Privacy Policy

Intelehealth Enterprise Privacy Policy

Your privacy is important to us. Intelehealth’s Enterprise Privacy Policy aligns with Generally Accepted Privacy Principles (GAPP). The GAPP are founded on key concepts from significant national and international privacy laws, regulations and good business practices.

In case of any privacy related complaints/grievances, please fill and submit this Privacy Complaint Form to privacy@intelehealth.io

Introduction

Intelehealth endeavours to meet leading standards for data protection and privacy. While our reasons are founded in ethical and corporate responsibility, our privacy practices as outlined in this policy enable the following:

  • Dignity for patients: Our work bringing primary healthcare to underserved communities in developing countries and humanitarian conflict zones means we must be mindful of upholding a standard of ethical caring, including patient privacy.

  • Competitive Advantage: Our emphasis on protecting the privacy of customers, vendors, and employees distinguishes us from competitors.

  • Good Corporate Citizenship: A sound privacy policy is emblematic of reliable corporate citizens that respect individuals’ privacy.

  • Business Enablement: Since Intelehealth uses significant volumes of personal information, privacy notices are a prerequisite to building enduring business relationships.

  • Legal Protection: Appropriate privacy notices offer an opportunity to eliminate allegations of unlawful usage of personal information, to limit liability for the conduct of third-party associates and to reserve the right to amend the Enterprise Privacy Policy.

Purpose

This Policy defines requirements to ensure compliance with laws and regulations applicable to Intelehealth’s collection, use, and transmission of Personal Data.

Scope

This policy is applicable to all Intelehealth employees, joint venture employees, contractors, vendors, interns, customers, end users and business partners who, as part of valid business operations, may receive personal information from Intelehealth, have access to personal information collected or processed by Intelehealth, or who provide information to Intelehealth.

This policy covers the treatment of personal information gathered and used by Intelehealth for lawful business purposes. This policy also covers the personal information we share with authorized Third Parties or that Third Parties share with us.

“Personal information” refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Sensitive personal information refers to personal information:

  • About an individual’s race, ethnic origin, colour, caste or tribal affiliation, marital status, age, and religious, philosophical or political affiliations;

  • About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings;

  • Issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, aadhar numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns;

Special categories of personal data, where Intelehealth operations are within the scope of European Union regulations or equivalent protections, are:

  • Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership

  • Genetic data, biometric data for the purpose of uniquely identifying a natural person

  • Data concerning health or data concerning a natural person’s sex life or sexual orientation.

Exceptions

This policy does not apply to the privacy practices of third parties whose operations we do not own or control, including but not limited to any third-party services facilitated by Intelehealth, or to any individuals we do not manage or employ, unless otherwise contractually agreed upon between the third party and Intelehealth.

Objective

The main objectives of the Enterprise Privacy Policy are:

  • To ensure that all of the personal data or personal information in Intelehealth’s custody is adequately protected against threats to maintain its security.

  • To ensure that Intelehealth’s employees & contractors are fully aware of the contractual, statutory or regulatory implications of any privacy breaches.

  • To limit the use of personal data or personal information to identified business purposes for which it is collected.

  • To create an awareness of privacy requirements to be an integral part of the day to day operation of every employee & contractor and ensure that all employees & contractors understand the importance of privacy practices and their responsibilities for maintaining privacy.

  • To make all the employees & contractors aware about the processes that need to be followed for collection, lawful usage, disclosure/ transfer and disposal of personal data or personal information.

  • To ensure that all third parties storing and processing personal information on behalf of Intelehealth provide adequate data protection.

  • To ensure that all applicable regulations and contracts regarding the maintenance of privacy and protection of personal data or personal information are adhered to.

    Policy

    1. MANAGEMENT

      1. Develop and maintain an Enterprise Privacy Policy that documents the privacy principles and practices followed by Intelehealth.

      2. The Enterprise Privacy Policy shall be communicated to Intelehealth’s internal personnel and any external personnel required to comply with the policy.

      3. Establish procedures for disciplinary and remedial action for violations of the Enterprise Privacy Policy. Refer Annexure D: Disciplinary guidelines

      4. Changes or updates to the Enterprise Privacy shall be communicated to Intelehealth’s internal personnel when the changes become effective.

      5. A Privacy Request procedure shall be defined to process complaints and requests for information related to Intelehealth’s privacy practices. Refer Annexure E.

    2. NOTICE

      1. Appropriate notice shall be provided at the time an individual is asked to give consent to the collection or processing of personal information and whenever personal information is collected.

