Privacy Policy

TIME Hospital (Tripura Institute of Medical Excellence), Agartala, is committed to protecting the privacy and confidentiality of every patient, attendant and visitor. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have over it.

Please read this policy together with any consent form you sign at the hospital. By visiting this website, contacting us by phone or WhatsApp, or receiving care at our hospital, you acknowledge that you have read and understood this policy.

1. Who we are

This website, timehospitals.com, is owned and operated by Jayanta-Kanak Healthcare LLP, operating as TIME Hospital (Tripura Institute of Medical Excellence), a cardiac and multi-speciality hospital at Kuripukur, Near Tripura University, Agartala, West Tripura - 799022, Tripura, India. In this policy, "we", "us" and "our" refer to TIME Hospital.

For the purposes of the Digital Personal Data Protection Act, 2023, we act as the Data Fiduciary for the personal data described here, and you are the Data Principal.

2. Scope of this policy

This policy covers personal information we handle when you:

• browse or use this website;
• call us, message us on WhatsApp, or write to us by email;
• book or attend an OPD consultation, admission, surgery, diagnostic test or health check-up;
• use our emergency, ambulance, ICU, cath lab, dialysis, laboratory or imaging services;
• interact with our official pages on Facebook and Instagram;
• apply for a job, or deal with us as a vendor, referring doctor or partner.

It does not cover the privacy practices of any third party website or platform we link to. Those are governed by their own policies.

3. Information we collect

3.1 Information you give us directly

• Identity and contact details: name, age, date of birth, gender, address, mobile and landline numbers, email address, and, where required by law or by an insurer, a government issued identity number.
• Appointment details: the doctor or department you want, preferred date and time, and the reason for your visit.
• Attendant and emergency contact details: the name, relationship and phone number of the person accompanying you or to be contacted on your behalf.

3.2 Health and clinical information

When you receive care from us we create and hold clinical records, which may include your symptoms, medical and family history, allergies, diagnoses, prescriptions, treatment and surgical notes, laboratory and pathology results, ECG, echo, X-ray, CT and other imaging, cath lab and dialysis records, discharge summaries, and photographs or scans taken for clinical purposes.

Health information is treated as sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is handled with the additional care those rules require.

3.3 Billing, payment and insurance information

• Bills, receipts, package details and payment records.
• Insurance policy or scheme details, TPA reference numbers, pre-authorisation and claim documents where you ask us to bill an insurer or a government health scheme.
• Payments made by card or UPI are processed by our bank or payment partner. We do not store your full card number, CVV, UPI PIN or net banking password.

3.4 Information collected automatically on this website

This website has no login, no patient portal and no online forms. When you simply visit it, our hosting provider automatically records standard technical data such as your IP address, browser and device type, referring page, and the date and time of your request. This is used to serve the site, keep it secure and diagnose faults.

The site also stores a single preference in your browser's local storage, named th_lang, which remembers whether you chose English or Bengali. It contains no personal information and you can clear it at any time from your browser settings.

4. How we use your information

Purpose	Basis
Registering you, scheduling appointments, and providing diagnosis, treatment, nursing and follow-up care	Your consent, and provision of the medical service you asked for
Confirming, rescheduling or reminding you about appointments, reports and follow-ups	Your consent
Billing, payment, insurance and government scheme claims	Performance of our contract with you, and legal obligations
Maintaining medical records, quality of care review, clinical audit and infection control	Legal obligation and legitimate hospital operations
Responding to your questions on phone, WhatsApp, email or social media	Your consent
Mandatory reporting to public health and statutory authorities	Legal obligation
Health camps, health awareness messages and hospital updates	Your consent, which you may withdraw at any time
Protecting the safety and security of our patients, staff and premises	Legitimate interest and legal obligation

We do not sell your personal data. We do not share your health information with advertisers, and we do not use your health information to target advertising to you.

5. WhatsApp, calls and SMS

We use WhatsApp, voice calls and SMS to communicate with patients and their families. Our published WhatsApp number is +91 60094 86548.

When you message us on WhatsApp, or when we message you:

• We receive your WhatsApp phone number, your WhatsApp profile name and the content of your messages, including any photos, prescriptions or reports you choose to send.
• We use this only to answer your query, book or confirm an appointment, share instructions, reports or bills, and send follow-up or health reminders you have asked for.
• Messages are transmitted through the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates. Meta processes message data as described in the WhatsApp Business Privacy Policy. WhatsApp applies end to end encryption in transit, but once a message reaches our business account it is stored and handled by us under this policy.
• We may use a customer messaging tool or authorised business solution provider to manage these conversations on our behalf, under written confidentiality obligations.

Opting out: you can stop receiving WhatsApp or SMS messages from us at any time by replying STOP, by blocking the number, or by telling us on +91 60094 86548 or at timehospital25@gmail.com. We will still contact you where it is necessary for your ongoing treatment or where the law requires it.

