Privacy Policy

Effective Date: 05 October 2026
Last Updated: 05 October 2026

Metro Heart Institute with Multispeciality, Faridabad (“Metro Hospital”, “we”, “us”, or “our”)
respects the privacy of patients, attendants, website visitors, healthcare professionals,
business partners and other individuals who interact with us.

We are committed to handling personal data responsibly, transparently and securely in accordance
with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”)
and applicable rules made thereunder.

This Privacy Policy explains what personal data we may collect, why we collect it, how we use it,
with whom it may be shared, how long it may be retained, and the choices and rights available to individuals.

This Privacy Policy applies to personal data collected through:

• Metro Hospital’s website;
• Online appointment and enquiry forms;
• Health package booking forms;
• Doctor appointment forms;
• International patient enquiries;
• Second-opinion requests;
• Telephone and call-centre interactions;
• WhatsApp communications;
• SMS and email;
• Online payment services;
• Digital advertising campaigns and lead forms;
• Hospital-related digital services; and
• Other authorised digital channels operated by or on behalf of Metro Hospital.

1. About Metro Hospital

For the purposes of applicable data protection law, the relevant entity determining the purpose
and means of processing personal data may act as the Data Fiduciary.

Metro Heart Institute with Multispeciality
Sector 16A, Faridabad (Delhi-NCR) – 121002, India

General Contact: +91 129 691 1111 / 427 7777
Emergency: +91 971 191 4000
Ambulance: +91 989 944 9970

Website:

www.metrohospitalfaridabad.com

2. Personal Data We May Collect

The personal data we collect depends upon how you interact with Metro Hospital and the services you request.

A. Identity and Contact Information

This may include:

• Name;
• Mobile number;
• Telephone number;
• Email address;
• Postal address;
• Age or date of birth, where required;
• Gender, where relevant to the requested healthcare service; and
• Other contact information voluntarily provided by you.

B. Appointment and Healthcare Enquiry Information

This may include:

• Selected speciality;
• Preferred doctor;
• Requested appointment date or time;
• Health package selected;
• Symptoms or health concerns voluntarily entered in an enquiry;
• Reason for consultation;
• Previous communication with Metro Hospital; and
• Information provided for arranging or managing healthcare services.

C. Medical and Health-Related Information

Where necessary for providing healthcare or where voluntarily provided by you,
we may process information such as:

• Medical history;
• Diagnostic reports;
• Prescriptions;
• Investigation reports;
• Treatment-related information;
• Medical images;
• Referral information;
• Information provided for a second opinion; and
• Other health or clinical information relevant to your treatment or enquiry.

Medical information should only be submitted through authorised Metro Hospital channels intended for that purpose.

D. International Patient Information

For international patient services, we may collect information reasonably required to assist with
treatment planning or travel coordination, including:

• Nationality;
• Country of residence;
• Passport-related information where necessary;
• Visa-related information where necessary;
• Travel information;
• Medical reports;
• Proposed treatment details;
• Accompanying attendant information; and
• Other information required to facilitate international patient services.

We will seek to collect only information reasonably necessary for the requested service
or applicable legal or regulatory requirements.

E. Payment and Transaction Information

When you make a payment or request a refund, we may process information such as:

• Patient or payer name;
• Transaction reference;
• Amount;
• Payment status;
• Invoice or receipt details; and
• Limited payment-related information received from payment service providers.

Payments may be processed through authorised payment gateways or financial service providers.

Metro Hospital does not intend to collect or store complete debit card, credit card, CVV,
UPI PIN, online banking password or similar authentication credentials unless specifically
required and lawfully handled through an authorised secure payment mechanism.

F. Website and Technical Information

When you visit our website, certain technical information may be collected automatically, including:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Pages visited;
• Date and time of access;
• Referring page;
• Website interactions;
• Cookie identifiers;
• Approximate location derived from network or device information, where applicable and permitted; and
• Advertising or campaign attribution information.

Please refer to our
Cookie Policy
for more information.

G. Advertising and Lead Information

If you contact Metro Hospital through Google Ads, Meta platforms, search engines,
lead-form advertisements or other advertising channels, we may receive information submitted by you, including:

• Name;
• Mobile number;
• Email address;
• Selected service;
• Campaign or advertisement source; and
• Other information you choose to provide.

We may also receive campaign measurement information such as source, medium,
campaign identifier and advertising click identifiers where permitted.

3. How We Collect Personal Data

Directly from you

For example, when you:

• Complete an appointment form;
• Submit an enquiry;
• Request a health package;
• Contact our international patient desk;
• Request a second opinion;
• Contact us by telephone;
• Communicate through WhatsApp;
• Send us an email;
• Make an online payment;
• Visit Metro Hospital and provide information; or
• Communicate with an authorised representative of Metro Hospital.