      2. The Privacy Notice shall provide the following information:

        1. Purposes for which personal information is collected, used and disclosed;

        2. Choices available to the individual regarding collection, use and disclosure of personal information;

        3. That personal information shall only be collected for the identified purposes;

        4. Methods employed for collection of personal information, including ‘cookies’ and other tracking techniques, and third party agencies;

        5. That an individual’s personal information shall be disclosed to Third Parties only for identified lawful business purposes and with the consent of the individual;

        6. That an individual’s personal information may be transferred within Intelehealth’s entities for business purposes;

        7. Consequences of withholding or withdrawing consent to the collection, use and disclosure of personal information for identified purposes;

        8. Individuals are responsible for providing Intelehealth with accurate and complete personal information, and for contacting the entity if correction of such information is required;

        9. Process for an individual to access and update their personal information records;

        10. Process for an individual to register a complaint or grievance regarding privacy practices at Intelehealth;

        11. Process for an individual to withdraw consent for the collection, use and disclosure of their personal information for identified purposes; and

        12. That implicit or explicit consent is required to collect, use and disclose personal information, unless a law or regulation specifically requires or allows otherwise.

      3. Individuals shall be provided a Privacy Notice in case any new purpose is identified for using or disclosing personal information before such information is used for purposes not previously identified.

      4. The Notice shall be in language that is simple and easy to understand, especially for marginalized communities.

    3. CHOICE AND CONSENT

      1. Implicit or explicit consent shall be obtained from individuals at the time of collection of personal information or as soon as practicable thereafter.

        1. Explicit consent shall be obtained from individuals for the collection, use and disclosure of sensitive personal information, unless a law or regulation specifically requires or allows otherwise. A record is maintained of explicit consent obtained from individuals.

        2. Implicit consent shall be considered adequate for the collection, use and disclosure of personal information which does not qualify as sensitive personal information.

        3. Implicit consent shall be considered adequate to share sensitive information between health providers for treatment purposes. This allows doctors, nurses, hospitals, laboratory technicians, and other health care providers to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization. This includes sharing the information to consult with other providers, including providers who are not covered entities, to treat a patient, or to refer the patient.

      2. Consent shall be obtained from individuals before their personal information is used for purposes not previously identified.

      3. Appropriate consent shall be obtained from individuals before their personal information is transferred to or from information processing systems not owned or controlled by Intelehealth except in the cases mentioned above.

    4. COLLECTION OF PERSONAL INFORMATION

      1. The collection of personal information shall be limited to the minimum requirement for lawful business purposes

      2. Methods of collecting personal information shall be reviewed by management to ensure that personal information is obtained:

        1. Fairly, without intimidation or deception, and

        2. Lawfully, adhering to laws and regulations relating to the collection of personal information.

      3. Individuals shall be notified if additional information is developed or acquired about them.

      1. PERSONAL INFORMATION

      2. Health Workers will collect the following kinds of personal information from you for your medical records:

      3. Generic personal information such as name, age, address, phone number, gender, date of birth, demographic information

      4. Data concerning your health such as sign and symptoms, vitals, past medical history, family history

      5. Images.

      7. USE

        8. Your generic personal information and data concerning your health are used for diagnosing and treating you, to send you reminders, prescription information, and other related communication.
        Your images are being used for registration and identity verification, diagnosis and treatment purposes. For instance, where you have suffered an injury, Health Workers will collect images of the injury, so that adequate treatment can be prescribed.
        Your personal information will be anonymized for use in research, disease monitoring, and analysis to help us improve our products and services.

      8. LIMITING USE, DISCLOSURE, RETENTION AND DISPOSAL

        1. Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as permitted by law.

        2. An information inventory shall be maintained of all personal information collected, its mode of storage, period of retention and method of disposal, which is reviewed at least annually.

        3. Personal information retention shall be only for the duration necessary to fulfil the identified lawful business purposes or as prescribed by law.

        4. Personal information and health records shall be retained for a minimum of 6 years from the date of creation or the date the record was last in effect, unless otherwise prescribed by legislative agencies that require records to be retained for greater periods of time.

        5. Information may be stored in hard copy or electronic copy. The mode of storage will be determined based on the purpose for which data is collected and will be reviewed annually.

          1. Hard copy: physical representations of data, such as paper printouts. This includes, among other things, notes, memos, messages, correspondence, transaction records and reports.

          2. Electronic copy: information stored on electronic media, such as computer hard drives, copier and printer hard drives, cloud storage, removable solid drives including memory, disks and USB flash drives, mobile phones and magnetic tapes.

