This Privacy Policy (“Privacy Policy”) pertains to Medical Assistance, Second Opinion services, Care Package services provided under the brand HudsonSide Health (HSH), a healthcare intermediary platform owned and operated by Vance Healthcare India Private Limited (“Vance India”) which is a wholly owned subsidiary of Vance Medical Group Inc. USA (“Vance US”). This Privacy Policy pertains to how their affiliates, group entities, service providers, Healthcare Professionals and authorised representatives, as applicable, collect, receive, store, use, process, disclose, transfer, protect and retain personal data, health data, Medical Records and other information in connection with the Platform and Services in accordance with Applicable Laws.
The primary entity responsible for collection and processing of personal data in connection with the Platform and Services shall be Vance Healthcare India Private Limited (unless expressly stated otherwise in writing), who owns and operates the brand HudsonSide Health (HSH). Vance Healthcare India Private Limited is a wholly owned subsidiary of Vance Medical Group Inc., New Jersey, United States of America. HudsonSide Health (HSH) is a Healthcare Platform owned and operated by Vance Healthcare India Private Limited offering medical and healthcare services to its subscribers.
This Privacy Policy forms part of, and shall be read together with, the Terms and Conditions of Use, Patient Disclaimer, Refund Policy, Copyright Policy, Care Package Consent, Online Second Opinion Disclaimer and any other policy, consent, disclaimer or document made available to you through the Platform or otherwise expressly communicated by HSH from time to time.
By accessing, registering on, paying for, uploading information to, communicating through, booking, availing or using the Platform or Services, you acknowledge that you have read, understood and accepted this Privacy Policy and you unequivocally agree to be bound by the same unconditionally. Where required under the Applicable Laws, HSH shall seek your consent through a clear affirmative action. In other circumstances, HSH may process Personal Data on any lawful basis available under the Applicable Laws, including legitimate use recognised thereunder.
If you do not agree with this Privacy Policy or any of the clauses contained herein, please do not access or use the Platform or any of the Services.
DEFINITIONS
Unless otherwise defined in this Privacy Policy, capitalised terms shall have the meaning assigned to them in the Terms and Conditions of Use, as amended from time to time and made available in accordance with such Terms and Conditions.
For the purposes of this Privacy Policy:
HudsonSide Health (HSH) is a Healthcare Service Platform owned and operated by Vance Healthcare India Private Limited.
“Vance India” means Vance Healthcare India Private Limited, Vance Medical Group Inc., and their affiliates, subsidiaries, parent entities, group entities, Healthcare Professionals, service providers, authorised representatives, employees, contractors, consultants and agents, engaged in connection with the Platform or Services as the context may require. References to “Vance India”, “Company”, “we”, “us” or “our” shall be interpreted contextually. Where any collection, processing, storage, disclosure, transfer, retention or data protection obligation relates to Indian Users, such reference shall primarily mean Vance Healthcare India Private Limited, unless the context expressly requires reference to Vance Medical Group Inc. or any other relevant entity or recipient.
“Applicable Laws” means all applicable laws, statutes, rules, regulations, notifications, guidelines, directions, orders, circulars, codes, standards and judicial or regulatory decisions in force from time to time in India, the United States of America or any other applicable jurisdiction, including, to the extent applicable, the Information Technology Act, 2000, the rules framed thereunder, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 as amended, replaced or re-enacted from time to time , applicable consumer protection laws, the Telecom Commercial Communications Customer Preference Regulations, 2018, applicable telemedicine and medical practice guidelines, the National Medical Commission Act, 2019, and applicable healthcare, medical ethics, pharmacy, diagnostics, clinical establishment, telecom, commercial communication, anti-spam, privacy, data protection, information technology, dispute resolution and cross-border data transfer laws and any binding guidance, directions or codes of practice issued by competent regulatory authorities thereunder.
“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of Personal Data. For Indian Users, Vance India shall ordinarily act as the Data Fiduciary in respect of Personal Data processed in connection with the Platform and Services, unless expressly specified otherwise or required under the Applicable Laws.
“Data Processor” means any person who processes Personal Data on behalf of a Data Fiduciary.
“Data Principal” means the individual to whom personal data relates and includes a parent or lawful guardian acting on behalf of a child or a lawful representative acting on behalf of a person with disability, where applicable under Applicable Law.
“Personal Data” means any data about an individual who is identifiable by or in relation to such data.
“Health Data” means any health-related, medical, clinical, wellness, diagnostic, treatment, prescription, consultation, care-related or healthcare-related data relating to a User, Patient or Care Recipient, whether or not such data constitutes Personal Data under the Applicable Laws.
“Medical Records” means medical records, diagnostic reports, prescriptions, images, scans, videos, consultation notes, case history, symptoms, treatment history, discharge summaries, recordings, transcripts, summaries, care plans and other health-related information submitted, uploaded, shared, generated, processed or made available through or in connection with the Platform.
“Processing” means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, sharing, alignment, combination, restriction, erasure or destruction.
SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies to information collected, received, generated, processed, stored, disclosed, accessed, retained, or transferred by or on behalf of HSH when you:
visit or use
use any mobile application, web application, portal, dashboard, software interface or AI Tool made available by HSH;
create an account or user profile;
book or avail Consultations, second opinions, Care Packages, Caregiver support, nursing support, diagnostics coordination, hospital admission coordination, medicine delivery coordination, chronic care programmes, corporate wellness services, Medical Records storage, AI-assisted services, preventive care services, wellness programmes or any other Services;
upload, submit or share Medical Records;
interact with Indian Doctors, U.S. Physicians, Caregivers, Relationship Managers, Care Coordinators, Diagnostic Partners, Hospital Partners, Pharmacy Partners or other service providers through or in connection with the Platform;
communicate with HSH through phone, WhatsApp message/s, SMS, email/s, video call/s, AI Tool/s (including chatbots), in-app messaging, support channels or other communication modes;
make payments or receive refunds;
participate in surveys, feedback, testimonials, reviews or promotional activities; or
otherwise interact with HSH, the Platform or Services.
