Privacy Policy - Jagruti Rehabilitation Centre

1. Who we are and what this policy covers

This policy explains how JAGRUTII REHAB CENTRE PRIVATE LIMITED ("Jagruti", "we", "us"), CIN U86100PN2021PTC203011, with its registered office at S No. 29/2B/1, Zagde Wasti, Near Draksha Sanshodhan Kendra, Manjari Bk, Pune 412307, Maharashtra, India, collects, uses, shares and protects your personal information.

It applies to information we receive through:

• our website, https://www.jagrutirehab.org, and its forms;
• phone calls, WhatsApp, email and SMS;
• our advertisements on Google, Meta (Facebook and Instagram) and other platforms;
• enquiries, assessments and admissions at any of our centres;
• job applications.

It covers all Jagruti centres and programmes, including Raha, our child and adolescent programme. Our sister brands, Aroha and Olive Elder Care, publish their own privacy policies.

Clinical records created during treatment are also governed by medical confidentiality obligations, including the Mental Healthcare Act, 2017. Where those obligations are stricter than this policy, they apply.

2. Laws this policy follows

This policy is published under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), framed under Section 43A of the Information Technology Act, 2000.

We are also preparing for the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. As their provisions come into force, we will update this policy, and your rights under that law will apply in addition to those described here.

3. Information we collect

We collect only what we need to respond to you and provide care. Health information is "sensitive personal data or information" under Rule 3 of the SPDI Rules, and we handle it with the highest level of protection.

Please avoid sharing detailed medical information in website forms. Our team will collect what is clinically needed through a confidential call or consultation.

4. How we collect it

• Directly from you: when you fill a website form, call us, message us on WhatsApp, email us, apply for a job, or visit a centre.
• From family members or representatives: when someone seeks care on behalf of a patient. If you share another person's information, please make sure you are entitled to do so.
• From advertising platforms: when you submit a lead form on Google or Meta, or start a WhatsApp chat from one of our ads.
• From referring doctors and hospitals: when a clinician refers a patient to us.
• Automatically: through cookies, pixels and similar technologies on our website (see Section 7).

5. Why we use your information

We use your information only for the purposes below, and not for any unrelated purpose without asking you first.

• Responding to your enquiry and calling you back about treatment options.
• Assessing, admitting and treating patients, and coordinating care with our clinicians.
• Scheduling appointments, sending reminders and sharing information you asked for.
• Billing, insurance and payment processing.
• Evaluating job applications.
• Measuring and improving our website and advertising, using the technologies described in Section 7.
• Sending updates about our services, only if you have opted in. You can opt out at any time.
• Meeting legal and regulatory obligations, and protecting the safety of patients, staff and others.

We do not sell your personal information.

6. Consent and withdrawing it

We ask for your consent before collecting sensitive personal data, as Rule 5 of the SPDI Rules requires. On our website, this is the consent checkbox on each form; at our centres, it is the consent form signed at assessment or admission.

You may choose not to give us information. If you do, we may be unable to respond to your enquiry or provide treatment.

You can withdraw your consent at any time by writing to our Grievance Officer (Section 17). Withdrawal stops future use, but does not affect processing already done, or records we must keep by law. Withdrawing consent for clinical data may mean we cannot continue treatment safely, and we will explain this to you.

7. Cookies, analytics and advertising technologies

We use essential cookies to keep the website working. We also use analytics and advertising technologies to understand how the website is used and to measure whether our advertising leads to enquiries.

You can block or delete cookies in your browser settings at any time, and opt out of personalised ads through your Google and Meta account settings. Blocking essential cookies may affect how the website works.

We are introducing a cookie consent tool that will let you choose which analytics and advertising technologies run on your device. We will update this section when it is live.

8. Who we share your information with

We share information only with the service providers below, only for the purposes in Section 5, and under contracts that require them to keep it confidential and secure.