Through authorised digital platforms

Information may also be collected when you voluntarily submit a lead or enquiry through
platforms such as Google or other digital advertising services.

Automatically

Certain technical information may be collected through cookies, analytics tools,
security technologies, server logs and similar technologies when you use our website.

From authorised representatives

Where appropriate, information may be provided by a parent, guardian, attendant,
family member, referring doctor or another person authorised to act on behalf of a patient.

4. Why We Process Personal Data

Appointment and Enquiry Management

We may process personal data to:

• Respond to enquiries;
• Schedule appointments;
• Connect you with the appropriate department or doctor;
• Confirm or reschedule appointments; and
• Provide requested information regarding Metro Hospital services.

Healthcare and Patient Services

Where applicable, information may be processed to:

• Support diagnosis and treatment;
• Maintain continuity of care;
• Provide investigations or healthcare services;
• Manage admission and discharge;
• Maintain medical or hospital records;
• Support clinical communication;
• Provide second opinions; and
• Fulfil healthcare-related responsibilities.

Service Communications

We may contact you regarding:

• Appointment confirmations;
• Appointment reminders;
• Requested callbacks;
• Treatment-related communication;
• Reports or service information;
• Payment or billing information; and
• Other communications reasonably connected with services requested by you.

International Patient Services

Information may be used for:

• Medical opinion or treatment planning;
• Appointment coordination;
• Communication with doctors or departments;
• Estimated treatment-related assistance;
• Visa or travel support where applicable;
• Accommodation or hospital logistics; and
• Other requested international patient services.

Payments and Refunds

Information may be processed for:

• Receiving payments;
• Issuing receipts;
• Reconciling transactions;
• Processing eligible refunds;
• Preventing fraudulent transactions; and
• Complying with accounting and legal obligations.

Website Operation and Security

Information may be processed to:

• Operate and maintain our website;
• Prevent misuse or unauthorised access;
• Investigate technical problems;
• Protect our systems;
• Detect fraud or malicious activity; and
• Maintain the security of our digital services.

Analytics and Performance Measurement

Subject to applicable requirements and user choices, we may use analytics technologies to understand:

• Website traffic;
• Website performance;
• Commonly visited pages;
• Effectiveness of website content;
• Conversion activity; and
• How users generally interact with our digital services.

Advertising Measurement

Where permitted, we may use advertising and measurement technologies to understand whether
advertisements result in actions such as:

• Appointment requests;
• Calls;
• Enquiry submissions;
• WhatsApp interactions; or
• Other relevant conversions.

We seek to avoid transmitting medical reports, detailed clinical information or unnecessary
health information to advertising platforms for advertising measurement.

Marketing Communications

Where required, marketing or promotional communications will be sent based on appropriate
consent or other applicable legal basis.

Such communications may include information about:

• Hospital services;
• Health programmes;
• Health camps;
• Events;
• Awareness programmes;
• New facilities; or
• Other relevant Metro Hospital communications.

Consent for promotional communication may be kept separate from information required
to respond to an appointment or treatment enquiry.

5. Consent

Where we rely on consent to process personal data, we aim to obtain consent through a clear
affirmative action and for a specified purpose.

The information presented at the time of collection may explain:

• What personal data is being requested;
• Why the information is required;
• How the information will be used; and
• How you can withdraw consent or exercise your applicable rights.

Submitting an appointment enquiry does not necessarily mean that you have agreed to receive
unrelated promotional communications.

Where marketing consent is sought separately, choosing not to provide marketing consent will
not prevent you from requesting an appointment or receiving necessary healthcare-related services.

6. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent, subject to applicable
law and any processing already lawfully undertaken.

You may withdraw or modify your consent through our:

Communication Preferences:

https://metrohospitalfaridabad.com/communication-preferences/

Privacy Request:

https://metrohospitalfaridabad.com/privacy-request/

Withdrawal of marketing consent will not ordinarily prevent Metro Hospital from sending
communications that are reasonably necessary for:

• An appointment requested by you;
• Healthcare services;
• Payment or billing;
• Patient safety;
• Legal or regulatory requirements; or
• Other necessary service-related purposes.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes including:

• Essential website functionality;
• Security;
• Remembering user choices;
• Website analytics;
• Performance measurement; and
• Advertising measurement, where applicable.

Where required, users will be provided with choices regarding optional analytics and advertising technologies.

Necessary Cookies – Always Active
Analytics Cookies – Accept / Reject
Advertising Cookies – Accept / Reject

You can review additional information in our
Cookie Policy.

You may also use the Cookie Settings option available on our website
to review or modify your preferences.

8. Google Analytics, Google Ads and Other Digital Platforms

Metro Hospital may use services provided by Google and other authorised digital technology
providers for:

• Website analytics;
• Advertising campaign measurement;
• Conversion tracking;
• Website performance analysis; and
• Campaign optimisation.