This Privacy Policy applies whether the Services are accessed online, offline, by telephone, WhatsApp, email, video consultation, audio consultation, in-person coordination, through third-party platforms or integrations or otherwise.
INFORMATION WE COLLECT
HSH may collect, receive, generate, access, store, retain, use or process the following categories of information in connection with the Platform and Services and for the purposes described in this Privacy Policy.
Identity and contact information
This may include:
name;
age / date of birth;
gender;
phone number;
email address;
residential address;
location or city;
nationality / residency status, where relevant;
identity documents or information contained therein where required for verification, fraud prevention, legal compliance or healthcare service delivery;
biometric identifiers or authentication-related information, where voluntarily provided by the User or collected for identity verification, fraud prevention, account security or compliance with Applicable Law;
caregiver / family member / guardian / representative details; and
emergency contact details including details of caregivers or other persons designated by the User or Patient for emergency communications.
Account and profile information
This may include:
account registration details;
username or login credentials;
profile information;
communication preferences;
service preferences;
plan/package details;
booking history;
service usage history; and
account settings.
Health data and Medical Records
This may include:
symptoms;
medical history;
prescriptions;
diagnostic reports;
laboratory reports;
scans, images, X-rays, MRIs, CT scans, ECGs or other medical imaging;
discharge summaries;
surgical history;
allergy information;
medication history;
vaccination history;
family history;
current treatment details;
chronic disease information;
doctor notes;
care plans;
second-opinion requests;
U.S. Physician review notes;
Indian Doctor consultation notes;
Care Package information;
home care observations;
medication reconciliation information;
escalation notes;
Medical Records uploaded by Users; and
any other health-related information submitted, uploaded, shared, generated, derived, analysed or processed through or in connection with the Platform.
Consultation, communication and recording information
This may include:
audio and video consultation recordings;
call recordings;
chat transcripts;
WhatsApp communications;
SMS and email communications;
chatbot interactions and interactions with AI Tools;
support tickets;
care coordination notes;
Relationship Manager / Care Coordinator communications;
Caregiver updates;
family communication logs;
service-related instructions;
consent records, withdrawal of consent records and other authorisation records; and
timestamps and interaction logs.
Payment and transaction information
This may include:
payment status;
transaction ID;
invoice details;
refund details;
payment method type;
billing information;
payment gateway references;
tax-related information; and
details required for payment reconciliation, accounting, audit and compliance.
HSH may use third-party payment gateways. HSH does not ordinarily store complete card numbers, CVV or sensitive payment authentication credentials, unless expressly permitted or required under Applicable Law and applicable payment security standards.
Device, technical and usage information
This may include:
IP address;
browser type;
device type;
operating system;
device identifiers, including advertising identifiers, device tokens and other unique device identifiers, where applicable;
log data;
session data;
pages visited;
time spent on the Platform;
clickstream information;
referral source;
app usage data;
approximate location derived from technical data, IP address, device settings or network information;
cookies, pixels, SDKs, and similar technologies; and
performance, crash, error and diagnostic data.
AI-generated and platform-generated information
This may include:
AI-assisted summaries;
automated transcripts;
triage outputs;
symptom review outputs;
care prompts;
risk flags;
automation logs;
record organisation outputs;
translations;
dashboards;
internal notes;
workflow outputs; and
other information generated by or through AI Tools, software systems or platform workflows, including outputs reviewed, modified or validated by Healthcare Professionals or authorised personnel.
Feedback, survey and marketing information
This may include:
feedback;
reviews;
ratings;
testimonials;
survey responses;
complaints;
suggestions;
service experience information;
marketing preferences; and
promotional communication preferences;
participation in campaigns, referral programmes, loyalty programmes or similar promotional initiatives.
SOURCES OF INFORMATION
HSH may collect information directly or indirectly from:
you directly;
your parent, guardian, family member, caregiver, representative or authorised person;
Healthcare Professionals;
Indian Doctors;
U.S. Physicians;
Caregivers, Relationship Managers and Care Coordinators;
Diagnostic Partners;
Hospital Partners;
Pharmacy Partners;
payment gateways and banks;
technology vendors and cloud service providers, analytics providers and infrastructure providers;
corporate wellness clients or employers, where applicable and lawful;
third-party service providers engaged in providing or supporting Services;
communications through phone, WhatsApp, SMS, email, chatbot, video call or other channels;
documents uploaded or shared by you; and
systems, devices, cookies pixels, SDKs, logs and automated tools used in connection with the Platform.
Where you provide information relating to another person, including a minor, elderly person, dependent person, family member, Patient or Care Recipient, you represent and warrant that you have the necessary legal authority and, where required under Applicable Law, valid consent to provide such information and permit HSH to process it in accordance with this Privacy Policy.
PURPOSES FOR WHICH INFORMATION IS PROCESSED
HSH may collect, use, store, disclose, transfer or otherwise process information for the following purposes and for purposes incidental, ancillary or reasonably connected thereto, to the extent permitted under Applicable Law:
creating and managing User accounts;
verifying identity, authority and eligibility;
booking, scheduling and managing Consultations;
facilitating teleconsultations with Indian Doctors;
facilitating second opinions, peer-to-peer inputs and Cross-Border Medical Review involving U.S. Physicians, including the secure transfer of relevant Medical Records and health information for such purposes;
organising, storing, reviewing and sharing Medical Records;
preparing case summaries;
coordinating Care Packages, Caregiver support, nursing support, Relationship Manager support and Care Coordinator support;
coordinating diagnostics, laboratory tests and report access;
coordinating hospital admission, discharge, ambulance, rehabilitation and Hospital Partner services;
coordinating medicine delivery through Pharmacy Partners;
providing chronic care plans, monitoring support, escalation support and care navigation;
enabling AI-assisted summarisation, transcription, triage, record organisation, automation and workflow support;
communicating with Users, Patients, family members, Representatives and service providers;
providing reminders, alerts, care updates, optional additional care packages, service updates and payment reminders;
processing payments, invoices, refunds and chargebacks;
managing plans, suggesting alternate plans based on user inputs, subscriptions, packages and service entitlements;
providing support, grievance redressal and dispute resolution;
ensuring patient safety and continuity of care;
quality assurance, training, audit, compliance, accreditation and internal governance;
fraud prevention, risk management and platform security;
legal, regulatory, tax, accounting and statutory compliance;
medico-legal defence, claim management and enforcement of rights;
improving the Platform, Services, user experience, workflows and operational processes;
internal analytics, research support, service improvement and business intelligence including the preparation of aggregated or de-identified insights, where permitted under Applicable Law;
obtaining feedback, reviews and survey responses;
marketing, promotional communication and user engagement, subject to Applicable Law and communication preferences; and
any other purpose disclosed to you at the time of collection, otherwise notified to you or permitted under Applicable Law.
