This notice is a pre-commercial draft pending Indian privacy counsel review and confirmation of operating-entity, contact, vendor, region, retention, children, and outbound-channel facts. It is useful for product testing but is not evidence that every described process is operational or that nnhans is certified or fully compliant.

The Digital Personal Data Protection Act, 2023 and its Rules commence in phases, so counsel must maintain the dated applicability map. The Information Technology Act section 43A, the SPDI Rules, and CERT-In obligations may apply alongside those phased duties. This notice covers visitors, data principals, authorized users, tenants, and imported lead records; an executed services agreement will govern conflicting customer commercial terms once one exists.

nnhans processes account, tenant, patient, referral, appointment, outreach, audit, and support information that authorized organizations and users provide through the service.

A hospital or its agency may operate a Meta Page, advertisement, and Meta Instant Form and is responsible for the form's collection notice. nnhans does not create or publish that advertising; it imports the resulting lead and available Meta identifiers into the hospital's workspace for authorized follow-up.

We also process limited technical and security information needed to authenticate users, protect accounts, diagnose errors, maintain audit records, and remember essential service preferences.

For patient, referral, appointment, clinical, outreach, and tenant records entered into the service, the hospital, clinic, doctor, or other subscribing organization may determine why and how the information is used, with nnhans processing on documented instructions. The exact fiduciary/processor role depends on each purpose and contract and remains subject to counsel review.

The hospital or clinic determines the purpose of the lead collection and is ordinarily the data fiduciary for its Meta form. nnhans processes the imported information on the hospital's documented instructions. The final role for each purpose remains subject to the executed customer agreement and counsel review.

We use information only to provide, secure, operate, improve, and administer the service; import inquiries into the appropriate authorized organization's workspace; coordinate permitted follow-up; support patient, referral, appointment, and outreach workflows; prevent misuse; and comply with applicable legal obligations. Importing a lead does not grant permission for promotional contact.

Hospitals, clinics, and other organizations using nnhans remain responsible for ensuring that personal information is collected and entered with all required notices, permissions, consents, and lawful authority under applicable privacy, healthcare, professional, and confidentiality obligations. If an organization collected your information, that organization is normally the first point of contact for questions about its records or follow-up.

nnhans does not sell personal information. We may disclose information only to authorized users of the relevant organization, contracted service providers that help operate or secure the service, infrastructure and security providers, professional advisers, or government and judicial authorities where legally required. Service providers are permitted to process information only for the services they supply to us.

Information is retained only for as long as reasonably necessary to provide the service, support the authorized organization's operational and record-keeping needs, maintain security and audit records, resolve disputes, and meet legal obligations. Retention may vary according to the organization's instructions and the type of record involved. The retention, deletion, anonymization, backup, and legal-hold schedule is still pending approval and operational testing.

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or loss. No online service can guarantee absolute security or uninterrupted availability, so organizations using nnhans must also maintain appropriate access controls, account reviews, backups, and continuity procedures.

You may ask the organization that collected your information to access, correct, restrict, or delete it, subject to applicable law and record-retention requirements. Authorized nnhans account users should contact their tenant administrator for account and organization records.

If your request concerns information submitted through a hospital or clinic's Meta Instant Form, contact that organization first and provide the approximate submission date so it can locate the inquiry.

If no organization has received the submission, or the request concerns nnhans's own handling of information, contact the nnhans pre-commercial privacy request route at privacy@nnhans.com. Please describe the request and provide enough information for us to locate the relevant record. The company must assign and verify the statutory grievance role, public entity details, and response workflow before launch. You may use this route to ask about access, correction, restriction, or erasure rights in the meantime.

Enabled vendors, processing regions, remote support access, and transfer safeguards have not yet been fully reconciled. They must be verified against the hosted environment and approved contracts before commercial launch; no transfer assurance is made by this draft.

A draft incident plan covers containment, evidence preservation, customer coordination, and CERT-In/DPDP decision paths. If an incident affects tenant information, nnhans will notify the affected hospital or clinic without undue delay and assist with applicable notification obligations. The plan must be approved, staffed, and exercised before launch; timing will follow incident-specific legal and contractual duties.

A data processing agreement template is being prepared to cover documented instructions, confidentiality, service providers and subprocessors, security measures, incident notification, deletion or return, and audit rights. Counsel approval and customer execution are required before the template can be treated as an effective agreement.

We may update this policy when the service or applicable requirements change. The date at the top of this page identifies the latest version. Material changes should be reviewed by organizations using nnhans before they continue collecting new information through the service.