Where applicable, these technologies will be configured in accordance with user consent choices
and our internal privacy controls.

Information shared with advertising or analytics platforms should be limited to what is reasonably
required for the relevant purpose.

Metro Hospital does not intend to use detailed medical reports, diagnoses or unnecessary clinical
information for personalised advertising.

Use of third-party services may also be subject to the privacy terms of the relevant service provider.

9. Sharing of Personal Data

Metro Hospital does not sell personal data.

Personal data may, however, be shared where reasonably necessary with authorised parties, including:

Healthcare Professionals

Doctors, nurses, diagnostic teams, clinical departments and other healthcare professionals
involved in the requested healthcare service.

Metro Hospital Departments and Authorised Personnel

Only personnel who reasonably require access for the relevant purpose should be given access to personal data.

IT and Technology Service Providers

• Website hosting providers;
• IT support providers;
• Cloud service providers;
• CRM providers;
• Cybersecurity providers;
• Analytics providers; and
• Other technology vendors.

Communication Service Providers

We may use authorised providers to facilitate:

• Telephone communication;
• SMS;
• WhatsApp;
• Email;
• Appointment reminders; and
• Other service communication.

Payment Service Providers

Relevant transaction information may be processed through banks, payment gateways
or authorised financial service providers.

Professional Advisers

Where necessary, information may be shared with legal advisers, auditors, insurers
or other professional advisers subject to appropriate confidentiality requirements.

Government, Regulatory or Law-Enforcement Authorities

Information may be disclosed where required or authorised under applicable law,
legal process, court order, regulatory requirement or lawful government request.

Other Parties with Authorisation

Information may also be shared where you have authorised or requested such sharing.

Metro Hospital will seek to use reasonable contractual, organisational and technical measures
when engaging third-party service providers that process personal data on its behalf.

10. Data Retention

Metro Hospital retains personal data for only as long as reasonably necessary for the purpose
for which it was collected, or where retention is required under applicable:

• Healthcare laws;
• Medical record requirements;
• Taxation requirements;
• Accounting requirements;
• Insurance requirements;
• Regulatory requirements;
• Contractual obligations;
• Dispute-resolution requirements; or
• Other applicable laws.

Different categories of information may have different retention periods.

Clinical and patient records may need to be retained for periods determined by healthcare
or other regulatory requirements even where an individual withdraws consent for unrelated marketing communication.

Where personal data is no longer required and there is no applicable reason to retain it,
Metro Hospital may securely delete, anonymise, archive or otherwise dispose of the information
in accordance with applicable requirements and internal retention practices.

11. Security of Personal Data

Metro Hospital takes reasonable technical, organisational and administrative measures designed
to protect personal data against risks such as:

• Unauthorised access;
• Unauthorised disclosure;
• Alteration;
• Misuse;
• Loss;
• Destruction; and
• Personal data breaches.

Depending on the system and nature of information, safeguards may include:

• Access controls;
• User authentication;
• Role-based access;
• Secure communication;
• System monitoring;
• Backups;
• Logging;
• Endpoint and network security;
• Restricted administrative access;
• Employee access controls; and
• Appropriate safeguards for service providers.

However, no digital system or method of internet transmission can be guaranteed to be completely secure.

12. Personal Data Breach Management

Metro Hospital maintains processes intended to identify, investigate and respond to suspected
personal data breaches.

Where a personal data breach occurs, Metro Hospital may take appropriate steps including:

• Containing the incident;
• Investigating its nature and impact;
• Taking corrective and security measures; and
• Notifying affected individuals and/or applicable authorities where required by law.

13. Your Rights

Subject to the DPDP Act and other applicable laws, individuals may have rights relating to their personal data.

Request Information About Personal Data

You may request information regarding personal data being processed about you and relevant
processing activities as provided under applicable law.

Request Correction

You may request correction of inaccurate or misleading personal data.

Request Updating

You may request that incomplete or outdated personal data be appropriately updated.

Request Erasure

Where applicable, you may request erasure of personal data that is no longer necessary
for the relevant purpose, subject to legal, medical, regulatory or other lawful retention requirements.

Withdraw Consent

Where processing is based on consent, you may withdraw consent in accordance with applicable law.

Raise a Grievance

You may raise a concern or grievance regarding the processing of your personal data.

To exercise an applicable right, please visit:

Submit a Privacy Request

Metro Hospital may need to reasonably verify your identity before processing certain privacy
requests in order to protect patient confidentiality and prevent unauthorised access to personal data.

14. Grievance Redressal

If you have a concern regarding the handling of your personal data, you may first contact
Metro Hospital through the privacy contact provided below.

We will make reasonable efforts to review and respond to privacy grievances within the period
required under applicable law.

Nothing in this Privacy Policy restricts any right that may be available to you under applicable
law to approach an appropriate regulatory authority or the Data Protection Board of India where applicable.

