Patient Privacy Notice (OPD/IPD, Printable, EN + HI)
The s.5 itemised notice, written for a registration counter rather than a website — what the hospital collects, why, who else sees it, and how a patient exercises their rights. Printable for OPD/IPD display and attachment to the registration form.
# Patient Privacy Notice
**[HOSPITAL_NAME]** — issued under DPDP Act 2023 **s.5** (notice) and
**DPDP Rules 2025 r.3** (how notice must be presented).
> **How to use this.** Display at the registration counter and in every
> OPD/IPD admission pack. Under **s.5(3)** the patient may ask for this in
> English or any language in the Eighth Schedule — keep the
> [CUSTOMIZE: local language] version alongside the English one. Notice
> must be **standalone and understandable on its own** (r.3), not a clause
> buried in a consent-to-treatment form.
## 1. What we collect about you
| Category | Examples | Why we hold it |
|---|---|---|
| Identity & contact | Name, age, sex, address, phone, next of kin | Registration, communication, billing |
| Government ID | [CUSTOMIZE: list only what you actually take — Aadhaar / PAN / insurance ID] | [CUSTOMIZE: state the purpose and the law or scheme requiring it] |
| Clinical | Complaints, diagnoses, prescriptions, investigation and imaging reports, operative notes | Diagnosis and treatment |
| Financial | Bills, payment records, insurance/TPA claim details | Billing, insurance claims |
| Images & recordings | [CUSTOMIZE: clinical photography, radiology images, CCTV in non-clinical areas] | [CUSTOMIZE] |
> Collect the minimum needed. If a field on your registration form has no
> stated purpose, it should not be on the form. Do **not** list a category
> here that you do not actually collect — this notice is evidence, and an
> aspirational notice is a false statement about your own processing.
## 2. Who else sees your information
- **Treating clinicians and hospital staff**, on a need-to-know basis.
- **Laboratories, imaging centres and pharmacies** we send work to.
- **Your insurer or TPA**, where you are making a claim.
- **Software vendors** who run our hospital management system, lab system
or billing system on our behalf. They act only on our instructions under
a written contract (**s.8(2)**). See `hospital-vendor-assessment`.
- **Where the law requires it** — [CUSTOMIZE: notifiable-disease reporting,
medico-legal cases, court or police requisitions, statutory registries.
List the ones that actually apply to your establishment.]
## 3. How long we keep it
Medical records are kept for the period required by the law applicable to
this establishment, and then erased.
**[CUSTOMIZE: state your retention period and the source.]** Retention of
medical records is **not** set by the DPDP Act. It is set by the Clinical
Establishments Act and the rules of [CUSTOMIZE: your state], NMC
regulations, and limitation periods for claims. Get this figure from your
legal adviser and cite the source here. See
`hospital-records-retention` for the full schedule and the genuine
conflict with DPDP Act s.8(7).
## 4. Your rights (ss.11-14)
You may:
- **ask what we hold** about you and who we have shared it with (s.11);
- **ask us to correct or complete** inaccurate details (s.12);
- **ask us to erase** your data where we no longer need it — subject to the
retention law above, which can require us to keep clinical records even
when you ask us to delete them (s.12);
- **nominate** someone to exercise your rights if you are unable to (s.14);
- **withdraw consent** you gave for anything that is not required for your
treatment or by law — for example marketing or research participation
(s.6(4)). Withdrawing that consent will **not** affect your treatment.
**How to ask:** [CUSTOMIZE: counter / email / form]. We will respond within
[CUSTOMIZE: your stated period].
## 5. Complaints (s.8(10))
Speak to our Grievance Officer first:
**[CUSTOMIZE: name / role]** · [CUSTOMIZE: email] · [CUSTOMIZE: phone]
· [CUSTOMIZE: desk location and hours]
If you are not satisfied, you may complain to the **Data Protection Board
of India**.
## 6. If something goes wrong (s.8(6))
If a personal data breach affects your information, we will inform you and
the Data Protection Board as required. See the hospital's breach
procedure.
## हिन्दी (s.5(3): Eighth Schedule language)
**हम क्या एकत्र करते हैं:** नाम, आयु, पता, संपर्क एवं परिजन का विवरण
(पंजीकरण, संचार एवं बिलिंग हेतु); सरकारी पहचान पत्र [CUSTOMIZE: केवल जो
वास्तव में लिया जाता है]; नैदानिक जानकारी — शिकायतें, निदान, नुस्खे, जाँच
एवं इमेजिंग रिपोर्ट (निदान एवं उपचार हेतु); बिल तथा बीमा/टीपीए दावे का
विवरण।
**हम किसके साथ साझा करते हैं:** उपचार करने वाले चिकित्सक एवं कर्मचारी
(आवश्यकतानुसार); प्रयोगशाला, इमेजिंग केंद्र एवं फार्मेसी; आपका बीमाकर्ता या
टीपीए (दावे की स्थिति में); हमारे सॉफ़्टवेयर विक्रेता, जो लिखित अनुबंध के
अंतर्गत केवल हमारे निर्देश पर कार्य करते हैं (धारा 8(2)); तथा जहाँ कानून
अपेक्षा करता है।
**हम कितने समय तक रखते हैं:** चिकित्सा अभिलेख उस अवधि तक रखे जाते हैं जो
इस संस्थान पर लागू कानून के अंतर्गत आवश्यक है — [CUSTOMIZE: अवधि एवं
स्रोत]। यह अवधि डीपीडीपी अधिनियम से निर्धारित नहीं होती, बल्कि क्लिनिकल
एस्टैब्लिशमेंट्स अधिनियम एवं संबंधित नियमों से।
**आपके अधिकार (धारा 11–14):** हम आपके बारे में क्या रखते हैं यह जानना;
अशुद्ध विवरण में सुधार कराना; मिटाने का अनुरोध करना (ऊपर दी गई
अभिलेख-प्रतिधारण अवधि के अधीन); अपनी ओर से अधिकारों का प्रयोग करने हेतु
किसी को नामित करना; तथा उपचार अथवा कानून के लिए आवश्यक न होने वाली किसी भी
सहमति — जैसे विपणन या शोध — को वापस लेना (धारा 6(4))। सहमति वापस लेने से
आपके उपचार पर कोई प्रभाव नहीं पड़ेगा।
**शिकायत (धारा 8(10)):** पहले हमारे शिकायत निवारण अधिकारी से संपर्क करें —
[CUSTOMIZE: नाम/पद], [CUSTOMIZE: ईमेल], [CUSTOMIZE: फोन]। संतुष्ट न होने पर
आप भारतीय डेटा संरक्षण बोर्ड (Data Protection Board of India) में शिकायत कर
सकते हैं।
---
*Owner: [ROLE] · Review: [ANNUALLY] · Version: [VERSION] · Date: [DATE]*
*Displayed at: [CUSTOMIZE: OPD registration, IPD admission desk, website]*