Data Protection Policy

Data Protection Policy:

• Objective

The purpose of this policy (“Policy”) is to maintain the privacy of and protect the personal information, including SPI, (“Personal Information”) of employees of Docscampus, and contractors, vendors, interns, associates, and business partners (“Data Subject”) who have access to information assets or information systems of Docscampus and ensure compliance with laws and regulations applicable to Hwell24 Plus Healthcare Private Limited (hereinafter referred to as “Docscampus” or “Organization”).

For the purpose of this Policy, “Sensitive Personal Information” or “SPI” shall mean personal data consisting of information but not limited to the following attributes of the Data Subject:

1. password;
2. financial information such as bank account or credit card or debit card or other payment instrument details ;
3. physical, physiological and mental health condition;
4. sexual orientation;
5. medical records and history;
6. genetic or biometric information;
7. racial and ethical origin;
8. political opinions;
9. religious or philosophical beliefs;
10. trade union membership;
11. any detail relating to the above clauses as provided to body corporate for providing service; and
12. any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise:

Provided that, any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as Sensitive Personal Data or information for the purposes of this Policy.

• Scope

• This Policy applies to all employees, contractors, vendors, interns, associates, and business partners who:
• receive and/or provide Personal Information to Docscampus, and/or
• have access to personal information collected or processed by Docscampus, regardless of geographic location.
• All employees of Docscampus are expected to comply with the Policy and its principles when they collect and/or handle Personal Information, or are involved in the process of maintaining or disposing of Personal Information. This Policy provides the information to successfully meet the Organization’s commitment towards data privacy.
• Any Third Party working with or for Docscampus, and who have or may have access to Personal Information, will be expected to have read, understand and comply with this Policy. No Third Party may access Personal Information held by the Organization without having first entered into a confidentiality agreement.

For the purpose of this Policy, “Third Party” shall mean any external party having access to Docscampus’s information assets or information system.

• Responsibilities

• The Data Privacy Officer (“DPO”) shall be responsible for maintenance and accuracy of this Policy. Any queries regarding the implementation of this Policy shall be directed to the DPO.

 

Name: Nilesh Bhanushali

Email address: [email protected]

• This Policy shall be reviewed for updates by the DPO on an annual basis. Additionally, the Policy shall be updated in-line with any major changes within the Organization’s operating environment or on recommendations provided by internal/ external auditors.

 

• Policy Compliance
  • The privacy review team (“Privacy Review Team”) shall annually review this Policy to ensure continuous compliance monitoring through the implementation of compliance measurements and periodic review processes.
  • In cases where non-compliance is identified, the Privacy Review Team shall review the reasons for such non-compliance along with a plan for remediation and report them to the DPO. Depending on the conclusions of the review, the Policy may be revised.

 