15. Children’s Personal Data

Metro Hospital provides healthcare services to patients of different age groups, including children.

Where personal data of a child is processed based on consent, Metro Hospital will follow applicable
requirements concerning consent of a parent or lawful guardian.

Where personal data is processed for medical treatment, health services, emergency care,
patient safety or other circumstances recognised under applicable law, appropriate legal
provisions and healthcare requirements will apply.

Metro Hospital does not intend to use children’s personal data for behavioural monitoring,
tracking or targeted advertising in a manner prohibited by applicable law.

Parents or lawful guardians may contact Metro Hospital regarding personal data submitted on behalf of a child.

16. Emergency and Healthcare-Related Processing

Certain personal data may need to be processed without relying solely on ordinary consent
mechanisms where permitted under applicable law.

This may include situations involving:

• Medical emergencies;
• Threats to life or health;
• Provision of necessary healthcare;
• Epidemics or public health situations;
• Compliance with court or government orders; or
• Other circumstances permitted under applicable law.

Such information will be processed only to the extent reasonably necessary for the applicable purpose.

17. International Patients and Cross-Border Services

Patients located outside India may communicate with Metro Hospital for:

• Medical opinions;
• Treatment estimates;
• Appointments;
• Travel coordination;
• Visa assistance;
• Medical report review; and
• Other international patient services.

Personal data submitted by international patients may be processed in India.

Where personal data is transferred outside India or accessed by authorised service providers
in another jurisdiction, such transfer will be handled in accordance with applicable Indian laws
and any restrictions notified by the Government of India.

18. Marketing Communications

Metro Hospital may provide promotional or informational communications where appropriate and permitted.

Where consent is required, we will seek appropriate consent before using personal data for such marketing.

You may choose to stop:

• Promotional WhatsApp messages;
• Promotional SMS;
• Marketing emails; and
• Promotional telephone calls.

To update your preferences, visit:

Communication Preferences

Opting out of marketing communication does not necessarily stop appointment,
treatment, payment, emergency, patient-safety or other necessary service-related communication.

19. Automated Decision-Making

Metro Hospital does not intend to make significant healthcare decisions about a patient solely
through automated advertising or website technologies.

Clinical diagnosis and treatment decisions should be made by appropriately qualified healthcare
professionals based on relevant clinical information.

Where automated technologies are introduced into hospital operations, they will be assessed
and used subject to applicable legal, clinical and organisational requirements.

20. Third-Party Websites and Services

Our website may contain links to third-party websites, platforms or services.

Metro Hospital is not responsible for the privacy practices, security or content of independently
operated third-party services.

Users should review the privacy information of the relevant third party before providing personal data
through such services.

21. Accuracy of Information

You should make reasonable efforts to provide accurate and up-to-date personal information
when using Metro Hospital services.

You may request correction or updating of relevant personal information through our Privacy Request mechanism.

Providing incorrect patient, contact or medical information may affect our ability to provide requested services.

22. Do Not Submit Unnecessary Sensitive Information

When using general website forms such as “Contact Us” or ordinary enquiry forms, please avoid entering:

• Complete medical records;
• Aadhaar details;
• Passport copies;
• Banking passwords;
• Card PINs;
• UPI PINs;
• CVV numbers; or
• Other information not necessary for the enquiry.

Where medical documents or identity information are required, please use the authorised channels
communicated by Metro Hospital.

23. Changes to This Privacy Policy

Metro Hospital may update this Privacy Policy from time to time to reflect:

• Changes in law;
• Regulatory requirements;
• Changes in hospital services;
• Changes in technology;
• Changes in website functionality; or
• Changes in our personal-data processing practices.

The latest version will be published on this page along with the updated “Last Updated” date.

Where required by law, we may provide additional notice or seek fresh consent for material
changes affecting the purpose for which personal data is processed.

24. Contact Us for Privacy Matters

For questions about this Privacy Policy, processing of your personal data,
withdrawal of consent or exercise of applicable privacy rights, please contact:

Data Privacy / Grievance Contact
Metro Heart Institute with Multispeciality
Sector 16A, Faridabad (Delhi-NCR) – 121002, India

Email: [INSERT DEDICATED PRIVACY EMAIL]
Phone: +91 129 691 1111

Privacy Request:

https://metrohospitalfaridabad.com/privacy-request/

Metro Hospital recommends that privacy requests relating to patient records include sufficient
information to reasonably verify the identity of the patient or authorised representative while
avoiding submission of unnecessary identity documents.

---

Your Privacy Matters

Metro Hospital is committed to using personal data responsibly and only for appropriate healthcare,
operational, legal, security, analytics or communication purposes.

We continually review our digital systems, website forms, communications, service providers
and privacy practices to strengthen the protection of personal information and maintain transparency
with the individuals we serve.