6. Website, cookies and embedded content

We do not set advertising or analytics cookies on this website. We do not run Google Analytics, the Meta Pixel or any similar tracking tool here. The only thing we store in your browser is the language preference described in section 3.4.

To provide some parts of the site we embed content from other companies:

• Google Maps shows the map on our Contact section, and Google Fonts supplies the site's typefaces. Loading these means Google receives your IP address and basic device information.
• The Facebook Page plugin displays our latest public posts. If you are logged in to Facebook, Meta may recognise you and set its own cookies.
• Links to our Facebook and Instagram pages, and the WhatsApp chat button, open services operated by Meta.

These companies act as independent controllers of the data they receive through those embeds. You can limit this by using your browser's privacy settings or a content blocker.

The website is hosted on Vercel and our domain email runs on Zoho Mail, both of which process data on our instructions as service providers.

7. How we share information

We share your information only where it is necessary, and only with:

• Your treating team: doctors, consultants, nurses, technicians and other clinical staff involved in your care.
• Referral partners: external laboratories, imaging centres, blood banks and hospitals to which you are referred, or from which a sample or report is obtained.
• Insurers, TPAs and government health schemes, where you ask us to raise a claim or seek cashless treatment on your behalf.
• Family members or attendants whom you have authorised, and, where you are unable to consent, your next of kin or legal guardian.
• Statutory and regulatory authorities: for example, notifiable disease reporting, birth and death registration, medico-legal cases, court orders, and lawful requests from the police or a government body.
• Service providers who work for us under confidentiality obligations, such as our hospital information system vendor, website host, email provider, messaging platform, payment processor, and auditors or legal advisers.

We may also use fully anonymised or aggregated data, which cannot identify you, for clinical audit, teaching, research and public health statistics.

8. How we protect your information

We follow reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000. These include:

• access to medical records restricted to authorised staff on a need to know basis;
• password protected systems and role based access in our hospital information system;
• encryption of data in transit on this website (HTTPS) and on our email;
• physical security for paper records and restricted access to clinical areas;
• confidentiality obligations in the contracts of our employees and vendors;
• periodic review of our access controls and backups.

No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023.

9. How long we keep your information

Type of record	Retention period
Outpatient and inpatient medical records	At least 3 years from the date of the last entry, in line with the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002
Medico-legal case records	Retained for a longer period as required by law or until the case concludes
Billing, tax and insurance records	As required under tax, GST and company law, generally 8 years
WhatsApp, email and call enquiry records	Kept only as long as needed to deal with your enquiry, then deleted, unless the exchange forms part of your clinical record
CCTV footage	Overwritten on a rolling basis in the normal course, unless specific footage is required for an investigation or legal proceeding
Website server logs	As retained by our hosting provider, typically up to 30 days

After these periods we securely delete or destroy the records, or retain them in an anonymised form that cannot identify you.

10. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed, and obtain a copy of your medical records. Under the Indian Medical Council Regulations we will provide records within 72 hours of a written request.
• Correct inaccurate or incomplete personal data, and have it updated or completed.
• Erase personal data that is no longer needed for the purpose it was collected, except where we are required by law to keep it.
• Withdraw consent at any time, for example for appointment reminders or health awareness messages. Withdrawal does not affect processing already carried out.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Raise a grievance with us, and, if you are not satisfied, with the Data Protection Board of India.

To exercise any of these rights, contact us using the details in section 15. We may need to verify your identity before acting on a request. We aim to respond within 30 days.

11. Children and persons with a guardian

We treat patients of all ages. Where a patient is under 18, or is a person with a disability who has a lawful guardian, personal data is collected and consent is given by the parent or legal guardian. We do not knowingly use children's data for tracking, behavioural monitoring or targeted advertising.

12. Storage and transfers

Your data is primarily stored on servers located in India. Some of our service providers, including Meta for WhatsApp messaging and our email and website hosting providers, may process limited data on servers outside India. Where this happens we rely on the terms of service and data protection commitments of those providers, and we transfer only what is necessary.

13. Third party links and health information on this site

This website links to external sites, including our social media pages and map services. We are not responsible for the content or privacy practices of those sites.

Information about specialities, facilities, doctors and health topics on this website is provided for general information only. It is not medical advice and must not be used to diagnose or treat a condition. Always consult a qualified doctor.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology or the law. The revised version will be posted on this page with a new "Last updated" date. If the changes are significant, we will make that clear on the website or notify you directly. Please review this page periodically.

15. Contact us and grievance redressal

If you have a question about this policy, want to exercise your rights, or wish to make a complaint about how we have handled your personal data, please contact our Grievance Officer. This officer is designated under Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and acts as the contact point for questions under the Digital Personal Data Protection Act, 2023.

We will acknowledge your complaint within 24 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.