and will identify the personal data and purpose. Consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. Optional purposes, such as promotional communication, optional profile images, non-essential cookies or advertising, will not be bundled with consent required to provide the core service.

An individual may withdraw consent using the same or a comparably easy method through an account or application control, unsubscribe facility, reply mechanism where supported, Consent Manager where used, or the privacy contact in Section 22. Withdrawal does not affect processing lawfully performed before withdrawal. CSC Healthcare and its processors will cease consent-based processing within a reasonable period unless continued processing is required or authorized by law. Withdrawal may prevent CSC Healthcare from continuing a feature or service that cannot operate without the relevant data.

7.3   Certain legitimate uses

Where permitted by the DPDP Act, CSC Healthcare may process personal data for certain legitimate uses without relying on consent, including processing voluntarily provided for a specified purpose where the individual has not indicated refusal, responding to a medical emergency or public-health threat, complying with a legal obligation or court order, safeguarding an employer from loss or liability, or carrying out an employment-related function. CSC Healthcare will apply only the legitimate use relevant to the circumstances and will not rely on it to avoid consent where consent is required.

7.4   Business-customer instructed processing

Where CSC Healthcare acts as a Data Processor, the business customer is responsible for establishing the lawful basis, providing the required notice, responding to Data Principal requests and issuing lawful instructions. CSC Healthcare will process the data only for the contracted service, apply appropriate safeguards, assist the business customer as agreed and avoid using the data for unrelated independent purposes.

7.5   Consent records and Consent Managers

A Data Principal may, where available, manage consent through a registered Consent Manager. CSC Healthcare will maintain appropriate records of the notice presented, consent or other lawful basis relied upon, material changes, and withdrawal or opt-out requests for the period needed to demonstrate compliance and resolve disputes.

8   Marketing, Advertising and Communications

CSC Healthcare may send information about its services, programmes, events or publications where permitted by law and, where required, after obtaining opt-in consent. Individuals may withdraw marketing consent through the unsubscribe link, account preferences, reply instructions where supported, or the contact details in Section 22. Service, security, transactional, healthcare, appointment, report and administrative communications may continue where necessary to provide the requested service or comply with law.

CSC Healthcare does not sell personal data. It will not disclose health or diagnostic information to advertisers for targeted advertising. Where advertising or social-media technologies are used on a public website, CSC Healthcare will apply the required cookie or consent choice and will not use those technologies to infer or target individuals based on health information unless expressly permitted by law and specifically disclosed.

Mobile-number opt-in data and consent collected for text-message communications will not be shared with third parties or affiliates for their independent marketing or promotional purposes. A user may opt out of marketing text messages by replying STOP where supported or by contacting info@cschealthcare.in. Service-related text messages may continue where necessary and permitted.

9   Cookies, Similar Technologies and Mobile Permissions

CSC Healthcare websites may use essential cookies and similar technologies for authentication, session continuity, security, load balancing and preferences. With the appropriate consent where required, CSC Healthcare and its service providers may also use analytics, measurement or advertising technologies to understand website use and improve communications. Cookie choices may be managed through an available consent banner or browser settings. Blocking cookies may affect login or other functionality.

Where CSC Healthcare offers a mobile application or an enabled device feature, it may request location, camera, photo, microphone, contact, notification or storage permission only where required for the selected function. Permission may be managed through device settings. Disabling a required permission may prevent the relevant function from operating. The exact permissions and third-party SDKs used in each deployed application must be confirmed before publication.

10   Sharing and Disclosure

CSC Healthcare may share personal data only to the extent necessary for an identified and lawful purpose with:

• authorized affiliates or related companies providing shared services under appropriate controls;
• the relevant business customer, employer, hospital, clinic, diagnostic centre, government department, programme owner or other organization for which CSC Healthcare provides the service;
• authorized healthcare professionals, laboratories, imaging centres, wellness centres, hospitals, blood banks, pharmacies, ambulance providers and other care or service partners;
• technology, hosting, cloud, voice, messaging, email, analytics, security, payment, customer-support, application-maintenance and database-management providers;
• business partners where an approved integration or jointly delivered service requires the information;
• auditors, lawyers, bankers, insurers, accreditation bodies, quality-assurance bodies and other professional advisers with a lawful need;
• a successor or prospective successor in connection with a merger, acquisition, reorganization, divestiture, financing, insolvency or transfer of assets, subject to applicable notice and protection requirements; and
• courts, regulators, law-enforcement agencies, public-health authorities and other government bodies where required or permitted by law.