LEGAL BASIS / GROUNDS FOR PROCESSING
HSH may process Personal Data and Health Data on one or more of the following grounds, to the extent applicable under Applicable Law:
your consent;
consent provided by your parent, lawful guardian, authorised representative or any person duly authorised to act on your behalf under Applicable Law, , where applicable;
performance of Services requested by you;
processing necessary for providing healthcare coordination, second opinions, care support, Medical Records management, diagnostics coordination, hospital coordination, medicine coordination, AI-assisted services or related Services;
compliance with Applicable Law;
fulfilment of legal, regulatory, tax, accounting, audit, record-keeping or reporting obligations;
protection of health, safety, legal rights, personnel, systems, property, business interests, continuity of care, or vital interests;
prevention of fraud, misuse, security incidents or unlawful activity;
dispute resolution, claim defence and enforcement of legal rights; and
such other lawful basis as may be available under Applicable Law.
Where consent is required under Applicable Law, HSH shall process Personal Data on the basis of consent unless another lawful ground is available or the processing is otherwise permitted under Applicable Law.
NOTICE AT OR BEFORE COLLECTION
HSH may provide Users with a notice, consent form, checkbox, pop-up, digital prompt, onboarding form, service-specific consent, teleconsultation consent, Care Package consent, Medical Records sharing consent, cross-border transfer consent or other appropriate notice or communication at or before the collection or processing of Personal Data, where required under Applicable Law.
Such notice may specify, among other things, the Personal Data being collected, the purpose of processing, the manner in which consent may be withdrawn, the manner in which rights may be exercised, and the grievance redressal mechanism and such other information as may be required under Applicable Law.
This Privacy Policy shall operate as a general privacy notice. Service-specific notices, consents and disclosures may supplement and, to the extent of any inconsistency in relation to a particular Service, prevail over this Privacy Policy.
HSH may provide privacy notices, consent notices and related communications in English and such additional languages as Vance may determine from time to time. Where required under Applicable Law, Vance shall endeavour to provide notices in the language prescribed or recognised under Applicable Law.
CONSENT
By accessing or using the Platform or Services, creating an account, booking a Service, uploading Medical Records, requesting a Consultation, availing a Care Package, interacting with a Healthcare Professional, communicating with HSH , or otherwise submitting information and where consent is required under Applicable Law, you consent to Vance processing your information in accordance with this Privacy Policy.
Your consent includes consent for:
collection, storage, use and processing of Personal Data, Health Data and Medical Records;
sharing of information with Indian Doctors, U.S. Physicians, Caregivers, Relationship Managers, Care Coordinators, Diagnostic Partners, Hospital Partners, Pharmacy Partners and other service providers;
recording, storing, transcribing, translating and reviewing consultations, calls, chats and communications, where applicable;
AI-assisted processing, summarisation, transcription, triage and workflow support;
cross-border transfer, disclosure, access and processing as set out in this Privacy Policy;
communication through phone, SMS, WhatsApp, email, push notification, in-app notification, chatbot, video call and other available channels;
processing for compliance, audit, legal claims, medico-legal defence, quality assurance and service improvement; and
retention of records in accordance with HSH’s policies and Applicable Law.
You may withdraw consent in accordance with this Privacy Policy and Applicable Law. However, withdrawal of consent shall not affect the lawfulness of processing undertaken prior to such withdrawal and may affect HSHs ability to provide Services, depending on the nature and character of information, permission for which has been recalled/withdrawn.
PERSONAL DATA OF MINORS
The Platform and Services are intended to be used by persons who are at least 18 years of age.
Where the Platform or Services are used for a minor, the parent or lawful guardian must provide consent or other verifiable authorisation recognised under Applicable Law and shall be responsible for providing accurate information and authorising processing of the minor’s Personal Data, Health Data and Medical Records.
HSH shall not knowingly process Personal Data of minors except through valid parental or guardian consent or other lawful authorisation as required under Applicable Law and may rely on information and representations provided by Users regarding age and authority unless Vance has reason to believe otherwise.
HSH may require additional verification, documentation or consent before providing Services relating to a minor and may suspend, decline or limit the provision of such Services until the required information or authorisation is received.
HSH shall not knowingly undertake tracking, behavioural monitoring or targeted advertising directed at minors, except to the extent permitted under Applicable Law. Any processing of Personal Data of minors shall be subject to parental or guardian consent and such additional safeguards as may be required under Applicable Law.
HEALTH DATA AND MEDICAL RECORDS
Health Data and Medical Records may be sensitive in nature. Vance shall process such information only for lawful purposes connected with the Platform and Services, including healthcare coordination, second opinion review, Medical Records management, care coordination, AI-assisted workflow support, diagnostics coordination, hospital coordination, medicine coordination, compliance, dispute resolution, medico-legal defence,service improvement quality assurance, patient safety and continuity of care, or as otherwise permitted under Applicable Law.