• Data Privacy Principles
  • This Policy describes generally acceptable privacy principles for the protection and appropriate use of Personal Information, at Docscampus. These principles shall govern the use, collection, disposal and transfer of Personal Information, except as specifically provided by this Policy or as required by applicable laws:
  1. Notice: Pursuant to Clause 1.6 hereinbelow, Docscampus shall provide Data Subjects with notice about how it collects, uses, retains, and discloses Personal Information, about them.
  2. Choice and Consent: Pursuant to Clause 1.7 hereinbelow, Docscampus shall give Data Subjects the choices and obtain their consent regarding how it collects, uses, and discloses their Personal Information.
  3. Rights of Data Subject: Docscampus shall provide Data Subjects with the right to control their Personal Information, which includes the right to access, modify, erase, restrict, transmit, or object to certain uses of their information and for withdrawal of earlier given consent to the notice.
  4. Collection: Pursuant to Clause 1.8 hereinbelow, Docscampus shall collect Personal Information from Data Subjects only for the purposes identified in the privacy notice/ statement of work (“SoW”)/ contract agreements to provide requested product or service.
  5. Use, Retention and Disposal: Pursuant to Clause 1.9 hereinbelow, Docscampus shall only use Personal Information that has been collected for the purposes identified in the privacy notice / SoW / contract agreements in accordance with the consent that the data subject shall provide. Docscampus shall not retain Personal Information longer than is necessary to fulfil the purposes for which it was collected and to maintain reasonable business records. Docscampus shall dispose the Personal Information once it has served its intended purpose or as specified by the Data Subject.
  6. Access: Pursuant to Clause 1.10 hereinbelow, Docscampus shall allow Data Subjects to make inquiries regarding the Personal Information about them, that Docscampus shall hold and, when appropriate, shall provide access to their Personal Information for review, and/or update.
  7. Disclosure to Third Parties: Pursuant to Clause 1.11 hereinbelow, Docscampus shall disclose Personal Information to Third Parties / partner firms only for purposes identified in the privacy notice / SoW / contract agreements. Docscampus shall disclose Personal Information in a secure manner, with assurances of protection by those parties, according to the contracts, laws and other segments, and, where needed, with consent of the Data Subject.
  8. Obligations for sub-processor: Where a processor (vendor or Third party acting on behalf of Docscampus’s data processor) engages another processor (sub-processor) for carrying out specific processing activities on behalf of Docscampus (controller), the same Data Protection and Security obligations as set out in the contract or other legal document between Docscampus and the processor shall be imposed on the sub-processor by way of a contract or other legal document under applicable law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of applicable law. Where the sub-processor fails to fulfil its Data Protection and Security obligations, the initial processor (relevant vendor or Third Party acting on behalf of Docscampus’s data processor) shall remain fully liable to Docscampus for the performance of that sub-processor's obligations.
  9. For the purpose of this Policy, “Data Protection and Security” shall mean anyone collecting Personal Information must fairly and lawfully process it, process it only for limited, specifically stated purposes, use the information in a way that is adequate, relevant and not excessive, use the information accurately, keep the information on file no longer than absolutely necessary, process the information in accordance with your legal rights, keep the information secure and never transfer the information outside the country without adequate protection.
  10. Security for Privacy: Pursuant to Clause 1.12 hereinbelow, Docscampus shall protect Personal Information from unauthorized access, data leakage and misuse.
  11. Quality: Pursuant to Clause 1.13 hereinbelow, Docscampus shall take steps to ensure that Personal Information in its records is accurate and relevant to the purposes for which it was collected.
  12. Monitoring and Enforcement: Pursuant to Clause 1.14 hereinbelow, Docscampus shall monitor compliance with its privacy policies, both internally and with Third Parties, and establish the processes to address inquiries, complaints and disputes.

   

  • Data Privacy Notices
  • Notice shall be made readily accessible and available to Data Subjects before or at the time of collection of Personal Information or otherwise, Notice shall be displayed clearly and conspicuously and shall be provided through online (e.g. by posting it on the intranet portal, website, sending mails, newsletters, etc.) and / or offline methods (e.g. through posts, couriers, etc.). All the web sites (including intranet portals), and any product or service that collects Personal Information internally, shall have a privacy notice.
  • In case of any cross-border transfer of Personal Information, the Data Subjects shall be informed by a notice sufficiently prior to the transfer and as per applicable law.
  • Privacy notices may include:
  1. the Organization's operating jurisdictions; Third Parties involved; business segments and affiliates; lines of business; locations;
  2. types of personal information collected; sources of information; who is collecting the Personal Information, including contact information;
  3. the purpose of collecting the Personal Information;
  4. assurance that the Personal Information will be used only for the purpose identified in the notice and only if the implicit and / or explicit consent is provided unless a law or regulation specifically requires otherwise;
  5. any choices the Data Subject have regarding the use or disclosure of the information; the process and Data Subject shall follow to exercise the choices;
  6. the process for a Data Subject to change contact preferences and ways in which the consent is obtained.
  7. collection process and how the information is collected; how the information is used including any onward transfer to Third-Parties;
  8. retention and disposal process for Personal Information; assurance that the Personal Information to be retained only as long as necessary to fulfill the stated purposes, or for a period specifically required by law or regulation and will be disposed-off securely or made anonymous post the identified purpose is completed;
  9. process of accessing Personal Information; the costs associated for accessing Personal Information (if any); process to update / correct the Personal Information; the resolution of disagreements related to Personal Information; how the information is protected from unauthorized access or use;
  10. how users will be notified of any changes made to privacy notice;
  11. disclosure process for Third Parties; the assurance that the Personal Information is disclosed to Third Parties only for the purpose identified; the remedial actions in place for any misuse of Personal Information by the Third Parties;
  12. security measures in place to protect the Personal Information ways of maintaining quality of Personal Information; and
  13. monitoring and enforcement mechanisms in place; description of the complaint channels available to Data Subjects; how the internal personnel, and the key stakeholders can contact the Organisation related to any privacy complaints or breaches; relevant contact information and / or other reporting methods through which the complaints and/or breaches could be