CSC Healthcare will use contractual, technical and organizational measures appropriate to the nature of the processing. Access will be limited to authorized personnel with a legitimate business, clinical, legal, regulatory or operational need. A current list of relevant sub-processors and the nature of their processing may be requested at info@cschealthcare.in, subject to confidentiality and security limitations.

Independent healthcare providers, laboratories, hospitals, blood banks, payment providers or other partners may separately determine how they process information for their professional, clinical, regulatory or service-delivery obligations. In that role, they are responsible for their own privacy notices, lawful basis, record-retention obligations and response to rights requests.

11   Information Security

CSC Healthcare uses reasonable technical, organizational and physical safeguards appropriate to the nature, volume, context and risk of the personal data processed. These may include encryption or equivalent protection, secure transmission, role-based and least-privilege access, controlled authentication, logging and monitoring, secure backups, network and endpoint controls, vulnerability and patch management, segregation of duties, incident-response procedures, employee confidentiality requirements, processor due diligence, training and periodic security review.

No service can guarantee absolute security. Users must keep passwords and one-time passwords confidential, use approved devices, avoid sharing accounts and promptly report suspected unauthorized access, device loss, phishing, account compromise or unusual activity. Email and text messages may not be suitable for sending highly sensitive information unless CSC Healthcare provides an approved secure channel.

12   Personal Data Breach Management

CSC Healthcare will investigate, contain, document and remediate a suspected personal data breach. Where applicable DPDP provisions are in force, CSC Healthcare will notify each affected Data Principal without delay in clear and plain language and will notify the Data Protection Board of India without delay, with additional prescribed information within the applicable period, including seventy-two hours where that timeline applies or within an extension allowed by the Board.

A notification may describe the nature and extent of the breach, likely consequences, measures taken or proposed, recommended protective steps and contact details for assistance. CSC Healthcare will preserve relevant records, cooperate with competent authorities and require involved Data Processors to support investigation and remediation.

13   Data Accuracy

CSC Healthcare takes reasonable steps to keep personal data complete, accurate and consistent where it is likely to be used to make a decision affecting an individual or disclosed to another Data Fiduciary. Individuals, business customers and authorized organizations are responsible for providing authentic and current information and should promptly request correction of inaccurate details. Corrections to finalized clinical, diagnostic, financial, audit or government-programme records will be handled through controlled procedures that preserve traceability.

14   Data Retention and Erasure

CSC Healthcare retains personal data only for as long as necessary to fulfil the specified purpose or comply with legal, clinical, diagnostic, accreditation, public-health, contractual, tax, accounting, employment, audit, security and dispute-resolution obligations. Retention periods vary by Service, record type and the organization for which CSC Healthcare processes the data.

When the specified purpose is no longer served, consent is withdrawn, or a valid erasure request is accepted, CSC Healthcare will erase or anonymize the relevant personal data and instruct its Data Processors to do the same, unless retention is necessary for the specified purpose or required by law. Backup copies may remain until overwritten under the controlled backup cycle. Records subject to legal hold, investigation, audit or claim will not be deleted until the hold is released.

15   Cross-Border Processing

Personal data may be processed outside the individual’s state or country where approved service providers operate. CSC Healthcare will comply with restrictions notified by the Government of India and with any applicable sector-specific localization requirement. Appropriate contractual, technical and organizational safeguards will be applied. The actual hosting locations, remote-support access and cross-border arrangements for each Service must be confirmed before publication.

16   Children, Minors and Dependents

General business and marketing areas of the Services are not directed to children. However, healthcare, diagnostic, screening or dependent services may involve a person under 18 years of age. Before processing a child’s personal data on the basis of consent, CSC Healthcare will take reasonable steps to obtain verifiable consent from a parent or lawful guardian and verify the adult’s identity and authority as required by law.

CSC Healthcare will not knowingly undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, in a manner prohibited by applicable law. A parent or guardian who believes that a child’s information has been provided without proper authority should contact CSC Healthcare so that the matter can be reviewed and appropriate action taken, subject to legal and medical-record obligations.