Users acknowledge that Medical Records and Health Data may be relied upon by Healthcare Professionals, Indian Doctors, U.S. Physicians, Caregivers, Diagnostic Partners, Hospital Partners, Pharmacy Partners and other authorised recipients for providing, coordinating supporting Services and that such persons may rely on the accuracy and completeness of the information made available to them.
HSH shall not be responsible for the consequences of inaccurate, incomplete, forged, outdated, delayed, misleading or withheld Medical Records or information provided by or on behalf of a User.
SHARING AND DISCLOSURE OF INFORMATION
HSH may share or disclose information with the following persons or entities where reasonably necessary for Services, compliance, legal purposes, safety, operations or lawful business purposes, or as otherwise permitted or required under Applicable Law:
Vance India;
Vance US;
affiliates, parent entities, subsidiaries and group entities;
Indian Doctors;
U.S. Physicians;
Healthcare Professionals;
Caregivers, nurses, Relationship Managers and Care Coordinators;
Diagnostic Partners;
Hospital Partners;
Pharmacy Partners;
laboratories, pharmacies, hospitals, clinics, nursing homes, rehabilitation centres and ambulance providers;
payment gateways, banks and financial service providers;
technology vendors, cloud providers, hosting providers, software providers, AI service providers, cybersecurity service providers, data storage providers and analytics service providers;
communication service providers, telecom service providers, email/SMS/WhatsApp vendors and support tools;
auditors, accountants, legal advisors, consultants and compliance personnel;
insurers, where applicable and authorised;
corporate wellness clients or employers, only where permitted by consent, agreement and Applicable Law;
government authorities, regulators, law enforcement agencies, courts, tribunals or statutory bodies where required or permitted by law;
successors, acquirers, investors or restructuring parties in connection with merger, acquisition, investment, restructuring, transfer or sale of business including due diligence conducted in connection therewith, subject to appropriate safeguards; and
any other person authorised by you or permitted under Applicable Law.
HSH shall not sell Personal Data or Health Data to advertisers.
CROSS-BORDER DATA TRANSFER AND OVERSEAS ACCESS
The User acknowledges and agrees that, where permitted under Applicable Law and where necessary for rendering the Services, as part of the Platform’s second opinion, peer-to-peer consultation, medical advisory, care coordination, AI-assisted review and healthcare support services, HSH may share, disclose, transmit, make available, permit controlled access to, or otherwise process Personal Data, Health Data, Medical Records, AI Tool-generated summaries and related information with persons or entities located outside India, even where primary storage of such data is maintained within India.
Such recipients may include Vance India, Vance US, U.S. Physicians, overseas affiliates, parent entities, cloud service providers, technology vendors, AI service providers, data processors, consultants, advisors, compliance personnel, legal advisors, auditors and other authorised representatives involved in providing, supporting, reviewing, improving, documenting, maintaining, securing or defending the Services.
The purposes of such cross-border transfer, access and processing may include:
obtaining U.S. Physician advisory inputs;
online second opinions;
peer-to-peer medical discussions;
review of Medical Records;
care coordination;
preparation of case summaries;
AI-assisted summarisation, transcription, triage or review;
quality assurance;
continuity of care;
compliance and audit;
record keeping;
medico-legal defence;
dispute resolution;
fraud prevention; and
service improvement;
information security, cybersecurity monitoring, system administration, disaster recovery and business continuity.
Where operationally feasible, HSH may restrict overseas recipients to controlled access, viewing, review or annotation of Medical Records through secure systems and may restrict downloading, local storage, onward transfer or unauthorised copying, subject to technical limitations, professional requirements, legal requirements and Applicable Law.
The User acknowledges that data transferred, accessed or processed outside India may be subject to foreign laws, foreign governmental access requirements, overseas processing standards, cloud infrastructure rules and jurisdictional differences.
If the Government of India notifies any restriction, prohibition or condition on transfer of Personal Data or Health Data to any country, territory, entity or class of entities, Vance may modify, suspend, restrict, restructure or discontinue affected cross-border or adopt alternative technical or organisational measures Services without liability.
Where U.S. laws relating to health information privacy, medical records, confidentiality, professional conduct or physician obligations apply to Vance US, U.S. Physicians or other overseas recipients, such persons shall be responsible for complying with such laws to the extent applicable to them. Nothing in this Privacy Policy shall be construed as a representation that HSH/Vance India is a covered entity, business associate or regulated entity under any U.S. health privacy law unless expressly confirmed in writing.
Where required by Applicable Law, HSH may implement contractual, organisational, technical or security measures that it reasonably considers appropriate for cross-border processing. HSH does not represent or warrant that foreign jurisdictions provide privacy protections identical to those available under Indian law.
DATA STORAGE
HSH may endeavour to store primary copies of Personal Data, Health Data and Medical Records on servers or systems located within India, where commercially, technically and legally feasible or otherwise in accordance with Applicable Law and HSHs operational requirements.
However, cross-border access, viewing, transmission, disclosure, backup, support, hosting, maintenance, disaster recovery, cybersecurity monitoring or processing may occur in connection with the Services, including where U.S. Physicians, Vance US, technology vendors, cloud providers, affiliates, consultants or other service providers are located outside India.
HSH will retain the data collected for a period of 7 (seven) years from the 1st date of collection of data/part thereof. On expiry of 7 (seven) years from the 1st date of collection of data/part thereof, the entire data so collected till such date of expiry of the 7 (seven) year period shall be archived and retained for a further period of 3 (three) years. HSH shall not be responsible to retain any data after the lapse of the 10 (ten) year period commencing from the 1st date of collection of data/part thereof.
HSH does not guarantee that every copy, backup, archive, log, support record, communication record, AI processing record, vendor record or temporary processing instance will be stored exclusively in India, unless expressly required under Applicable Law or expressly undertaken in writing by HSH and the User acknowledges that such processing or storage may occur through distributed or cloud-based infrastructure operated by HSH or its authorised service providers.