   

  • Choice and consent
  • Choice refers to the options for the Data Subjects are offered regarding the collection and use of their Personal Information. Consent refers to their agreement to the collection and use, often expressed by the way in which they exercise a choice option.
  • Docscampus shall establish systems for the collection and documentation of Data Subject’s consent to the collection, processing, and/or transfer of Personal data.
  • Data Subjects shall be informed about the choices available to them with respect to the collection, use, and disclosure of Personal Information.
  • Consent shall be obtained (in writing or electronically) from the Data Subjects before or at the time of collecting Personal Information or as soon as practical
  • The changes to Data Subject’s preferences shall be managed and Consent or withdrawal of consent shall be documented appropriately.
  • The choices shall be implemented in a timely fashion and respected. If Personal Information is to be used for purposes not identified in the notice / SoW / contract agreements at the time of collection, the new purpose shall be documented, the Data Subject shall be notified, and consent shall be obtained prior to such new use or
  • The Data Subject shall be notified if the data collected is used for marketing purposes, advertisements,
  • Docscampus shall review the privacy policies of the Third Parties and types of consent of Third Parties before accepting Personal Information from Third-Party data

   

  • Collection of Personal Information
  • Personal Information may be collected online or offline. Regardless of the collection method, the same privacy protection shall apply to all Personal Information.
  • Personal Information shall not be collected unless either of the following is fulfilled:
  1. the Data Subject has provided a valid, informed and free consent;
  2. processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
  3. processing is necessary for compliance with the Organizations legal obligation;
  4. processing is necessary in order to protect the vital interests of the Data Subject; or
  5. processing is necessary for the performance of a task carried out in the public interest.

• Data Subjects shall not be required to provide more Personal Information than is necessary for the provision of the product or service that Data Subject has requested or authorized. If any data not needed for providing a service or product is requested, such fields shall be clearly labelled as optional. Collection of Personal Information shall be avoided or limited when reasonably possible.
• Personal Information shall be de-identified when the purposes of data collection can be achieved without Personally Identifiable Information, at reasonable
For the purposes of this Policy, “Personally Identifiable Information” shall mean any information about the Data Subject which can be used to distinguish or trace the Data Subject ‘s identity; and any other information that is linked or linkable to the Data Subject, including but not limited to the Data Subject’s name, address, date of birth, etc.
• When using vendors to collect Personal Information on the behalf of Docscampus, it shall ensure that the vendors comply with the privacy requirements of Docscampus as defined in this
• Docscampus shall at minimum, annually review and monitor the information collected, the consent obtained and the privacy notice / SoW / contract agreement identifying the
• The project team/support function shall obtain approval from the information technology security team before adopting the new methods for collecting Personal Information
• Docscampus shall review the privacy policies and collection methods of Third-Parties before accepting Personal Information from Third-Party data

 

• Use, Retention and Disposal

• Personal Information may only be used for the purposes identified in the privacy notice / SoW / contract agreements and only if the Data Subject has given consent;
• Personal Information shall be retained for as long as necessary for business purposes identified in the privacy notice / SoW / contract agreements at the time of collection or subsequently authorized by the Data Subjects.
• When the use of Personal Information is no longer necessary for business purposes, a method shall be in place to ensure that the information is destroyed in a sufficient manner to prevent unauthorized access to that information or is de-identified in a manner sufficient to ensure the data is not Personally Identifiable Information.
• Docscampus shall have a documented process to communicate changes in retention periods of Personal Information required by the business to the Data Subjects who are authorized to request those changes.
• Personal Information shall be erased if their storage violates any of the Data Protection and Security rules or if knowledge of the data is no longer required by Docscampus or for the benefit of the Data Subject. Additionally, Docscampus has the right to retain the personnel information for legal and regulatory purpose and as per applicable data privacy
• Docscampus shall perform an internal audit on an annual basis to ensure that Personal Information collected is used, retained and disposed-off in compliance with this Policy.

