Patient Data Policy

Introduction

Curolive Care Multispeciality Clinic ("Curolive", "we", "us", or "our"), located at Sarjapur Main Road, Bangalore, is committed to protecting the privacy and confidentiality of every patient who walks through our doors or interacts with us online at curolive.com.

This Patient Data Policy describes how we collect, use, disclose, store and protect personal and medical information in the course of providing healthcare services. It applies to all patients, including those who book appointments online, visit our clinic in person, undergo diagnostic tests, or otherwise engage with our services.

Information We Collect

We collect information necessary to provide you with safe, accurate and personalised healthcare. This includes information you provide directly, information generated during your treatment, and limited technical information when you use our website.

We collect this information through appointment booking forms (online and in-clinic), consultations with our doctors and therapists, diagnostic and laboratory tests, and your interactions with our website and customer support channels.

How We Use Your Data

We use your information strictly for purposes connected to your care and the operation of our clinic. These purposes include:

• Providing clinical care — diagnosing conditions, planning treatment, prescribing medication and coordinating between specialists involved in your care.
• Appointment management — scheduling, confirming, rescheduling and sending reminders for your visits.
• Billing and insurance processing — generating invoices, processing payments and liaising with insurers where applicable.
• Continuity of care — maintaining your medical history so that any doctor you see at Curolive Care has accurate context for your treatment.
• Legal and regulatory compliance — meeting record-keeping obligations under Indian healthcare and data protection law.
• Quality improvement — using de-identified, aggregated data to improve our services, never used to identify you individually.
• Communication — sending appointment confirmations, lab results, and (only with your consent) health tips or clinic updates.

Who We Share It With

We disclose your information only when necessary and only to the following categories of recipients:

• Treating doctors and clinical staff at Curolive Care directly involved in your care.
• Diagnostic and laboratory partners when external testing is required, limited to the information necessary for that test.
• Insurance providers, only with your explicit authorisation, for claims processing.
• Referral specialists outside Curolive, only when you are referred for further treatment and only with your consent.
• Regulatory and legal authorities, where required by law, court order, or public health reporting obligations.
• IT and software service providers who support our electronic medical records and booking systems, bound by strict confidentiality agreements.

We do not share your personal or medical information with any third party for marketing, advertising, or commercial research purposes without your explicit, informed consent.

Data Storage & Security

We take the security of your information seriously and apply multiple layers of protection across both physical and digital records:

• Restricted access — only authorised clinical and administrative staff directly involved in your care can access your records, governed by role-based permissions.
• Encrypted digital storage — electronic medical records and our appointment system are stored on secured servers with encryption in transit and at rest.
• Secure physical records — any physical documents are stored in locked, access-controlled areas of the clinic.
• Staff confidentiality agreements — every employee and contractor with access to patient data signs a confidentiality undertaking as a condition of employment.
• Regular security reviews — our systems and access logs are periodically reviewed to detect and prevent unauthorised access.

While we take every reasonable precaution, no system can guarantee absolute security. In the unlikely event of a data breach affecting your personal information, we will notify you and relevant authorities in accordance with applicable law.

Data Retention

We retain your medical records for as long as required to provide ongoing care and to comply with applicable Indian medical record-keeping regulations, which generally require clinical records to be retained for a minimum period following your last visit.

You may request earlier deletion of non-clinical personal data (such as marketing communication preferences) at any time, subject to our legal obligation to retain core medical records.

Your Rights

As a patient, you have meaningful control over your personal and medical information. These rights include:

To exercise any of these rights, please contact us using the details in Section 11. We aim to respond to all requests within 30 days.

Cookies & Website Data

When you visit curolive.com, we may use cookies and similar technologies to improve your browsing experience, understand how visitors use our site, and remember your preferences (such as language or previously viewed pages).

• Essential cookies enable core website functionality such as appointment booking forms.
• Analytics cookies help us understand site usage patterns to improve content and navigation.
• You can disable cookies through your browser settings at any time; doing so may affect certain website features.

Information submitted through online appointment or contact forms on our website is transmitted securely and handled under the same standards described throughout this policy.

Children's Data

For patients under the age of 18, we collect and process personal and medical information with the consent of a parent or legal guardian. Parents and guardians have the right to access, correct, or request deletion of their child's information, subject to applicable medical record retention requirements.

Our paediatric services follow the same data protection standards outlined in this policy, with additional care taken to ensure information is shared only with authorised parents, guardians, or legal representatives.

Policy Updates

We may update this Patient Data Policy from time to time to reflect changes in our practices, technology, legal requirements, or services offered. Any material changes will be communicated through a notice on our website or, where appropriate, directly to patients.

The "Last updated" date at the top of this page indicates when this policy was most recently revised. We encourage you to review this page periodically to stay informed about how we protect your information.

Contact Us

If you have questions about this Patient Data Policy, wish to exercise any of your rights, or have concerns about how your information has been handled, please reach out to our team directly:

For urgent matters relating to your ongoing care, please call our main line directly rather than using this email address.