AI TOOLS AND AUTOMATED PROCESSING
HSH may use AI Tools for symptom checking, triage support, summaries, transcription, translation, record organisation, care prompts, alerts, risk flags, automation, workflow support, patient engagement, provider assistance, analytics, quality review and service improvement, fraud detection, security monitoring and operational optimisation.
Personal Data, Health Data and Medical Records may be processed by AI Tools for these purposes.
AI Tools are used for informational, administrative, assistive and decision-support purposes only and do not constitute medical advice, diagnosis, prescription, treatment or emergency guidance nor are they intended to replace the independent professional judgment of a qualified Healthcare Professional.
Outputs generated by AI Tools may be incomplete, inaccurate, outdated, biased, inappropriate, misleading or unsuitable for a User’s condition. Users must verify AI outputs with a qualified Healthcare Professional before acting upon them. To the maximum extent permitted under Applicable Law, HSH shall not be responsible for any decision made solely in reliance on AI-generated outputs without appropriate professional review.
HSH may use anonymised, de-identified, pseudonymised, summarised, scrubbed, redacted or aggregated information for AI-assisted workflow improvement, operational analytics, quality review, research support, service improvement and lawful business purposes, subject to Applicable Law and may engage authorised third-party service providers to process such information on its behalf under appropriate contractual and security obligations.
HSH may take reasonable technical and organisational measures to remove or mask direct identifiers before using such information for such purposes; however, HSH does not guarantee that anonymisation, de-identification, pseudonymisation, redaction, scrubbing or aggregation will eliminate all risk of re-identification in every circumstance.
To the fullest extent permitted by Applicable Law, AI-generated outputs shall be treated as preliminary informational material only and no User shall rely upon such outputs as a substitute for independent medical judgment, diagnosis or treatment by a qualified Healthcare Professional.
RECORDINGS, TRANSCRIPTS AND COMMUNICATION LOGS
By booking or participating in a Consultation, Care Package, care coordination interaction, support call, Relationship Manager call, Caregiver update, AI interaction or other communication, and where recording or processing requires consent under Applicable Law you consent to HSH recording, storing, transcribing, translating, analysing and reviewing such interactions for:
quality assurance;
training;
compliance;
continuity of care;
patient safety;
dispute resolution;
medico-legal defence;
fraud prevention;
service improvement;
regulatory compliance;
operational monitoring; and
any other lawful purpose described in this Privacy Policy or otherwise permitted under Applicable Law.
Recordings, transcripts and interaction logs may be retained by HSH in accordance with its internal policies and Applicable Law including for evidentiary, audit, security, continuity of care and medico-legal purposes.
Users shall not record, publish, circulate, edit, misuse or disclose any Consultation, Caregiver interaction, doctor interaction, HSH communication or Platform content without prior written consent of HSH and the concerned participants except where such recording, disclosure or use is expressly permitted or required under Applicable Law.
COMMUNICATIONS, REMINDERS AND PROMOTIONAL MESSAGES
HSH may contact you by phone, WhatsApp, SMS, email, push notification, in-app notification, video call, chatbot, automated system or other available communication channels made available by you or otherwise lawfully available to HSH for:
service delivery;
appointment scheduling;
consultation reminders;
care coordination;
payment reminders;
support;
feedback;
compliance;
safety alerts;
service updates;
grievance redressal;
account-related communication;
lawful promotional purposes, including information about products, services, wellness programmes, offers, features or initiatives offered by HSH or its affiliates, subject to Applicable Law; and
other purposes connected with the Platform and Services.
Such communications shall be subject to Applicable Law, where applicable user consent, communication preferences and applicable telecom, commercial communication, anti-spam and do-not-disturb requirements.
You may opt out of non-essential promotional communications by using the opt-out mechanism provided by HSH or by contacting HSH at the details set out in this Privacy Policy. HSH may take a reasonable period to process and implement such opt-out requests in accordance with Applicable Law. Opting out of promotional communications shall not affect HSH’s ability to send transactional, service-related, care coordination, safety, legal, payment, account, grievance, compliance or emergency-related communications.
COOKIES AND SIMILAR TECHNOLOGIES
HSH may use cookies, pixels, tags, local storage, SDKs, analytics tools and similar technologies, whether deployed by HSH or its authorised service providers, to:
operate the Platform;
remember preferences;
maintain sessions;
improve security;
analyse usage;
personalise user experience;
measure performance;
detect fraud or misuse;
improve products and Services; and
support lawful marketing, analytics, service optimisation, performance monitoring and business intelligence.
You may be able to disable cookies through your browser or device settings. However, disabling cookies may affect the functionality, availability or performance of the Platform.
A separate Cookie Policy may be made available by HSH and shall form part of this Privacy Policy.
Where required under Applicable Law, HSH may provide a cookie banner, consent tool or preference management mechanism to allow Users to manage cookies or similar technologies, including the ability to accept, reject or modify cookie preferences to the extent technically feasible and legally required.
DATA SECURITY
HSH shall adopt reasonable technical, organisational and security measures as required under Applicable Law and taking into account the nature of the Personal Data processed, the risks associated with such processing and industry practices for protecting Personal Data, Health Data and Medical Records.
Such measures may include, as appropriate:
access controls;
authentication controls;
encryption or secure transmission protocols;
restricted access to Medical Records;
confidentiality obligations;
vendor controls;
audit trails;
data minimisation practices;
internal policies;
staff training;
incident response measures;
other reasonable safeguards;
network monitoring and logging;
backup and disaster recovery measures; and
periodic security assessments, testing or reviews, where appropriate.
However, the User acknowledges that no digital platform, electronic communication, cloud system, software, server, database, internet transmission, device, communication channel or storage system can be guaranteed to be completely secure or immune from unauthorised access, cyberattacks, malware, ransomware, hacking, phishing, system failure, human error, third-party failure or other security incidents and HSH does not warrant uninterrupted or error-free operation of the Platform from a security perspective.