        6. Upon the expiration of identified lawful business purposes, Intelehealth shall either securely erase or anonymize the individuals’ personal information.

        7. When disposing of personal information by completely destroying the hard or electronic copy, including all back ups in such a way as to ensure that the information stored on it can never be recovered.

        8. Anonymization shall be carried out in such a way that the information cannot be used to identify an individual using the “Expert Determination” method. Intelehealth may determine that health information is not individually identifiable health information only if:

          1. A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

          2. Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and

          3. Documents the methods and results of the analysis that justify such determination;

      1. ACCESS FOR REVIEW AND UPDATE

        1. Processes shall be established for individuals to:

          1. Request access to their personal data or information;

          2. Correct or update their personal data or information; and

          3. Withdraw consent for the collection, use and disclosure of their personal information.

        2. The identity of individuals requesting access their personal information shall be reasonably verified before providing access to such information.

        3. A response shall be given individuals requesting access to their personal information in an accessible form, within a defined period from receipt of complaint/ request.

        4. Individuals shall be notified, in writing, the reason for any denial of requests for access to personal information. This notice will provide the source of Intelehealth’s legal right to deny access and the individual’s right to challenge such access as allowed or required by law.

      2. DISCLOSURE TO THIRD PARTIES AND OUTWARD TRANSFERS

        1. The disclosure of personal information to third parties shall be only for identified lawful business purposes and with appropriate consent from the individuals, unless a law or regulation specifically allows or requires otherwise.

        2. Management shall ensure that third parties storing or processing personal information on behalf of Intelehealth have:

          1. Signed agreements to protect personal information consistent with Intelehealth’s Enterprise Privacy Policy and information security practices;

          2. Signed non-disclosure agreements or confidentiality agreements; and

          3. Established procedures to meet the terms of their agreement with Intelehealth to protect personal information

        3. Personal information may be transferred outside the jurisdiction in which they were created or stored, for storage or processing where any of the following apply:

          1. The individual has given consent to the transfer of information

          2. The transfer is necessary for the performance of a contract between the individual and Intelehealth, or the implementation of pre-contractual measures taken in response to the individual’s request.

          3. The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between Intelehealth and a third party.

          4. The transfer is necessary or legally required on important public interest grounds or for the establishment, exercise or defence of legal claims.

          5. The transfer is required by law

          6. The transfer is necessary in order to protect the vital interests of the individual.

        4. Remedial action shall be taken in response to misuse or unauthorized disclosure of personal information by a third party storing or processing personal information on behalf of Intelehealth.

      3. SECURITY PRACTICES FOR PRIVACY

        1. Intelehealth’s information security policy and procedures shall be documented and implemented to ensure reasonable security for personal information collected, stored, used, transferred and disposed by Intelehealth, as required by law.

        2. Information asset labelling and handling guidelines shall include controls specific to the storage, retention and transfer of personal information.

        3. Management shall establish procedures that maintain the logical and physical security of personal information.

        4. Incident response protocols are established and maintained in order to deal with incidents concerning personal data or privacy practices. Refer: “Intelehealth Personal Data Breach Management Plan”

      4. QUALITY OF PERSONAL INFORMATION

        1. Intelehealth shall make best efforts to ensure that personal information collected is accurate and complete for the business purposes for which it is to be used.

        2. Intelehealth shall make best efforts to ensure that personal information collected is relevant to the business purposes for which it is to be used.

      5. PRIVACY MONITORING AND ENFORCEMENT

        1. Individuals can file a complaint/ grievance about Intelehealth’s privacy practices by submitting a filled Privacy Complaint Form (Annexure E) and sending it via mail (physical or electronic) to the Data Privacy Officer.

        2. All complaints/ grievances registered by individuals shall be recorded and responded to in a timely manner.

        3. The DPO shall conduct an investigation into the complaint and initiate corrective action to resolve it.

        4. Each complaint regarding privacy practices registered by individuals shall be validated, responses documented and communicated to the individual.

        5. Annual privacy compliance reviews shall be performed for identified business processes and their supporting applications.

        6. A record shall be maintained of non-compliances identified in the annual privacy reviews. Corrective and disciplinary measures shall be initiated and tracked to closure, guided by Intelehealth’s management.

        7. Procedures shall be established to monitor the effectiveness of controls for personal information and for ensuring corrective actions, as required.

        8. Privacy Impact Assessments shall be conducted annually, or when there are significant changes to the process or system environment. Refer: Privacy Impact Assessment Template.

        9. Any conflicts or disagreements relating to the requirements under this policy or associated privacy practices shall be referred to the Data Privacy Officer for resolution.