 

• Access
  • Docscampus shall establish a mechanism to enable and facilitate exercise of Data Subject’s rights of access, blockage, erasure, opposition, rectification, and, where appropriate or required by applicable law, a system for giving notice of inappropriate exposure of Personal Information.
  • Data Subjects shall be entitled to obtain the details about their own Personal Information upon a request made and set forth in writing. Docscampus shall provide its response within 72 hours of receipt of written
  • The Data Subjects shall have the right to require Docscampus to correct or supplement erroneous, misleading, outdated, or incomplete Personal Information.
  • Requests for access to or rectification of Personal Information shall be directed, at the Data Subjects option, to the manager of the projects team or support function responsible for the Personal Information.
  • The privacy coordinators shall record and document each access request as it is received and the corresponding action shall be
  • Docscampus shall provide Personal Information to the Data Subjects in a plain simple format which is understandable (not in any code format).

 

• Disclosure to Third Parties

• Data Subject shall be informed in the privacy notice / SoW / contract agreement, if Personal Information shall be disclosed to Third Parties / partner firms, and it shall be disclosed only for the purposes described in the privacy notice / SoW / contract agreements and for which the data subject has provided consent.
• Personal Information of Data Subjects may be disclosed to the Third Parties / partner firms only for reasons consistent with the purposes identified in the notice / SoW / contract agreements or other purposes authorized by law.
• Docscampus shall notify the Data Subjects prior to disclosing Personal Information to Third Parties / partner firms for purposes not previously identified in the notice / SoW / contract agreements.
• Docscampus shall communicate the privacy practices, procedures and the requirements for data privacy and protection to the Third Parties / partner firms.
• The Third Parties shall sign a non-disclosure agreement (“NDA”) with Docscampus before any Personal Information is disclosed to the Third Parties partner firms. The NDA shall include the terms on non-disclosure of Personal

 

• Security
• Information security policy and procedures shall be documented and implemented to ensure reasonable security for Personal Information collected, stored, used, transferred and disposed by Docscampus.
• Individuals noticing or becoming aware of any breach of Personal data shall notify the DPO (by emailing at [.] within 2 It shall be the DPO’s responsibility to analyze and act on the intimation of the same within 12 hours.

 

• Quality
• Docscampus shall maintain data integrity and quality, as appropriate for the intended purpose of Personal data collection and use and ensure data is reliable, accurate, complete and current.
• For this purpose, the DPO and privacy coordinators (“Privacy Coordinators”) shall have systems and procedures in place to ensure that Personal Information collected is accurate and complete for the business purposes for which it is to be
• Docscampus shall perform an annual assessment on the Personal Information collected to check for accuracy, completeness and relevance of the Personal Information.

 

• Monitoring and enforcement
• Dispute Resolution and Recourse
1. Docscampus shall perform a periodic review of all the complaints related to data privacy to ensure that all the complaints are resolved in a timely manner and resolutions are documented and communicated to the Data Subjects.
2. Communication of privacy incident / breach reporting channels and the escalation matrix shall be provided to all the Data Subjects.

 

• Dispute Resolution and Escalation Process for Employees

Employees with inquiries or complaints about the processing of their Personal Information shall first discuss the matter with their immediate supervisor. If the employee does not wish to raise an inquiry or complaint with an immediate manager, or if the manager and employee are unable to reach a satisfactory resolution of the issues raised, the employee shall bring the issue to the attention of the grievance officer. (Emailing at [.]

 

• Dispute Resolution and Escalation Process for Third Party

Data Subjects with inquiries or complaints about the processing of their Personal Information shall bring the matter to the attention of the grievance officer in writing. Any disputes concerning the processing of the Personal Information of non-employees shall be resolved through arbitration.

 

• Compliance Review
1. The internal audit shall consist of the review of the following:
1. Personal Information collected from Data Subjects;
2. the purposes of the data collection and processing;
3. the actual uses of the data;
4. disclosures made about the purposes of the collection and use of such data;
5. the existence and scope of any data subject consents to such activities;
6. any legal obligations regarding the collection and processing of such data, and
7. the scope, sufficiency, and implementation status of security measures.
2. The DPO along with Privacy Coordinators shall take actions on the findings from the internal audit and work on the recommendations for improvement of the privacy posture
3. Any changes made to the policies shall be communicated to all the employees, and the stakeholders.