HSH shall not be liable for any unauthorised access, cyber incident, data loss, data corruption, data breach, security incident, service disruption or compromise of Personal Data, Health Data or Medical Records where HSH has adopted reasonable security measures in accordance with Applicable Law, except to the extent such incident is caused by HSH’s wilful misconduct, gross negligence or material violation of Applicable Law, as finally determined by a competent authority and subject to any non-excludable rights or remedies available under Applicable Law.
PERSONAL DATA BREACH
In the event of a personal data breach, cybersecurity incident, unauthorised access or security incident affecting Personal Data, Health Data or Medical Records, HSH shall take such reasonable and appropriate steps as may be required under Applicable Law, including investigation, mitigation, user notification, regulatory notification, cooperation with authorities and remedial measures, as applicable.
HSH may notify affected Users, regulators, service providers, law enforcement agencies or other relevant persons or coordinate such notifications through its authorised representatives or service providers, where required under Applicable Law or where HSH considers such notification appropriate in the circumstances.
Nothing in this Privacy Policy shall be construed as an admission by HSH of fault, liability, negligence or non-compliance merely because a security incident, personal data breach or notification has occurred.
RETENTION OF INFORMATION
HSH may retain Personal Data, Health Data, Medical Records, recordings, transcripts, communication logs, payment records, service records, consent records, grievance records and other information for as long as reasonably necessary or as otherwise required or permitted under Applicable Law for:
providing Services;
continuity of care;
maintaining Medical Records;
legal, regulatory, tax, accounting and audit compliance;
dispute resolution;
medico-legal defence;
fraud prevention;
enforcing rights;
responding to grievances;
quality assurance;
service improvement;
internal analytics; and
any other lawful purpose or legitimate operational purpose connected with the Platform or Services, to the extent permitted under Applicable Law.
Different categories of information may be retained for different periods depending on the nature of the information, the purpose of processing, legal requirements, medical record requirements, limitation periods, dispute risk, contractual obligations, regulatory expectations and business requirements.
HSH may retain anonymised, de-identified, irreversibly aggregate or aggregated data for a longer period, subject to Applicable Law.
Upon expiry of the applicable retention period, HSH may delete, archive, anonymise, de-identify or securely dispose of information in accordance with its internal policies and Applicable Law unless continued retention is required or permitted under Applicable Law or for the establishment, exercise or defence of legal claims.
Information that has been anonymised in a manner that does not permit the identification of an individual and is no longer Personal Data under Applicable Law may be retained, used, disclosed, commercialised, licensed, analysed or otherwise processed by HSH for lawful business purposes without further notice or consent, to the extent permitted under Applicable Law.
USER RIGHTS
Subject to Applicable Law and the nature of the Services provided, you may have rights in relation to your Personal Data, including the right to:
access information about your Personal Data;
seek correction, completion, updating or rectification of Personal Data;
seek erasure of Personal Data, where applicable and not inconsistent with Applicable Law, professional record retention requirements or HSH's legal obligations;
withdraw consent for future processing;
nominate another individual to exercise rights in relation to Personal Data in the event of death or incapacity, where available under Applicable Law;
raise grievances; and
exercise such other rights as may be available under Applicable Law.
To exercise your rights, you may contact HSH at the grievance/contact details provided in this Privacy Policy.
HSH may require verification of identity, authority and request details before acting on any request and may request such additional information or documentation as is reasonably necessary to verify the identity or authority of the requester or to process the request securely.
HSH may refuse, restrict or defer a request in whole or in part where permitted under Applicable Law, including where retention or processing is necessary for legal compliance, healthcare purposes, record keeping, dispute resolution, fraud prevention, medico-legal defence, contractual obligations, safety, security or enforcement of rights.
Withdrawal of consent shall not affect processing undertaken lawfully before such withdrawal or HSH’s continued retention or processing of information where required or permitted under Applicable Law, or processing required for compliance, record keeping, legal claims, dispute resolution, medico-legal defence or other lawful purposes.
HSH shall not be required to comply with any request that it reasonably determines to be manifestly unfounded, repetitive, abusive, technically infeasible, disproportionate, prohibited by Applicable Law or inconsistent with legal, healthcare, patient safety, record-retention, compliance, audit, fraud prevention or evidentiary obligations.
ACCURACY OF INFORMATION
Users are responsible for ensuring that information submitted to HSH whether directly or through a parent, guardian, caregiver, authorised representative or any other person acting on their behalf, is true, accurate, complete, current and lawful.
Users must promptly update information that becomes inaccurate, incomplete, outdated or misleading including any changes to their medical condition, contact details, authorised representatives or other information relevant to the provision of the Services, where applicable.
HSH shall not be liable for any incorrect Medical Opinion, care plan, AI Tool output, recommendation, Consultation-related issue, service issue, data processing issue or third-party action to the extent arising from or attributable to incorrect, incomplete, forged, misleading, outdated or withheld information provided by or on behalf of the User. HSH shall be entitled to rely on the accuracy and completeness of the information provided by or on behalf of the User unless HSH has actual knowledge that such information is inaccurate or incomplete.
THIRD-PARTY SERVICES
The Platform may contain or facilitate access to Third-Party Services, including Diagnostic Partners, Hospital Partners, Pharmacy Partners, laboratories, pharmacies, hospitals, clinics, nursing homes, rehabilitation centres, payment gateways, cloud providers, communication tools, software providers, medical device providers, ambulance providers, delivery partners and independent Healthcare Professionals and other third-party vendors, contractors or service providers engaged in connection with the Platform or Services.
Third-Party Services may collect, use, store or process information in accordance with their own privacy policies, terms and practices and HSH encourages Users to review such policies before providing information directly to such third parties, where applicable.
HSH does not control Third-Party Services and shall not be liable for acts, omissions, delays, negligence, errors, misconduct, data breaches, service failures, privacy practices or regulatory non-compliance of third parties, or for any products, services, advice, treatment, diagnosis, representations or omissions provided by such third parties, except to the extent expressly required under Applicable Law.
