This Privacy Notice (“Notice”) is published on 29th April, 2026.
Gleneagles Healthcare India Private Limited (“Gleneagles”) and its subsidiary, Centre for Digestive and Kidney Diseases (India) Private Limited (“CDKD”) (together, “we”, “our”, or “us”), are committed to protecting personal data responsibly and in line with applicable data protection laws. In this Privacy Notice, the terms “you”, “your”, and “yours” refer to the individual whose Personal Data is processed by us.
This Privacy Notice explains how we collect, use, share, store, and protect your personal data when you visit or interact with us via this website.
What personal data do we collect, store and process?
Depending on the nature of your interaction with us and the services you request, the personal data we collect, store and process include:
| S.no | Personal Data Category | Personal data elements |
|---|---|---|
| 1 | Personal and Demographic Particulars | Name, Age, Sex, Country of Residence, Marital Status |
| 2 | Health Data | Medical records, Blood test report, Radiology reports, Hospital visit detail |
| 3 | Transaction Data | Hospital Bill, Transaction ID, Payment Amount, Payment Details |
| 4 | Contact Information | Email ID, Mobile Number and Physical Address |
| 5 | Communication Records | Chatbot conversation, WhatsApp conversation, Query messages |
| 6 | Professional and Educational Qualification | Professional history, Educational history as part of CV |
| 7 | Marketing and Consent Preferences | Ad preferences, Consent choices, Video optimisation |
| 8 | Service Preference | Doctor, Appointment Date and Time, Speciality, Hospital Unit, Language preferences |
| 9 | System-generated Identifiers | Patient ID, Lead ID |
| 10 | Online Identifier and Technical Data | Session ID, Advertising ID, Visitor ID, Client ID, Device/Browser metadata, Debug flags |
| 11 | Authentication/Security Data | Secure tokens, Encrypted IDs |
How do we collect your Personal Data from?
During our interactions with you, we may collect certain Personal Data that is necessary to provide the services you request. If you choose not to provide such information, we may be unable to provide the requested services. In other cases, providing your Personal Data may be optional.
We may collect your Personal Data in the following situations:
Form Submission: When you submit a form on the website. (for example: to raise a query, book an appointment, or apply for a job opening listed on our careers page, etc.);
Account creation: When you create an account through the sign-up page on the MyGleneagles portal.;
Communications with us: When you share Personal Data with our teams through telephone communications, Chatbot interactions, email exchanges, or other communication and messaging platforms;
Marketing Sign up: When you sign up to receive our marketing and promotional communications;
Social Media and Interactions: when you interact, communicate with us and/or leave comments on our social media platforms;
Payments: When you make payments for our services through third-party payment gateways
Cookies and similar technologies: We may also collect certain Personal Data automatically through cookies and similar technologies when you use our websites, subject to your consent preferences as managed through our Cookie Banner. For more details, please see our Cookie Policy
How do we use your personal data?
Personal Data may be collected, used, transferred or otherwise processed for one or more of the following purposes:
| S.no | Purpose | Description |
|---|---|---|
| 1 | Provision of medical care | To provide medical care and healthcare services, including diagnosis, treatment, consultations, procedures, prescribing medication and medical emergencies. |
| 2 | Creation of Patient record | To create and maintain your patient records for medical care and continuity of care. |
| 3 | Online Patient Service | To create and manage your MyGleneagles account online, enabling you to access your medical records, billing information, and book or manage appointments online. |
| 4 | Billing and payments | To facilitate payment, billing and outstanding recovery relating to the services you requested. |
| 5 | Customer Service and support | To provide customer service, including responding to your queries, arranging and facilitating appointments, providing notifications and reminders, and addressing any issues or concerns you may raise with us. |
| 6 | Quality and service improvement | To use recordings of our communications with you for training and quality assurance purposes, and to analyse and improve our services, where you have provided your consent. |
| 7 | Marketing and promotions | To send you marketing and promotional communications, where you have provided your consent. |
| 8 | Employment-related purposes | If you are a prospective employee, we collect your Personal Data for employment evaluation purposes. |
| 9 | Optimise website experience | If you are a visitor to our website, we may process your Personal Data to optimize your experience, customize content, and track your digital footprint, based on your cookie consent preferences. |
| 10 | Legal and regulatory obligations | To comply with legal or regulatory requirements. |
On What Basis Do We Process Your Personal Data?
We process your Personal Data by relying on one or more of the following basis:
You have consented to us processing your Personal Data for one of the above specified reasons; or
You have voluntarily provided your Personal Data for a specified reason; or
The processing is necessary for compliance with statutory and regulatory obligations we may have towards other stakeholders like law enforcement agencies, government agencies, regulators, etc; or
The processing is required for employment purposes; and/or
For the legitimate use of responding to a medical emergency involving a threat to your life or immediate threat to your health.
Where the processing is based on your consent, you have the right to withdraw your consent at any point in time. In many cases, upon such a withdrawal, we may not be able to continue offering our services to you. You may withdraw consent by contacting us using the details specified in the ‘Contact Us’ section provided below.
How do we process Personal Data of Minors and Persons with Disability?
