Privacy Policy

Introduction

Sri Muthukumaran Medical College Hospital & Research Institute (”SMMCHRI”, “the Institution”, “we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of the personal data entrusted to us.

This Privacy Policy describes how SMMCHRI collects, processes, stores, uses, shares, retains, and safeguards personal data relating to students, patients, parents, faculty members, employees, applicants, alumni, researchers, vendors, visitors, and users of our digital services.

This Policy has been prepared in accordance with the principles of the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable laws of India.

Applicability

This Policy applies to all personal data processed through:

Official SMMCHRI website
Hospital Information System (HIS)
Learning Management System (LMS)
Student Information System
Parent Portal
Faculty Portal
Employee Portal
Hospital Patient Portal
Mobile Applications
Online Admissions
Online Appointments
Telemedicine Services
Research Platforms
Institutional ERP
Email and Communication Systems
Helpdesk and Support Services
Physical and Digital Records maintained by SMMCHRI

Definitions

For the purpose of this Policy:

Personal Data means any data about an individual who is identifiable by or in relation to such data.

Processing includes collection, recording, storage, organisation, use, disclosure, sharing, retrieval, modification, deletion, or destruction of personal data.

Data Principal means the individual to whom the personal data relates.

Data Fiduciary means SMMCHRI, which determines the purpose and means of processing personal data.

Consent means a free, specific, informed, unconditional, and unambiguous indication of the Data Principal’s agreement to process personal data for a specified purpose.

Information We Collect

Depending on the services provided, SMMCHRI may collect:

A. Personal Information

Name
Photograph
Gender
Date of Birth
Nationality
Residential Address
Email Address
Mobile Number
Emergency Contact
Parent or Guardian Details
Government-issued Identification
Signature

B. Academic Information

Admission Records
Registration Number
Roll Number
Course Details
Attendance
Examination Results
Assignments
Academic Performance
Clinical Postings
Internship Records
PG e-Logbook
Competency Records
Learning Progress

C. Employee Information

Employment Records
Qualification Details
Payroll Information
Attendance
Leave Records
Performance Appraisals
Professional Registration Details

D. Patient Information

Medical History
Clinical Notes
Diagnosis
Laboratory Reports
Imaging Reports
Prescriptions
Treatment Plans
Surgical Records
Pharmacy Records
Insurance Information
Billing Records
Follow-up Information

E. Technical Information

IP Address
Browser Information
Device Information
Operating System
Cookies
Access Logs
Login History
Crash Reports
Usage Analytics

Purpose of Processing

SMMCHRI processes personal data only for lawful purposes, including:

Delivering healthcare services
Providing emergency medical care
Managing admissions
Conducting educational programmes
Operating LMS and ERP platforms
Maintaining attendance
Managing examinations
Supporting research activities
Managing employees
Regulatory compliance
Financial administration
Patient care
Academic administration
Security monitoring
Fraud prevention
Quality improvement
Responding to enquiries
Institutional communication
Appointment scheduling
Telemedicine services
Legal compliance

Lawful Basis for Processing

Personal data may be processed:

With the consent of the Data Principal;
To provide healthcare services;
For educational and academic administration;
To comply with legal or regulatory obligations;
To protect life or health in emergencies;
For employment-related purposes;
For public health requirements;
For research, audits, accreditation, and quality assurance, where permitted by law.

Consent

Where consent is required, SMMCHRI shall:

Obtain consent before processing personal data.
Clearly explain the purpose of collection.
Process data only for the stated purpose.
Allow withdrawal of consent where legally permissible.

Withdrawal of consent shall not affect processing already carried out lawfully or processing required by law or institutional obligations.

Children's Personal Data

Where personal data relates to minors, SMMCHRI shall obtain consent from a parent or lawful guardian where required by applicable law.

Personal data of children shall be processed only for healthcare, education, admission, safety, welfare, or other lawful institutional purposes.

SMMCHRI does not knowingly process children's personal data for advertising or unrelated commercial purposes.

Learning Management System (LMS)

The LMS may collect:

Login Information
Attendance
Assignments
Assessments
Learning Progress
Faculty Feedback
PG e-Logbook
Competency Records
Academic Communications

Access to LMS data is role-based and restricted to authorised users.