Users are encouraged to review applicable third-party privacy policies and terms before using Third-Party Services. Nothing in this Privacy Policy shall be construed as creating any agency, partnership, joint venture or employment relationship between HSH and any independent Third-Party Service provider, unless expressly agreed in writing.
CORPORATE WELLNESS AND EMPLOYER-RELATED SERVICES
Where Services are provided under a corporate wellness arrangement, HSH may receive or process information relating to employees, consultants, members or beneficiaries of the relevant organisation for the purposes of administering, providing, managing, monitoring and improving such Services, and otherwise as permitted under Applicable Law.
HSH shall not disclose identifiable employee Health Data or Medical Records to an employer except (i) with valid consent, (ii) where disclosure is expressly authorised under the applicable corporate wellness arrangement or other contractual documentation and is consistent with Applicable Law, (iii) where required by law, or (iv) as otherwise permitted under Applicable Law.
Aggregated, anonymised or de-identified wellness insights may be shared with employers for reporting, analytics, wellness programme management, programme evaluation, utilisation reporting, benchmarking or service improvement, provided such information is not reasonably capable of identifying individual Users.
Employers shall not use wellness data for unlawful discrimination, employment decisions, disciplinary action or any purpose prohibited by Applicable Law. HSH shall not be responsible for any processing, use or disclosure of information by an employer after such information has been lawfully disclosed in accordance with this Privacy Policy, the applicable corporate wellness arrangement and Applicable Law
MARKETING, FEEDBACK AND TESTIMONIALS
HSH may collect feedback, reviews, ratings, suggestions, survey responses, testimonials, complaints, recommendations or improvement inputs from Users for business, product, operational, quality, training, compliance, marketing, research, analytics, product development, internal benchmarking and service improvement purposes, subject to Applicable Law.
HSH may use anonymised, aggregated or de-identified feedback, ratings, survey responses or service experience information without further consent, provided such information is not reasonably capable of identifying the User or Patient and such use is otherwise consistent with Applicable Law. HSH shall not publish or use any User’s name, photograph, image, video, identifiable testimonial, identifiable health information, personal story, case study or Medical Records for marketing or promotional purposes without obtaining valid and appropriate consent, where required under Applicable Law.
Users grant HSH a perpetual, worldwide, royalty-free irrevocable, transferable, sublicensable and non-exclusive licence to use non-confidential feedback and suggestions for business, product, marketing, operational, research, analytics, AI model improvement, and service improvement purposes, subject to Applicable Law.
Nothing in this clause shall permit HSH to use Personal Data, Health Data or Medical Records for marketing or promotional purposes except in accordance with this Privacy Policy, Applicable Law and any consent obtained from the User where required.
BUSINESS TRANSFERS
In the event of any merger, acquisition, investment, financing, restructuring, reorganisation, sale of business, transfer of assets, joint venture, collaboration, strategic partnership, corporate reorganisation, insolvency proceeding, business combination or similar transaction, HSH may disclose or transfer information to prospective or actual acquirers, investors, successors, affiliates, advisors, auditors, legal counsel, consultants, transaction managers or other relevant parties, subject to appropriate confidentiality and data protection safeguards and Applicable Law. Any successor entity or permitted transferee receiving such information shall be entitled to continue processing such information in a manner consistent with this Privacy Policy, the purposes for which it was originally collected, and Applicable Law.
Users acknowledge that due diligence review may occur through secure data rooms, controlled-access environments or other confidentiality-protected mechanisms and that disclosure for such purposes shall be deemed compatible with the purposes for which the information was originally collected to the extent permitted under Applicable Law.
LEGAL DISCLOSURES
HSH may disclose information to the extent reasonably necessary where it believes in good faith that such disclosure is necessary or appropriate to:
comply with Applicable Law;
respond to court orders, notices, summons, warrants or legal process;
cooperate with regulators, law enforcement agencies, government authorities or statutory bodies, self-regulatory organisations, professional bodies or other competent authorities;
protect patient safety;
prevent fraud, abuse, misuse or unlawful activity;
enforce the Terms, Policies or contractual rights;
protect the rights, property, reputation, personnel, users, Healthcare Professionals, Caregivers, service providers, affiliates or business interests of HSH or Protected Parties;
investigate security incidents or data breaches;
establish, exercise or defend legal claims, legal proceedings, investigations, arbitrations, mediations or regulatory proceedings;
comply with audit, tax, accounting or regulatory obligations; or
protect or enforce the security, integrity, functionality or operation of the Platform, Services or associated systems.
YOUR RESPONSIBILITIES
You agree to comply with the following responsibilities while accessing or using the Platform or Services:
provide accurate, complete and lawful information;
update your information when it changes;
ensure you have all necessary authority, consent or other lawful basis to share information about another person;
maintain confidentiality of login credentials;
use reasonable security measures, including secure devices and networks where possible;
not share OTPs, passwords or account credentials;
promptly notify HSH of any actual or suspected unauthorised access compromise of account credentials, security incident or data misuse relating to your account or use of the Platform;
not upload unlawful, forged, fabricated, misleading, malicious, corrupted or infringing content;
not record, publish or circulate consultations or communications without consent;
keep your contact details and communication preferences updated;
promptly notify HSH if you no longer wish to receive non-essential promotional communications; and
cooperate with HSH in investigating security incidents, verifying identity, responding to lawful requests or resolving issues relating to your use of the Platform or Services, where reasonably required.
GRIEVANCE REDRESSAL AND CONTACT DETAILS
For privacy concerns, data protection requests, consent withdrawal requests, correction requests, grievances, complaints Data Principal rights requests or questions about this Privacy Policy, you may contact:
Grievance Officer / Compliance Contact
Name: Seema Ghose
Designation: Chief Grievance Officer
Entity: HudsonSide Health
Registered Office: Kolkata, West Bengal, India
Email: [email protected]
The Grievance Officer shall act as the designated point of contact for Data Principal requests and grievances under the Digital Personal Data Protection Act, 2023 and applicable rules.