17   Rights of Data Principals

Subject to applicable law, exemptions and identity verification, a Data Principal may request:

• a summary of personal data being processed and the processing activities;
• the identities of Data Fiduciaries and Data Processors with whom the personal data has been shared, subject to lawful exceptions;
• correction of inaccurate or misleading personal data;
• completion of incomplete personal data and updating of personal data;
• erasure of personal data that is no longer required, subject to lawful retention;
• withdrawal of consent where consent is the basis of processing;
• grievance redressal concerning processing or exercise of rights; and
• nomination of another individual to exercise applicable rights in the event of death or incapacity.

Other rights may be available under another applicable law. CSC Healthcare may request information reasonably necessary to verify the identity and authority of the requester. CSC Healthcare will not disclose information that would adversely affect another person’s rights, compromise security, reveal confidential business-customer information or conflict with law.

18   How to Exercise Rights and Delete an Account

A user may submit a rights, consent-withdrawal or account-deletion request through an available account or support feature, the approved request form, the website Contact page, or by emailing info@cschealthcare.in. If CSC Healthcare processes the personal data solely for a business customer, hospital, government department or other organization, CSC Healthcare may forward the request to that organization or ask the requester to contact it directly.

Account deletion or deactivation may remove access to the Services but does not require deletion of records that CSC Healthcare or an authorized organization must retain for healthcare, diagnostic, legal, tax, security, quality, government-programme, contractual or audit purposes. CSC Healthcare will explain any applicable limitation where permitted. The source policy refers to an online deletion request form; the final publication must include the approved form link.

19   User Choices and Communication Preferences

• Account information: a registered user may review or update permitted profile information through the account where available.
• Marketing email: a recipient may use the unsubscribe facility or contact info@cschealthcare.in. Service-related messages may continue.
• Text messages: a recipient may reply STOP where supported or contact CSC Healthcare. Carrier charges may apply and delivery may depend on the mobile network.
• Cookies and advertising: a user may manage cookie choices through the website banner or browser settings and may use available platform controls for advertising identifiers.
• Location and mobile permissions: a user may manage permissions through device settings, although disabling a required permission may affect the relevant service.
• Referrals: a user should provide another person’s contact details only with that person’s permission or other lawful authority.

20   Duties of Users and Data Principals

Users and Data Principals must comply with applicable law, must not impersonate another person, must not suppress material information when providing official identity, clinical or address details, must not submit false or frivolous grievances, and must provide verifiably authentic information when requesting correction or erasure. Users must not upload, refer or disclose another person’s information without lawful authority and must follow applicable healthcare, security and account-use instructions.

21   Third-Party Websites, Social Media and Independent Services

The Services may contain links to independent websites, social-media platforms, payment gateways, laboratories, hospitals, healthcare professionals or other third-party services. Their processing is governed by their own privacy notices where they act independently. CSC Healthcare does not control and is not responsible for an independent third party’s privacy practices. Users should review the relevant privacy notice before submitting personal data to an external service.

22   Grievance Redressal and Contact Details

Privacy questions, rights requests, consent-withdrawal requests, account-deletion requests, security concerns and grievances may be submitted using the contact details below. CSC Healthcare will acknowledge and resolve grievances within its published grievance period and the applicable statutory period, which will not exceed ninety days where the Digital Personal Data Protection Rules apply.

A Data Principal should first use CSC Healthcare’s grievance-redressal mechanism. If the grievance is not resolved satisfactorily after the available redressal process is exhausted, the Data Principal may make a complaint to the Data Protection Board of India in the manner permitted by applicable law.

23   Changes to This Policy

CSC Healthcare may update this Policy to reflect changes in law, technology, services, security practices or processing activities. The revised Policy will display its effective date and last-updated date. Where a material change affects the purpose of processing or an individual’s rights, CSC Healthcare will provide an appropriate notice through the website, application, email, SMS, business customer or other suitable channel and will obtain fresh consent where required.

24   Governing Law

This Policy is governed by the laws of India. Any complaint or dispute remains subject to statutory rights and remedies available under applicable data-protection, consumer, healthcare and other laws. Subject to such mandatory rights and applicable dispute-resolution provisions, courts of competent jurisdiction at the location confirmed below will have jurisdiction.