It is our intention to comply with applicable law, which requires the personal data of certain individuals- specifically children (under 18 years) and persons with disability— be processed only with the verifiable consent of the parent or the lawful guardian, as applicable.
If a parent or lawful guardian becomes aware that personal data of their child or of the person with disability under their care, has been provided without their consent, they may contact us using the details specified in the ‘Contact Us’ section provided below. Upon receipt of such a request, we will take steps to delete such personal data from our records in accordance with applicable law.
How do we ensure accuracy of Personal Data?
We strive to maintain Personal Data in a manner that is accurate, complete and up-to-date, for which the personal data you provide to us must be accurate, complete and up-to-date, and you must inform us of any significant changes to such Personal Data provided by you.
With whom do we share your personal data?
We may share your Personal Data, on a need to know basis, with:
Our affiliates and group companies for business and administration purposes;
Our third-party service providers, both healthcare and non-healthcare, including registered medical practitioners, diagnostic service providers, specialized or outsourced medical service companies, and other vendors who work for us or provide products and services to support your care or our operations;
Our corporate clients and partners, limited to their employees who are enrolled under our corporate healthcare, wellness, or related service arrangements;
To trainees/apprentices/students from educational institutions with which we have formal arrangements to undergo supervised hands-on training at our hospital, which may involve assisting in patient care.
Insurance agents/Third party agents with whom we have tie ups with.
Medical institutions with whom we have tie ups to facilitate your care and treatment; and
We may also share your Personal Data under the following circumstances:
To respond to court orders, or legal process, or to establish our legal rights or defend against legal claims;
To public and governmental authorities when required by law, in support of government initiatives or community programs; and
To other parties if we are involved in a sale, merger, reorganisation, joint venture, or transfer of ownership.
How long do we retain your Personal Data?
We keep your Personal Data as long as we need to fulfil the purposes for which it has been collected.
We retain Personal Data only:
for the period required to serve the purpose outlined in the privacy policy;
to the extent necessary to comply with an applicable legal and/or regulatory requirement; and/or as advised by applicable Data Protection Laws.
Promptly after applicable retention period has ended, your Personal Data will be appropriately deleted/de-identified.
How do we protect your Personal Data?
We are committed to protecting your Personal Data in our custody. We take reasonable steps to ensure that appropriate physical, technical and managerial safeguards are in place to protect your Personal Data from unauthorized access, alteration, transmission, and deletion. We train our employees about the importance of maintaining the privacy and security of your Personal Data. We ensure that the third parties with whom we share your Personal Data are under appropriate contracts and we take appropriate security measures to protect your Personal Data in line with our policies.
What Are Your Privacy Rights?
You have certain rights regarding your Personal Data shared with us as per the applicable data protection laws. We have provided a list of your rights,
Right to Access Information: You have the right to get confirmation and access to your Personal Data that is with us along with other supporting information.
Right to Correction and Erasure: You have the right to request to correct, complete, update and erase your personal data which is stored with us.
Right to nominate: You have the right to nominate another individual who may, in the event of your death or incapacity, exercise your rights in relation to your Personal Data.
Right of grievance redressal: You have the right to readily available means of grievance redressal in respect of any act or omission committed by us in relation to your personal data or your rights guaranteed under this act.
Right to withdraw consent: You have the right to withdraw your consent at any point of time. However, in some circumstances, we may have to limit the products and services provided to you due to withdrawal of your consent.
If you wish to make a request to exercise any of your rights, you can contact us using the details in the ‘Contact Us’ section of this Privacy Notice.
Cross-border transfer of Personal Data
Due to our international presence, your Personal Data may be accessed by or transferred to our affiliates located in various countries around the world, in order to fulfil some of the purposes described in this Notice.
As a result, your Personal Data may be transferred to jurisdictions outside India that may have data protection laws which differ from, or is substantially similar to, the standards under the Digital Personal Data Protection Act, 2023.
We may also engage authorised third-party service providers who may process or transfer your Personal Data outside India for the purpose of delivering services that support our operations and enable us to provide you with the requested services.
Links to third-party websites
Our website may contain links to websites of other organisations. This Privacy Policy does not apply to the personal data processing practices of such third-party websites. We encourage you to read the Privacy Policy of the other websites you visit.
How can you contact us?
If you have any inquiries, requests, feedback or complaints in relation to protecting your Personal Data, please contact the Data Protection Office via the following channels:
Email: grievance.dataprivacy@gleneagleshospitals.co.in
Written communication can be mailed to:
Gleneagles Hospitals - Corporate Office Hyderabad
2nd Floor, Laxmi Cyber Centre, 8-2-682,
Road No. 12, Fortune Enclave,
Sri Ram Nagar Colony, Banjara Hills,
Hyderabad, Telangana 500028
We will do our best to respond to you within a reasonable time and no longer than 60 days from the date we receive your inquiry, request, feedback or complaint.
Updates to Notice
We reserve the right to amend, update or revise this Notice from time to time. Any such amendments shall become effective as of the Effective Date indicated when the revised Notice is published on our website.
It is your responsibility to review this Notice periodically for any updates or changes. The most current version of this Notice, together with the date of the latest revision, will be made available on our website at all times.