HSH shall acknowledge, review and endeavour to resolve grievances and respond to requests within such timelines as may be prescribed under Applicable Law, having regard to the nature, complexity and circumstances of the request or grievance, depending on the nature of the grievance, including whether it relates to data protection, privacy, platform/intermediary obligations, consumer protection, e-commerce, healthcare services, Third-Party Services or any other matter.
You must provide accurate and sufficient details to enable HSH to identify and process your request, including name, contact details, booking ID, patient details, service details, relevant documents and a clear description of the grievance or request.
HSH may seek additional information, documents, verification or clarifications before responding to or resolving any grievance or request and may decline to act on a request until it is reasonably satisfied as to the identity, authority or entitlement of the requester, where permitted under Applicable Law.
Where a request or grievance relates wholly or partly to a Third-Party Service or an independent Healthcare Professional, HSH may coordinate with such third party to investigate or respond to the request, and the time required to resolve the matter may depend upon the cooperation of such third party, subject to Applicable Law.
CHANGES TO THIS PRIVACY POLICY
HSH may modify, amend, supplement, replace or update this Privacy Policy or any part thereof, from time to time to reflect changes in the Platform, Services, Applicable Law, regulatory requirements, technology, security practices, business operations or for any other lawful reason.
Where required by Applicable Law or where reasonably practicable, HSH may notify Users of material changes through email, SMS, WhatsApp, in-app notification, website notice, dashboard notice or any other reasonable mode of communication or by publishing the updated Privacy Policy on the Platform with a revised "Last Updated" date.
Non-material, operational, administrative, corrective clarificatory or editorial changes may be made without individual notice.
Continued use of the Platform or Services after an updated Privacy Policy becomes effective shall constitute acceptance of the updated Privacy Policy, to the extent permitted under Applicable Law. Where Applicable Law requires fresh consent for specific changes to the processing of Personal Data, HSH shall obtain such consent in the manner prescribed by Applicable Law before undertaking such processing.
The "Last Updated" date appearing at the beginning or end of this Privacy Policy shall indicate the date on which the most recent version became effective, unless otherwise specified. Users are encouraged to review this Privacy Policy periodically to remain informed of any updates.
GOVERNING LAW
This Privacy Policy shall be governed by and construed in accordance with the laws of India without regard to its conflict of law principles.
Vance India who operates HSH shall be the primary contracting, service-providing and data processing entity unless expressly specified otherwise in writing for its users.
The mere involvement of Vance US, U.S. Physicians, overseas consultants, overseas technology providers, persons conducting Cross-Border Medical Review or other overseas recipients in providing or supporting the Services shall not, by itself, alter the applicability of Indian law to Indian Users, unless expressly agreed otherwise in writing or required under Applicable Law.
Nothing in this Privacy Policy shall prevent HSH or any relevant authority from complying with any mandatory legal or regulatory obligation applicable in any jurisdiction in relation to the processing, disclosure or protection of Personal Data, Health Data or Medical Records.
CONFLICT WITH TERMS AND CONDITIONS
This Privacy Policy shall be read together with the Terms and Conditions of Use and any other policies, consents, disclaimers or documents forming part of the contractual framework governing the Platform and Services.
In case of conflict between this Privacy Policy and the Terms and Conditions of Use on matters relating specifically to privacy, data protection, use, disclosure, processing, sharing, transfer, retention or user data rights, this Privacy Policy shall prevail solely to the extent of such conflict.
In case of conflict on service terms, disclaimers, refund, limitation of liability, indemnity, intellectual property, arbitration, governing law or general platform use, the Terms and Conditions of Use shall prevail. Nothing in this Privacy Policy shall be construed as limiting or overriding any mandatory rights or obligations arising under Applicable Law.
USER ACKNOWLEDGEMENT
By accessing, registering on, paying for, booking, using or continuing to use the Platform or Services, and where required by Applicable Law, by providing your consent through the applicable consent mechanism, you acknowledge and agree that:
you have read and understood this Privacy Policy;
you acknowledge and, where required under Applicable Law, consent to the collection, storage, processing, use, disclosure, transfer and retention of your Personal Data, Health Data and Medical Records in accordance with this Privacy Policy;
you acknowledge and, where required under Applicable Law, consent to sharing of your information with Indian Doctors, U.S. Physicians, Vance US, authorised overseas recipients, Healthcare Professionals, Caregivers, Diagnostic Partners, Hospital Partners, Pharmacy Partners, technology vendors, payment processors, cloud providers and other persons where necessary for Services or lawful purposes;
you understand that Medical Records and Health Data may be shared outside India for U.S. Physician review, second opinions, peer-to-peer advice, care coordination, AI-assisted review, quality assurance and related purposes;
you understand that primary storage may be maintained in India where commercially, technically and legally feasible, but cross-border access, viewing, transmission, disclosure or processing may occur;
you acknowledge and, where required under Applicable Law, consent to recording, transcription, translation, analysis and review of consultations, calls, chats, messages and care coordination communications for the purposes described in this Privacy Policy;
you understand that AI Tools may process your information for assistive, administrative, decision-support, summarisation, triage, workflow and service improvement purposes;
you understand that no digital platform, electronic communication, cloud system, software, server, database, internet transmission or storage system can be guaranteed to be completely secure;
you understand your rights to access, correction, erasure, consent withdrawal, nomination and grievance redressal, subject to Applicable Law; and
you agree to be bound by this Privacy Policy as amended from time to time in accordance with its terms and Applicable Law.
Nothing in this User Acknowledgement shall be construed as limiting any rights available to you under Applicable Law or as preventing HSH from relying on any other lawful basis for processing Personal Data where permitted under Applicable Law.
END OF PRIVACY POLICY