We also share information:

• among Jagruti centres and clinicians involved in your care;
• with your nominated representative or guardian, as permitted by law;
• with government agencies or courts when required by law, without your consent where Rule 6 of the SPDI Rules allows;
• in an emergency, to protect someone's life or safety;
• with a successor entity if our business is merged or transferred, under the same protections.

9. Transfers outside India

Some of our service providers, including HubSpot, Google, Meta and Microsoft, may store or process data on servers outside India. We transfer data only to providers that maintain security standards at least equal to those required under Indian law, as Rule 7 of the SPDI Rules requires, and only where needed for the purposes in this policy. We will follow any restrictions the Government of India notifies under the Digital Personal Data Protection Act, 2023.

10. How we protect your information

We follow reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, appropriate to the sensitive nature of the health information we hold. These are set out in our internal information security policy, which governs access control and the handling of personal data, and which we review whenever we make significant changes to our systems.

Our safeguards include:

• Encryption: all data sent to and from our website is encrypted in transit using HTTPS, enforced site-wide through HTTP Strict Transport Security (HSTS). Personal and sensitive personal data stored in our systems is encrypted at rest.
• Restricted access: only authorised staff can access systems holding personal data, on a need-to-know basis, through individual user accounts protected by two-factor authentication.
• Secure hosting: our systems are hosted with established cloud service providers that maintain their own physical and network security controls.
• Service provider obligations: third parties who process data on our behalf are contractually bound to keep it confidential and maintain comparable security standards.
• Logging and monitoring: we maintain system and access logs, retain them as required by law, and review them periodically.
• Incident response: if a security incident affects personal data, we will report it to the Indian Computer Emergency Response Team (CERT-In) as required by law and notify affected individuals where required.

No method of transmission or storage is completely secure. If you believe your information has been compromised, please contact our Grievance Officer immediately (see Section 17).

11. How long we keep it

We keep information only as long as needed for the purpose it was collected, or as long as the law requires.

When the period ends, we delete or anonymise the information.

12. Your rights

You can exercise these rights free of charge by writing to our Grievance Officer (Section 17):

• Access: ask what information we hold about you and how it is used.
• Correction: ask us to correct or complete inaccurate information.
• Erasure: ask us to delete information we no longer need, subject to records we must keep by law.
• Withdraw consent: as described in Section 6.
• Stop marketing: opt out of calls, messages or emails about our services.
• Nominate a representative: name someone to exercise your rights if you are unable to.
• Complain: raise a grievance with us, and, once it is operational for your complaint, with the Data Protection Board of India.

We may ask you to verify your identity before acting on a request. We will respond within one month.

13. Children and persons who cannot consent for themselves

We treat anyone under 18 as a child. Through Raha and our other programmes, we collect a child's information only with the consent of a parent or lawful guardian, and we verify that relationship at assessment or admission.

Children should not submit information through our website themselves. If you believe a child has done so, contact our Grievance Officer and we will delete it.

For adults who cannot give informed consent, we act with their nominated representative or lawful guardian, as provided under the Mental Healthcare Act, 2017 and other applicable law.

We do not knowingly target children with advertising or build advertising profiles of them.

14. Testimonials and case studies

Testimonials on our website are reviews posted publicly by their authors on Google and other review platforms. We do not add any further personal details to them. Case studies are illustrative examples and do not contain any patient’s personal information.

15. If a data breach happens

If a security incident affects your personal information, we will contain it, report it to CERT-In within the time required by law, and inform you and the relevant authorities as the law requires, with what happened and the steps you can take.

16. Links to other websites

Our website links to other sites, including news publications, social media pages and our sister brands. Their privacy practices are governed by their own policies, not this one.

17. Grievance Officer and contact

For any question, request or complaint about your personal information, contact our Grievance Officer, appointed under Rule 5(9) of the SPDI Rules:

We will acknowledge your complaint within 48 hours and resolve it within one month of receiving it.

18. Changes to this policy

We will update this policy when our practices or the law change, including as the Digital Personal Data Protection Act, 2023 comes fully into force. The "Last updated" date at the top shows the current version. For significant changes, we will place a notice on our website, and, where the law requires, ask for your consent again.