Hospital Information

Patient information is processed solely for:

Medical treatment
Diagnosis
Laboratory Services
Pharmacy
Surgery
Billing
Insurance
Clinical Audit
Infection Control
Quality Assurance
Medical Education
Research where applicable and appropriately approved

Research Data

Where personal data is processed for research purposes, SMMCHRI shall comply with applicable ethical standards, Institutional Ethics Committee requirements, participant consent requirements, and applicable laws.

Research data shall be protected with appropriate technical and organisational safeguards.

Cookies and Analytics

SMMCHRI may use:

Essential Cookies
Functional Cookies
Analytics Cookies
Session Cookies

Cookies are used to improve website functionality, maintain secure sessions, analyse usage patterns, and enhance user experience.

Users may disable cookies through browser settings; however, certain features may not function correctly.

Sharing of Personal Data

Personal data may be shared only where necessary with:

Internal departments
Faculty members
Hospital staff
Administrative personnel
Universities
Regulatory authorities
Government agencies
National Medical Commission
Examination authorities
Cloud service providers
LMS vendors
ERP vendors
IT service providers
Diagnostic partners
Insurance providers
Payment service providers
Law enforcement authorities where legally required

SMMCHRI does not sell personal data.

Data Processors

Third-party service providers processing personal data on behalf of SMMCHRI shall be contractually obligated to:

Maintain confidentiality;
Implement appropriate security measures;
Process personal data only under SMMCHRI's instructions; and
Comply with applicable data protection laws.

Cross-Border Data Transfers

Where SMMCHRI uses cloud infrastructure or service providers that process personal data outside India, such transfers shall be carried out in accordance with applicable Indian laws and subject to appropriate contractual, technical, and organisational safeguards.

Data Security

SMMCHRI implements reasonable safeguards including:

Encryption where appropriate
Firewalls
Role-based access controls
Multi-factor authentication where applicable
Audit logs
Backup systems
Secure hosting
Antivirus protection
Vulnerability assessments
Network monitoring
Physical security controls

No electronic system is completely secure; however, SMMCHRI continuously works to minimise security risks.

Data Retention

Personal data shall be retained only for as long as necessary for:

Patient care
Academic administration
Employment
Regulatory compliance
Legal obligations
Accreditation
Financial audits
Research
Record preservation

Retention periods may be extended where required by law, court order, regulatory authority, or institutional policy.

Rights of Data Principals

Subject to applicable law, Data Principals may:

Request access to their personal data.
Request correction of inaccurate data.
Request updating of incomplete information.
Request erasure where legally permissible.
Withdraw consent.
Seek grievance redressal.
Nominate another person to exercise their rights where permitted by law.

Requests may be subject to identity verification and statutory or institutional limitations.

Duties of Data Principals

Users are expected to:

Provide accurate information.
Update information when changes occur.
Protect their login credentials.
Refrain from impersonating others.
Avoid misuse of institutional systems.
Submit only genuine requests and grievances.

Personal Data Breach

In the event of a personal data breach, SMMCHRI shall:

Assess the incident.
Contain the breach.
Investigate the cause.
Mitigate adverse effects.
Notify affected individuals and competent authorities where required by applicable law.
Implement corrective measures to reduce future risks.

Third-Party Links

SMMCHRI's website or applications may contain links to third-party websites or services. SMMCHRI is not responsible for their privacy practices, content, or security. Users are encouraged to review the privacy policies of such third parties.

Changes to this Policy

This Privacy Policy may be revised periodically to reflect changes in law, technology, institutional practices, or operational requirements. The latest version will always be available on the official SMMCHRI website.

Grievance Officer

For questions, requests, or grievances regarding personal data, please contact:

Grievance Officer

Sri Muthukumaran Medical College Hospital & Research Institute (SMMCHRI)
Chikkarayapuram, Near Mangadu,
Chennai – 600069, Tamil Nadu, India
Email: grievances@smmchri.res.in
Phone: 044-66344000

SMMCHRI will endeavour to acknowledge and address grievances within a reasonable period in accordance with applicable law.

Contact Us

Sri Muthukumaran Medical College Hospital & Research Institute (SMMCHRI)
Chikkarayapuram, Near Mangadu,
Chennai – 600069, Tamil Nadu, India
Website: https://www.smmchri.res.in
General Email: info@smmchri.res.in
Telephone: 044-66344000

Acceptance of this Policy

By accessing or using SMMCHRI's website, hospital services, academic platforms, mobile applications, LMS, ERP, patient portals, or related digital services, you acknowledge that you have read, understood, and accepted this Privacy Policy.

Where consent is required by applicable law, such consent shall be obtained before processing your personal data.